Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
2answers
56 views

From a technical perspective, is my data insecure when using a public VPN like SecurityKiss?

I wonder if I understand well VPN. I connected to SecurityKiss, they provide a list of TunnelBlick configs. In order you to connect their VPN. (TUnnelBlick is OpenVPN based). Am I right : your IP is ...
0
votes
2answers
14 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
2answers
144 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
2answers
34 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
6
votes
2answers
3k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
0
votes
0answers
10 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
20 views

Nginx Default/Welcome Page Suddenly Returns

I installed Nginx a number of months ago and deployed some code. I obviously deleted the default index.html Nginx default page. I know this for certain as PHP was not installed and so index.html was ...
11
votes
2answers
465 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
0
votes
0answers
13 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
0answers
23 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
3
votes
2answers
74 views

How worried should I be about unsecured HTTP on a “private” network?

So I've joined a new team, which develops and operates a service available on the Internet. It's aimed at B2B use rather than consumer, although anyone can sign up for a low-tier account to check it ...
7
votes
7answers
11k views

How to detect rogue WIFI routers on a network?

My client recently changed their network policy so now all WIFI routers are disallowed from the network. They said they would be running some scans and that they would be able to find "rogue" WIFI ...
6
votes
3answers
748 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
1
vote
2answers
51 views

site-to-site vpn tunnel - does hardware matter? [closed]

I have been tasked with setting up 4 offices and connecting them all together so they can be on the same network. Does hardware really matter or could I build a decent machine in the low $1000's and ...
0
votes
1answer
17 views

How to manage access to nodes in a cluster?

I am about to set up a server cluster for our company's web applications. At the beginning there will be 3 hardware servers in Proxmox HA setup in a remote datacenter running about 20-30 VMs all ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
0answers
23 views

Garbage files in public_html folder. Is this a security breach? [duplicate]

The public_html folder on my site just got uploaded with a ton of garbage html files with filenames such as vonzipper-sunglasses-men-25jh27.html and tumi-daypack-04po59.html as well as several files ...
0
votes
1answer
158 views

secAst lib prerequisites too new for Debian/Utuntu 12 LTS?

as requested in FAQ I wrote here the question (there is no question for this product yet on this site?) This Asterisk securing tool looks very nice so I tried to test it out: ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
39
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
0
votes
0answers
35 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
8
votes
5answers
24k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
1
vote
4answers
11k views

Password protect file folders on FTP site

We have an FTP site with a single username/password that we provide to people as they need it. We are unable to create a new username/password for every person that might need to access the site, but ...
-2
votes
1answer
21 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
0
votes
0answers
10 views

Application Virtualization Risk Through WAN / Internet

I was weighing pros and cons about the new mission critical system that through application virtualization, will allow my colleagues from 3 different countries to access it. Here are some background ...
3
votes
10answers
8k views

Real one-time passwords (OTP) on Linux other than S/Key? [closed]

Surely it is no good idea to log into a remote system from an untrusted computer. But sometimes it is plain necessary. Exposing an unencrypted SSH keyfile is no option of course. Entering a regular ...
0
votes
1answer
24 views

Can I use an IAM role to grant my Heroku app access to my Amazon S3 bucket?

Heroku: Using AWS S3 to Store Static Assets and File Uploads suggests using my AWS security credentials to enable my Heroku app to access my Amazon S3 bucket. However, isn't it better practice (as ...
2
votes
1answer
60 views

Multi-site hosting security - ensure no scripts can run as Apache user, but only as each website's user

In setting up a hosting environment with multiple sites that should be isolated from each other, I did the obvious step of having PHP be configured so it runs as the user that's associated with each ...
0
votes
1answer
21 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
1
vote
1answer
69 views

Minimizing attack surface on fresh 2012 R2

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my ...
13
votes
3answers
2k views

Wipe is very slow. Too little entropy?

I have to hand off a Laptop including its hard disc. Since it was not encrypted I wanted to wipe it at least quickly. I know this is not optimal on SSD, but I thought better than just plain readable. ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
2
votes
2answers
3k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
2k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
1
vote
1answer
4k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
0
votes
1answer
47 views

Extra SSL Certificate For Database Server?

I have three servers: Web-Server Database Server Database Replication Server In the upcoming days, I am going to order a SSL certificate for the Web-Server to deliver the data encrypted to the ...
0
votes
1answer
34 views

Do not allow all domain users to have access to a shared folder

This should be easy, but I just don't see it. And, first, I'm a programmer wearing the hat of an IT for lack of resource where I work (small company). I need to create a folder, inside our network ...
-1
votes
0answers
21 views

Mirror Raid to Single Harddisk ACPI BIOS in the system is not fully compliant with the ACPI [migrated]

My server used to be setup as a Mirror which means the 2nd harddisk would take the image of 1st harddisk. In anycase 1st harddisk is dead, 2nd harddisk would take over. It wasn't setup by me & ...
0
votes
4answers
209 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
16
votes
6answers
19k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
0
votes
0answers
21 views

How can I secure an insecure Meteor by using Nginx?

I have an insecure Meteor running on AWS. For those not familiar with Meteor, that means I am using the "insecure" package, which trades security for rapid prototyping. I only need our development ...
0
votes
1answer
37 views

Is it a security issue if I have GIT working copy in www?

If I checkout a working copy into the www root of my site, would that be a security vulnerability?
1
vote
1answer
20 views

Linux security implications for sudo, su to service account & add secondary group to admin Tomcat?

I have a named account to login to a Linux host. Tomcat is running under a Service Account named "tomcat" I periodically need to do admin functions like modify tomcat-users.xml which is configured ...
1
vote
1answer
14 views

Accept only new file uploads over SSH

We want to send files around between some linux hosts via OpenSSH, but we don't want clients to be able to list / retrieve / modify existing files on the server. In other words, it should be an ...
1
vote
2answers
361 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
0
votes
1answer
52 views

How do you use a SOCKS proxy?

I intended to call this question: "Are SOCKS proxies still relevant?" but thought it would be too vague. I know there are various SOCKS proxies that are actively maintained and developed (like ...
0
votes
2answers
67 views

do i need to filter the OUTPUT with iptables for a dedicated firewall box?

I already know how to setup a firewall using iptables, but after a visit of the IT Security Department, they said i need to filter the OUTPUT, but, it is pointless to me, i really can find an scenario ...