Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
1answer
181 views

Where does Credential Manager store credentials on the file system?

I want to clear a users stored credentials on a remote machine. Without having to have the user login and open the Cred manager GUI or run CMDKEY with them logged in. Is there a place on the file ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
0
votes
0answers
18 views

Website was hacked but only 1 domain [duplicate]

I recently found out that one of my Domains (which was only a empty Wordpress installation), was hacked. The website didn't show the wordpress installation anymore, instead there was just a website ...
1
vote
1answer
32 views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
3
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
1
vote
3answers
85 views

Secure Administration AD Domain

I have a project to securize my Active Directory infrastructure. To do that, one of my colleague told me about the possibility to create another AD domain in the forrest just for administration. That ...
1
vote
2answers
51 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
1
vote
4answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
22 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
1
vote
0answers
20 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
3
votes
3answers
3k views

what's the difference b/w MMC.exe and certmgr.msc

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove ...
1
vote
1answer
1k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
0
votes
0answers
10 views

Secure an external linux distro

I have a fairly complex situation, I have researched all the parts required before asking this question. I am trying to make a bootable linux distro on which I have an app that is located on an ...
0
votes
0answers
10 views

Error with security constraint in Tomcat

I have a problem setting up a login with password in a web application, but returns me a 404 error when I try to access the website. My first step was add a new role and user in tomcat-users.xml: ...
1
vote
1answer
24 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
0
votes
0answers
20 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
0answers
14 views

RSH from Linux to WIN7 and access COM port

I have a script(run on a Linux machine) , and does the following rsh to a Windoes machine (rsh XX.XX.XX.XX CMD) cd to a directory (cd YY) run a script (say ZZ.pl --someargument) it runs fine when ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
0
votes
1answer
27 views

Do “Old Passwords” have an expiration?

There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc. Do these "old passwords" have an expiration? ...
0
votes
1answer
18 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
18
votes
11answers
10k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
-2
votes
0answers
41 views

does 22 port should open in firewall when internal user want to use services on 22 port

user in internal network want to communicate outside via 22 port to access a particular URL. do i need to open 22 port in firewall? is there any solution to fix this issue with altering security ...
0
votes
0answers
7 views

Two network cards, one directly to internet, other in LAN [migrated]

I need some insight in my thinking so that I don't do something completely stupid. I have two physical network cards on my computer, one card/interface offers a handful of services and the other is ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
15
votes
2answers
10k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
4
votes
2answers
23k views

Remote Desktop Connection Denied because the user account is not authorized for remote login

I have set up Terminal Services in Windows 2003. Which is part of the domain. That server is not DC. It has only one role: Terminal Server When I'm trying to log in to it via RDP as an Domain ...
0
votes
2answers
33 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
-1
votes
1answer
24 views

FTP Port Protocol Type

I recently switched to a different VPN provider, therefore did a fresh server installation. Before I proceed, please keep in mind that I am not super experienced with server stuff. I am having a ...
-2
votes
0answers
29 views

Ownership permissions with current Nginx configuration a security issue? [duplicate]

Today I set up Nginx and PHP5-FPM with my main account named Nick in Ubuntu server by changing the user and group defintions of nginx.conf and www.conf, so that both instances are running under my ...
2
votes
1answer
16 views

Insider threat and Office 365 - STIGs or similar results?

Office 365 is a convenient way to keep work in-synch between multiple computers and smart phones. However, for cases where one is contractually obligated to safe guard and protect a client data and ...
0
votes
1answer
32 views

Secure way of granting access to production database

We are currently using the FedEx Ship Manager in our warehouse and would like to automate the process of entering customer shipping information automatically. Inside the ship manager there is an ...
-2
votes
0answers
19 views

server getting hacked daily how to fix it [duplicate]

my server gets hacked daily 1: after i restore back and see next day my .htacess files seem to be modified 2: google keeps on showing error with hacked content how can i fix error 1: i found no ...
0
votes
0answers
17 views

Tornado server on port 80/443, any issues?

I would like to run an application based on the Tornado web server in a production environment. The performance requirements are low. Since I don't need a load balancer, I wonder if it is OK to have ...
0
votes
0answers
26 views

VPN revocation error?

I have managed to successfully configure a SSTP VPN connection on my internal client PC, but only through registry fixes. I keep getting this error relating to checking to see if the server has been ...
1
vote
1answer
33 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
2
votes
7answers
595 views

My site hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I just discovered that my site has, I believe, been hacked. Along with a couple of other sites on my host. If you go to the bottom ...
3
votes
1answer
19 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
20
votes
3answers
33k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
2
votes
5answers
8k views

Prevent SSH from advertising its version number

The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client. If I telnet to my host on port 22 it tells me the exact version of SSH I am ...
0
votes
1answer
42 views

Windows Server 2012 - How to get the username/password of an IP that is trying to connect using RDS?

I'm new to server admin, hence my apologies if this is a very basic question. I was going through my server's event log when I noticed under 'Application and Service Logs > Microsoft > Windows > ...
32
votes
2answers
4k views

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

I'm unsure if this should be asked here or over on security.stackexchange.com... Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print ...
1
vote
0answers
33 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
0
votes
1answer
3k views

PureFTPd : How to have user isolation?

I've installed pureFTPd, with a mysql database on a debian distribution. I used the following tutorial. But now if I'm logging, I see that I'm in the /Data/www/MyUserDirectory. AND I can browse to /. ...
1
vote
1answer
30 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
1
vote
0answers
33 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
-2
votes
1answer
66 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
13
votes
7answers
9k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
2
votes
3answers
491 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
0
votes
2answers
112 views

Gateway Anti-Virus vs Desktop Anti-Virus

I need your help with a question on Gateway Anti-Virus and Desktop/Server Anti-virus. The example I have is the following: You have a network of 50 machines (Desktops/Servers) which includes a ...