Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
94 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN msg=audit(...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
0answers
26 views

How secure is it to use secret directory names to share files on unix? [migrated]

There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users. mkdir share chmod 711 share #others can traverse share, but can't list its ...
2
votes
2answers
87 views

Martian sources from my public IP

These days I get some Martian packets in the kern.log: Jul 7 02:28:20 box14932 kernel: [789192.798073] IPv4: martian source XXX.XXX.XXX.XXX from 10.91.12.01, on dev eth1 Jul 7 02:28:20 box14932 ...
0
votes
2answers
40 views

Powrshell Script to read the Windows Secutiry logs and filter Elevation type 196 and 1937

I have a powershell script that reads the elevation type and displays the content in powershell window. However I need to put the contents in Excel file. Please help. cls $evtLogEntries=$null $...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
4answers
141 views

do I still need to block attacks on my server once I lock it down by ip?

I have a public dedicated server that clients log in to via RDP. I am using rdpguard to block bad RDP logins attempts on my server. Recently, I locked it down to only allow specific IP addresses ...
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
1
vote
1answer
21 views

ModSecurity duplicate anomaly logs reported instead of single

This is my second time configuring ModSecurity with the OWASP ruleset. Previously I've used version 2.2.5 of the ruleset and now on a different server 2.2.9. I'm trying to configure anomaly detection ...
0
votes
0answers
18 views

Restricting SQL Server Management Studio using LogMeIn Hamachi

I have a SQL Server 2016 instance on Windows Service 2012 VM running in Azure. Currently the network security group/firewall allows for port 1433/TCP traffic so I can connect from my PC using SQL ...
0
votes
1answer
9k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
2answers
58 views

OpenStack Horizon behind reverse proxy (nginx preferred)

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
0
votes
2answers
26 views

Strange characters in nginx log starting with \x

I was hacked and checking nginx logs I found several requests like this one: 169.229.3.91 - - [18/Jun/2016:09:42:19 +0000] ")\xE7\xD1?\xD6\x18.\xC0\xCE\xA3\x7FR\xEA~O$\x0BLi\x13\xA0m\xE7\xF0H4\x92\...
0
votes
1answer
14 views

Centos 6 Require Password to Enable NIC

We are using a dedicated NIC as a port forward target to allow support access to port 22 on a CentOS 6 machine. I would like to prevent the NIC from being enabled without a password. I know I could ...
1
vote
2answers
27 views

Securing Mail From Admins - Office 365

I'm trying to determine the best solution that allows me to assure our CEO that his Office 365 mailbox cannot be read by anyone, including myself, an admin. Obviously the mailbox is already locked ...
6
votes
6answers
9k views

SSH access problem: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

We have a server XXX ON Amazon EC2. SSH is running on a standard (22) port. I placed my pubkey at the /.ssh/authorized_keys file The fun thing is that YESTERDAY it was working great! But today, I ...
1
vote
1answer
17 views

Apache SSL FS disable SHA1

I am using apache 2.2.15 and are about to make it as secure as possible. When I do a scan of one of my websites via the Qualys SSL Test. https://www.ssllabs.com/ssltest/analyze.html It lists me the ...
2
votes
1answer
1k views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
0
votes
1answer
732 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
49
votes
7answers
34k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
-3
votes
0answers
24 views

Secure tomcat (by ip AND basic auth) [duplicate]

I have a server working with tomcat. Inside webapps i've secured one folder. This folder has basic auth to access, all this works. What i need is to protect this folder in another way. Only people can ...
0
votes
0answers
14 views

Multi user passwordless directory specific ssh login

I am running Ubuntu 14.04 LTS. I want to allow multi user passwordless ssh login. But I want to give directory specific ssh access. For example: My home directory(server home) has two folders user1 ...
26
votes
9answers
14k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
3answers
117 views

Are there any disadvantages of blocking port 80 for security reasons?

To improve security, we would like to make https access to all customer sites that we host mandantory, and guarantee this in our terms and conditions. The problem is that currently the Apache ...
-1
votes
1answer
12 views

sendmail : closing port 25

Nmaping my server I got theses results : PORT STATE SERVICE 25/tcp filtered smtp 80/tcp open http On the server-side : netstat -lpn Proto Recv-Q Send-Q Local Address ...
0
votes
1answer
13 views

ModSecurity IIS Block Out of Country IPs by X-Forwarded-For

Problem We've had someone that has been trying to crawl our site with random, malicious urls (for about 12 hours now). Here is the log file 2016-06-29 08:17:02 10.X.X.X GET /assets/plugins/lightbox/...
0
votes
1answer
25 views

Is it safe to use only iptables for security?

