Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
3answers
3k views

what's the difference b/w MMC.exe and certmgr.msc

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove ...
1
vote
1answer
1k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
0
votes
0answers
10 views

Secure an external linux distro

I have a fairly complex situation, I have researched all the parts required before asking this question. I am trying to make a bootable linux distro on which I have an app that is located on an ...
0
votes
0answers
10 views

Error with security constraint in Tomcat

I have a problem setting up a login with password in a web application, but returns me a 404 error when I try to access the website. My first step was add a new role and user in tomcat-users.xml: ...
1
vote
1answer
24 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
0
votes
0answers
19 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
0answers
13 views

RSH from Linux to WIN7 and access COM port

I have a script(run on a Linux machine) , and does the following rsh to a Windoes machine (rsh XX.XX.XX.XX CMD) cd to a directory (cd YY) run a script (say ZZ.pl --someargument) it runs fine when ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
0
votes
1answer
27 views

Do “Old Passwords” have an expiration?

There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc. Do these "old passwords" have an expiration? ...
0
votes
1answer
18 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
18
votes
11answers
10k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
-2
votes
0answers
37 views

does 22 port should open in firewall when internal user want to use services on 22 port

user in internal network want to communicate outside via 22 port to access a particular URL. do i need to open 22 port in firewall? is there any solution to fix this issue with altering security ...
0
votes
0answers
7 views

Two network cards, one directly to internet, other in LAN [migrated]

I need some insight in my thinking so that I don't do something completely stupid. I have two physical network cards on my computer, one card/interface offers a handful of services and the other is ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
14
votes
2answers
10k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
4
votes
2answers
23k views

Remote Desktop Connection Denied because the user account is not authorized for remote login

I have set up Terminal Services in Windows 2003. Which is part of the domain. That server is not DC. It has only one role: Terminal Server When I'm trying to log in to it via RDP as an Domain ...
0
votes
2answers
32 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
-1
votes
1answer
24 views

FTP Port Protocol Type

I recently switched to a different VPN provider, therefore did a fresh server installation. Before I proceed, please keep in mind that I am not super experienced with server stuff. I am having a ...
-2
votes
0answers
29 views

Ownership permissions with current Nginx configuration a security issue? [duplicate]

Today I set up Nginx and PHP5-FPM with my main account named Nick in Ubuntu server by changing the user and group defintions of nginx.conf and www.conf, so that both instances are running under my ...
2
votes
1answer
16 views

Insider threat and Office 365 - STIGs or similar results?

Office 365 is a convenient way to keep work in-synch between multiple computers and smart phones. However, for cases where one is contractually obligated to safe guard and protect a client data and ...
0
votes
1answer
32 views

Secure way of granting access to production database

We are currently using the FedEx Ship Manager in our warehouse and would like to automate the process of entering customer shipping information automatically. Inside the ship manager there is an ...
-2
votes
0answers
19 views

server getting hacked daily how to fix it [duplicate]

my server gets hacked daily 1: after i restore back and see next day my .htacess files seem to be modified 2: google keeps on showing error with hacked content how can i fix error 1: i found no ...
0
votes
0answers
14 views

Tornado server on port 80/443, any issues?

I would like to run an application based on the Tornado web server in a production environment. The performance requirements are low. Since I don't need a load balancer, I wonder if it is OK to have ...
0
votes
0answers
26 views

VPN revocation error?

I have managed to successfully configure a SSTP VPN connection on my internal client PC, but only through registry fixes. I keep getting this error relating to checking to see if the server has been ...
1
vote
1answer
31 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
2
votes
7answers
595 views

My site hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I just discovered that my site has, I believe, been hacked. Along with a couple of other sites on my host. If you go to the bottom ...
3
votes
1answer
19 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
20
votes
3answers
33k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
2
votes
5answers
8k views

Prevent SSH from advertising its version number

The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client. If I telnet to my host on port 22 it tells me the exact version of SSH I am ...
0
votes
1answer
35 views

Windows Server 2012 - How to get the username/password of an IP that is trying to connect using RDS?

I'm new to server admin, hence my apologies if this is a very basic question. I was going through my server's event log when I noticed under 'Application and Service Logs > Microsoft > Windows > ...
32
votes
2answers
4k views

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

I'm unsure if this should be asked here or over on security.stackexchange.com... Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print ...
1
vote
0answers
33 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
0
votes
1answer
3k views

PureFTPd : How to have user isolation?

I've installed pureFTPd, with a mysql database on a debian distribution. I used the following tutorial. But now if I'm logging, I see that I'm in the /Data/www/MyUserDirectory. AND I can browse to /. ...
5
votes
3answers
2k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
1answer
28 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
1
vote
0answers
33 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
-2
votes
1answer
65 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
13
votes
7answers
9k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
2
votes
3answers
484 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
0
votes
2answers
112 views

Gateway Anti-Virus vs Desktop Anti-Virus

I need your help with a question on Gateway Anti-Virus and Desktop/Server Anti-virus. The example I have is the following: You have a network of 50 machines (Desktops/Servers) which includes a ...
2
votes
2answers
54 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
2
votes
2answers
89 views

Run command after N failed local login attempts

Any good ways of running a linux command (shell script for instance) when N failed local login attempts happens? Maybe using pam_tally?
1
vote
2answers
43 views

Is Office365 Message Encryption actually secure?

I'm looking at implementing Office365 Message Encryption for our organization. My question is this: is it actually more secure than regular (unencrypted) email for messages sent to users outside the ...
0
votes
0answers
24 views

Docker / LXC and PCI-DSS Compliance

We are in payment space and we have built out a lot of our processes in Docker for development environment purposes. Now, we are thinking about converting our production environment which is in Xen ...
0
votes
1answer
2k views

How to set Windows Services permissions from Powershell?

I need to grant a specific account SERVICE_START permissions for a given Windows service. There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and ...
-4
votes
2answers
42 views

Config to allow SQL Server to be connected through CloudFlare?

I have already known the risk of exposing SQL Server database on the Internet, but please look at my situation: I have two instances of SQL Server: production (default instance SQLEXPRESS) and dev ...
1
vote
0answers
42 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...