Security is not a product, but a process.

learn more… | top users | synonyms (1)

53
votes
3answers
9k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
1
vote
2answers
185 views

FTP SITE CHMOD Error

When trying to edit file/folder permissions via FTP I am getting the error: 505 Security server forbids SITE commands. Contact admin. I am currently using VSFTPD with the config value ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
20
votes
3answers
2k views

how to secure an open PostgreSQL port

So, this is the situation. It seems we need to have an open TCP port 5432 to the world, where a customer has access to his PostgreSQL database. For obvious reasons, we can't say just "no", only as a ...
0
votes
2answers
676 views

EC2 Load balancer and wildcard/multi-domain SSL certificates

I am running three sites through one load balancer (and 2 child-application servers) One of the site's has an SSL certificate, but I'd like to add a certificate for the other two sites What is my ...
-1
votes
0answers
4 views

How can a WiFi router recognize MAC address change of a connected device? [migrated]

My teen son and I are playing a hacking game. I've installed an WiFi router with parental controls, MAC filtering, VPN, etc. I block Internet for him, he tries to break out of the cage (for now I'm ...
0
votes
0answers
17 views

How to secure a website with Apache ModRuid2 enabled

On webservers that I have built and administer, I am able to use group permissions and ACLs to decide what access can be given to Apache. This works quite well as I can have a small number of ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
4
votes
4answers
3k views

can localhost be spoofed?

Is it possible for a remote machine to access another machine's localhost data by spoofing the loopback ip? Say if I wanted a setup where if I'm connecting from somewhere outside my own network, I ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
0answers
13 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
0
votes
0answers
13 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
1
vote
1answer
22 views

Nginx config subdomain exhibiting strange behaviour

I've got two identical droplets running on digital ocean. Both running Ubuntu 14.04 with nginx, gunicorn and Django. I am trying to park a subdomain of mine onto the IP of one of the droplets. On the ...
2
votes
1answer
31 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
0answers
21 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go ...
1
vote
1answer
7k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
-1
votes
2answers
30 views

Do I need mutlipe certificates for mutliple services running

I did a lot of research on this but still I am confused about how many certificates I need to self-sign for each of my services running on my private server. Here is the deal: I am creating my own ...
0
votes
2answers
39 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
17
votes
6answers
5k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
1
vote
1answer
1k views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
1
vote
1answer
82 views

Q: Strange web traffic - Is this an attack?

I recently noticed some strange traffic in my nginx access logs. I'm not sure if these indicate an attack, a mistake, or something else. I've started sending these to HTTP 444, so these logs will ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
2answers
53 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...
0
votes
1answer
39 views

What type of SID ends with -0?

I have been parsing through the logs and found a random sid doing authentications against AD. It is as follows "s-1-5-21-xxxxx-xxxxx-xxxxx-0"; It cant be found in domain or forest. I want to know if ...
2
votes
2answers
30 views

Is it safe to change the owner of the document root?

Does it pose a security risk if I change the owner of the document root on Apache? I've been spoiled by generic website hosting providers. I'm used to SFTPing my files over to the host and hitting ...
0
votes
1answer
21 views

How to restrict network access by user on a Windows multitenant machine?

I have a multitenant windows 2012 machine running several IIS WebSites, each running it's own application pool with its own windows user identity, and I need to restrict the all outbound network ...
0
votes
1answer
35 views

Can VPN authentication be used for SSH?

Can VPN authentication details be re-used for SSH access? Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without ...
4
votes
2answers
4k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
1
vote
2answers
114 views

sketchy nginx access log entries

There were quite a few entries as below in the nginx access log. How do I know the outcome of these scripts and if my server is compromised or no? 162.232.183.48 - - [14/Jan/2016:10:54:57 +0000] "GET ...
1
vote
0answers
30 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
54
votes
5answers
13k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
1
vote
1answer
47 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
0
votes
1answer
94 views

How to prevent password expiration in apache Archiva

I am running a standalone Archiva 2.2.0 installation. I added security.properties file to ~\conf directory. In security.properties I defined: security.policy.password.expiration.days=999999 ...
0
votes
3answers
1k views

Deny directory browsing in a Proftpd / Ubuntu Installation

I used this guide to set up a Proftpd installation an Ubuntu 8.04 server... Works well, but the generic user ( userftp ) can run ls and is able to change to any Directory and browse freely on the ...
3
votes
1answer
1k views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
0
votes
2answers
2k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
15
votes
2answers
566 views

What is the Rowhammer DRAM bug and how should I treat it?

DRAM chips are very tightly packed. Research has shown that neighboring bits can be flipped at random. What is the probability of the bug triggering at random in a server-grade DRAM chip with ECC ...
5
votes
3answers
2k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
1answer
38 views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
0
votes
2answers
49 views

improving soho network security

My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data ...
0
votes
0answers
18 views

Windows CE lockdown

My company just began purchasing Windows CE 5 & 7 based devices. The only application that they need to run is Remote Desktop. I am looking for solutions to lock them down so our users cannot ...
0
votes
0answers
25 views

How to block zip files containing executable (exe, jar) using Squid?

Squid Proxy Server is blocking exe and jar files by file extensions and meme type (for http traffic). However, if exe or jar files/programs are within zip files, then it is not blocking. The ...
1
vote
2answers
109 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
3
votes
6answers
2k views

How to check, if IPs in your network are blacklisted?

I would like actively monitor, if any of my network IPs are on blacklists. Here I would like to collect links to instructions, how to sync blacklists, which allows that.
0
votes
0answers
16 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
1
vote
2answers
10k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
43
votes
5answers
32k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
0
votes
0answers
8 views

Sharing VPN access to my LAN - security concern [migrated]

I recently subscribed to a VPN service (Vpnsecure.me) and I have been thinking to share it to my all LAN via my synology NAS or my raspberry PI. Before configuring my devices, I would like to know how ...
3
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...