I have 2 servers on different machines. First machine should send requests to second machine via tcp. Both machine have static ip addresses. Does it secure to protect this interaction between servers ...
0
votes
2answers
2k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
4
votes
2answers
4k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
23 views

AWS EC2: Secure configuration via IP access list

My company have a network with a fixed IP address/IP address range. Is it save when I configure my Security group that all traffic from this IP address will be accepted and everything else will be ...
0
votes
0answers
12 views

MYSQL error: IP address could not be resolved [duplicate]

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there ...
0
votes
1answer
38 views

How to make git forget my credentials

I am using GIT in windows. The repository stores my credentials and uses it for manipulating remote directory. For security reasons, I want to manually enter my credentials every time I do ...
0
votes
0answers
29 views

avoid data leak by block internet access for PCs, but allow internet access through remote desktop

In a small network(in my company), I would like to block some computers(PCs) to access the internet, so that sensitive data or files in those PCs can not be leaked. But I still need users of the PCs ...
-4
votes
2answers
50 views

Does it make sense to have a server dedicated to login? [closed]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
0
votes
1answer
235 views

TACACS+ configuration: how to receive priv-lvl value?

I need to configure TACACS+ server to know if the given user is authenticated* and what is his priv-lvl. As a client I'm using tactest (tacacs.net) and TACACS+ Client Java Library (AXL). I tried with ...
3
votes
2answers
51 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
0
votes
0answers
25 views

Web server got compromised (What to do next?) [duplicate]

My webserver got compromised (I think). The last 3 days inbound traffic spiked up to abnormal levels, in 3 days +/- 2.5TB of bandwith got used. when reading my access logs I see thousands of requests ...
0
votes
0answers
273 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false configs....
8
votes
3answers
816 views

Password similarity

I wanted to change my password on a unix machine. I did a normal "passwd" and typed in my old and my new password. Then the machine came back to me with the following message: BAD PASSWORD: is too ...
1
vote
3answers
1k views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
-1
votes
1answer
31 views

Updating Ubuntu Webserver

Our webserver is on AWS running on Ubuntu 14.04.3 LTS. When I ssh into the server I see this message. 196 packages can be updated. 123 updates are security updates. Should I update our ...
0
votes
0answers
15 views

FTP file upload positive or negative file extension list

I'm setting up an FTP on IIS and I want user's to not be able to upload possible dangerous files based on file extensions. Now I'm uncertain if I should create a positive list to allow or negative ...
0
votes
0answers
18 views

Tracking filesystem changes in runtime

I need to have program that tracks changes made to the file e.g. when I am installing software from supplied installer instead of packages. I do not want to checksum every file in filesystem because ...
1
vote
1answer
33 views

Security of SSL certs on AWS ELBs / SSL offloading

I have some concerns about security and am wondering how AWS will store an SSL certificate deployed to an ELB. I have a wildcard SSL cert for my domain that I want to make sure doesn't persist ...
0
votes
0answers
23 views

Arch Linux install without root password

Is it possible to install (and later maintain) Arch Linux (or some of its derivatives) without ever setting root password - using only user account and sudo? The same way it's done in Ubuntu and many ...
1
vote
1answer
174 views

Every website on the server redirects to a foreign page, even after clean install

First of all, this is my first time posting here, so sorry if I posted in the wrong section. To get to the point: I have a CentOS 7 + Gnome server, with VestaCP configured and running 2 WordPress ...
0
votes
1answer
38 views

How make Docker auto-survive kernel upgrades and restart?

Brief question: Docker, Ubuntu 16.04, auto-security-upgrades & reboot. Then how can I ensure the newest linux-image-extra-`uname -r` has been installed before Docker attempts to start the ...
1
vote
3answers
125 views

How to simulate a WORM environment w/Active Directory/NTFS

In NTFS/Active Directory, assume I have two drives mapped: H:\ I:\ Users can edit files in H:\, but not in I:\ . I want users to be able to, using a script, move their files to the I:\ drive unless ...