Security is not a product, but a process.

learn more… | top users | synonyms (2)

22
votes
10answers
18k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
-3
votes
0answers
34 views

Is my vps being hacked? [duplicate]

I'm on a debian vps that was rebuild from scratch a few hours ago. In ps aux I get weird entries and commands I haven't started: root 2553 0.0 0.1 3164 1616 pts/0 Ss 23:09 0:00 -bash ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
2
votes
3answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
-2
votes
2answers
49 views

Removing the Security Alert Outlook pops up for internal network domain clients - Remove security?

I have several Outlook clients on the internal network pointing to the internal DNS name of the Exchange 2010 SP1 R2 server. The name we're using is exchange2.example.local. Since new guidelines ...
0
votes
0answers
49 views

Enabling the Internet Connection on an EC2 Windows Server 2012 Machine

I've disabled the firewall: netsh firewall set opmode disable I've made sure to accept all inbound and all outbound connections: Is there anything that I should be installing or adding on to the ...
2
votes
2answers
58 views

Restrict access to active directory attributes from a particular computer?

I know that some attributes in AD are classified as personal information and some are classified as public information (see the "property set" column here - ...
329
votes
13answers
57k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
-6
votes
0answers
52 views

How to bring a hacker to justice? [duplicate]

One of my sites disappeared. Or to be exact httpdocs and httpsdocs were wiped out Logs showed, that the server started to generate 404 errors after this request: 89.248.172.175 - - ...
1
vote
2answers
65 views

Should I sudo as root or use a public key [duplicate]

I have read a few times to disable root login and sudo as root using another user. But is using a public key as good if not better security?
0
votes
0answers
13 views

setting up DANE fails, error with “could not get cert chain from ssl”

I successfully setup DNSSEC and enabled it on my domain. I'd love to make use of my DANE. I created a standard self signed certificate openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem ...
0
votes
1answer
11 views

How to stop username enumeration in Samba on Ubuntu?

I'm using Ubuntu 12.04 LTS to serve a web application to a local Windows network. A recent pen test highlighted that it was possible to enumerate local user accounts on the Samba service. I have been ...
0
votes
1answer
16 views

Solaris 11 / OpenSolaris - stop processes from listening?

I would like to write a script to secure Solaris 11 servers in preparation for internet access. In addition to enabling ipfilter, I would like to disable network-accessible services that are not ...
0
votes
0answers
26 views

Remove mapping drives from RDP to user from exteral network

I would like to know if you guys have a solution to my problem. I have a terminal server 2012 that can be accessed remotely after a VPN connection and from the LAN. My question is how can I create a ...
-3
votes
1answer
29 views

Data Backup from aws to other cloud storage for backups if aws account get hacked [duplicate]

We are thinking to make a backup of all our AWS data (RDS and S3) to some other cloud sources, because there is a possibility that a developer of company AWS account get hacked. The hacker could then ...
0
votes
0answers
29 views

Server 2012 LDAP signing - “Number of simple binds performed without SSL/TLS..”

Here is our log on event 8227: Number of simple binds performed without SSL/TLS: 88 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0 I have set LDAP Interace Events ...
0
votes
1answer
7 views

FIM2010 R2 SP1 service account requirements on database after installation

We're in the process of updating our Forefront Identity Manager to 2010 R2 SP1. The SQL Server instance for the old installation has the FIM service account in the sysadmin role, as is required for ...
11
votes
9answers
8k views

How to secure a public facing Remote Desktop Server?

I am looking at needing to expose my Remote Desktop Server (Terminal Services) to be accessed from outside our network. Right now, it can only be accessed from inside our network. I know it's easy ...
4
votes
2answers
862 views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
1answer
17 views

Disable Apache server signature [closed]

I've just set expose_php to off via WHM's Configure PHP and suExec. For security purposes I want to additionally hide: Apache ServerSignature/ServerTokens/PHP X-Powered-By I can't find a relevant ...
7
votes
3answers
2k views

How to securely manage private keys for EC2-managed key pairs?

In order to launch an EC2 instance you need a key pair. How do you handle the situation where an engineer with acccess to the private key for that key pair leaves the company? Would it work to add ...
3
votes
1answer
204 views

Determine if possible successful probe is successful exploit?

