Security is not a product, but a process.

learn more… | top users | synonyms (2)

6
votes
4answers
773 views

Any security tips for my first server? (complete beginner)

I'm paying for a VPS and hoping to launch my first website on it in the next few days. I'm worried there might be some glaringly obvious security holes in the standard setup, so I'm keen to get some ...
6
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
13
votes
4answers
1k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
8
votes
2answers
1k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
4
votes
2answers
772 views

Is it possible to have a 100% secure virtual private server?

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS. Obviously there are some things that you could do to ...
3
votes
2answers
784 views

Read access control with Mercurial and Apache

I've set up Mercurial via Apache (hgwebdir.cgi). I would like to have the same functionality as when using Subversion and AuthzSVNAccessFile, in which I can restrict which user has read or write ...
0
votes
1answer
279 views

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a “turn-key” linux security distribution)?

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a "turn-key" linux security distribution)? Can anyone help me?
27
votes
5answers
2k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
28
votes
8answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
41
votes
19answers
2k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
29
votes
4answers
59k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
29
votes
3answers
18k views

What's best practice for communication between Amazon EC2 instances?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far: Web Server -- Apache Database Server ...
20
votes
4answers
10k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
23
votes
7answers
4k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
21
votes
8answers
3k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
9
votes
6answers
2k views

What should every sysadmin know before administrating a public server?

Similar to this question on Stack Overflow, what should a sysadmin who is used to private, intranet-type situations know before being the administrator of a public site? These could be security ...
6
votes
3answers
2k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
21
votes
2answers
47k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
14
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
8
votes
4answers
1k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
28
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
16
votes
3answers
46k views

What are the IUSR and IWAM accounts for in IIS?

I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment: Why are they there? What's the difference between them? Do the names ...
9
votes
2answers
9k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
12
votes
9answers
5k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
10
votes
3answers
848 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
10
votes
7answers
2k views

Storing rarely used single-purpose passwords

How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as: Administrator/root password when everyone logs on using their own ...
8
votes
4answers
4k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
24
votes
9answers
2k views

What should I do about a “misbehaving” user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
18
votes
3answers
22k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
15
votes
5answers
40k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
14
votes
7answers
4k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
12
votes
6answers
3k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
10
votes
6answers
2k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
7
votes
8answers
3k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
6
votes
7answers
996 views

What are the most essential tools for Linux security? [closed]

I'm running a hobby Debian sever hosting a few web sites, software repositories, and some other apps. There are tons of all kinds of network security enhancement tools available. Firewalls, hardening ...
5
votes
9answers
704 views

Remote Desktop Security

I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding ...
3
votes
1answer
3k views

Cookie Authentication in Apache

I'm trying to set up a reverse proxy in Apache. The user will be required to log in, and will then be sent a cookie. I want Apache to check the cookie. Is there a way to do this? EG, right now my ...
2
votes
3answers
311 views

Securing and Monitoring a Virtual Private Server

After nearly a decade (yikes) of hosting my personal websites and applications with a decent shared web hosting provider (the one in pittsburgh) I've decided its time to venture out on my own and try ...
8
votes
1answer
8k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
8
votes
6answers
441 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
8
votes
1answer
622 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
7
votes
4answers
21k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
4
votes
1answer
2k views

Prevent service accounts from logging in locally or remotely

We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using ...
3
votes
2answers
10k views

View Remote Desktop access logs on Win 2003

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying ...
3
votes
7answers
628 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
3
votes
3answers
912 views

Open Source XML Firewalls?

Does anyone know of any open source XML firewalls that provide equivalent functionality to DataPower, Vordel, etc?
2
votes
1answer
836 views

How should I structure my users/groups/permissions for a web server?

How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
2
votes
4answers
3k views

How to find out what files an installer (rpm, deb) created?

I need to find out all the file system modifications an installer did. Most likely the installed package is an rpm or deb, but an app could of course be simply copied over or compiled and installed ...