A logwatch report outputted the following message. A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that ...
-1
votes
0answers
16 views

Restrict access to one VPC in AWS

I am trying to restrict users to a single VPC. I went through Controlling Access to Amazon VPC Resources and came up with the following policy but it does not work. Can someone point out the errors in ...
4
votes
1answer
928 views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
1
vote
1answer
52 views

Kerberos SSH Man-in-the-Middle for Data Sniffing

Kerberos clearly keeps an attacker from getting a user's credentials in an SSH man-in-the-middle scenario (one where the attacker has gotten the user to trust their server's public key and redirects ...
-6
votes
1answer
36 views

Verify HASH value of certificate [closed]

How can I verify Hash value of a certificate I get from a website using openssl? Say for example or facebook.com.
-2
votes
1answer
25 views

EV Certificate on browser [closed]

How does the browser recognise that the presented certificate actually is an EV certi cate? I went through this article but I couldn't figure out any thing for sure.
1
vote
1answer
100 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
1
vote
2answers
4k views

Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?

I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
0
votes
0answers
14 views

Cups Does not ask for authentication for remote access at all, it will either not ask and work or not ask and not work

I can find an infinite amount of questions asking how to remove authentication but I cant seem to find any that want to be asked for a prompt before being able to access the web service GUI. I have ...
2
votes
5answers
30k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
0
votes
0answers
34 views

Lock Down Users on Cygwin SFTP Server

How do I lock down sftp users in Cygwin so that they can't read from random directories such as /etc. i set up local windows accounts for each sftp user on the machine. I've used /etc/fstab file to ...
0
votes
1answer
924 views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
-1
votes
0answers
12 views

how to get tripwire to warn if a file exists

When I configure tripwire policy, I have to comment out files that don't exist so tripwire doesn't give an error. But what if I want to test for a file suddenly existing? Suppose I want to test, for ...
6
votes
3answers
3k views

Does windows Remote Desktop have any protection against brute force attacks?

If I were to have a server (Windows Server 2008) out on the internet that is allowed Remote Desktop connections, is there anything to stop random people from trying brute-force Username/password ...
0
votes
1answer
35 views

Apache - Drop connection for anything but HTTP 200 status

Is there a way to configure Apache to drop connection for any request resulting in an HTTP status other than 200 (or possibly a list of status codes)? The idea is that, rather than returning any ...
0
votes
1answer
36 views

Why should I remove firewall rule after application exit?

I have a server which listens on port 80 for incoming requests - using HttpListener. I've found that to be able to do that, I need to open up the port (add a firewall rule which enables me to listen ...
3
votes
5answers
284 views

OK, so I'm running a Windows Server 2008 and my friend called me an idiot for not using remote desktop to administrate it. Why?

I mean, I understand that it's kind of a risk to directly log on. But why should I just administrate it via Remote instead of directly manipulating it? :S
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
1
vote
1answer
54 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
7
votes
1answer
100 views

PCI-DSS: Virtualization segmentation in ESXi environment

I have already asked this question over on Information Security but so far it has not garnered any comments. I am thinking perhaps it is more of a server infrastructure and configuration question, ...
0
votes
1answer
35 views

Does Active Directory alone is not enough to secure hadoop?

I am trying to secure Hadoop environment installed in windows. So basically I started to analyse how to secure a Unix-based hadoop cluster. Have gone through various links related to Kerberos and ...
0
votes
0answers
19 views

What if Security ID and Account Name differ on Windows Security Event Log

the latest MS Kerberos Vulnerability let us search our Security Event Logs for potential attackers. According to a technet article, to identify an attacker you have to search for non matching security ...
-2
votes
0answers
22 views

Digital Ocean droplets get locked down because of outgoing DDOS attacts [duplicate]

Two of my droplets were locked down this week from my account for an apparent reason of outgoing DDOS attack. My first machine was allegedly compromised on Nov 18 2014 and my networking is brought ...
1
vote
2answers
51 views

How to limit dynamic DNS updates

First off, I'm sorry if this is vague, but I'm not very familiar with DNS or DNS terminology. What I'm trying to do: I want to limit what hostnames are allowed to dynamically update DNS. I don't ...
0
votes
2answers
654 views

How do I set permissions for uploading media in WordPress? (Ubuntu 14.04.1, nginx 1.4.6)

I'm having trouble finding the correct permissions for running a WordPress site on my droplet. I followed this guide to configure the site: How To Configure Secure Updates and Installations in ...
1
vote
1answer
65 views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
42
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
2
votes
2answers
810 views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
-1
votes
1answer
49 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?