Security is not a product, but a process.

learn more… | top users | synonyms (2)

38
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
12
votes
6answers
5k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
11
votes
2answers
6k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
6
votes
4answers
787 views

Any security tips for my first server? (complete beginner)

I'm paying for a VPS and hoping to launch my first website on it in the next few days. I'm worried there might be some glaringly obvious security holes in the standard setup, so I'm keen to get some ...
8
votes
1answer
10k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
7
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
13
votes
4answers
2k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
8
votes
2answers
1k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
3
votes
2answers
807 views

Read access control with Mercurial and Apache

I've set up Mercurial via Apache (hgwebdir.cgi). I would like to have the same functionality as when using Subversion and AuthzSVNAccessFile, in which I can restrict which user has read or write ...
0
votes
1answer
289 views

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a “turn-key” linux security distribution)?

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a "turn-key" linux security distribution)? Can anyone help me?
27
votes
5answers
2k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
28
votes
8answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
62
votes
9answers
67k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
42
votes
19answers
3k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
29
votes
3answers
20k views

What's best practice for communication between Amazon EC2 instances?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far: Web Server -- Apache Database Server ...
20
votes
4answers
11k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
25
votes
7answers
4k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
10
votes
6answers
2k views

What should every sysadmin know before administrating a public server?

Similar to this question on Stack Overflow, what should a sysadmin who is used to private, intranet-type situations know before being the administrator of a public site? These could be security ...
22
votes
8answers
5k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
21
votes
2answers
55k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
6
votes
3answers
3k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
28
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
15
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
8
votes
8answers
14k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
8
votes
4answers
1k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
43
votes
11answers
6k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
16
votes
3answers
50k views

What are the IUSR and IWAM accounts for in IIS?

I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment: Why are they there? What's the difference between them? Do the names ...
11
votes
7answers
2k views

Storing rarely used single-purpose passwords

How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as: Administrator/root password when everyone logs on using their own ...
9
votes
2answers
10k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
25
votes
9answers
2k views

What should I do about a “misbehaving” user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
13
votes
9answers
5k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
11
votes
3answers
876 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
8
votes
4answers
5k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
19
votes
3answers
23k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
17
votes
5answers
46k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
17
votes
8answers
5k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
14
votes
6answers
3k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
10
votes
2answers
2k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
4
votes
2answers
612 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
2
votes
4answers
3k views

How to find out what files an installer (rpm, deb) created?

I need to find out all the file system modifications an installer did. Most likely the installed package is an rpm or deb, but an app could of course be simply copied over or compiled and installed ...
2
votes
3answers
346 views

Securing and Monitoring a Virtual Private Server

After nearly a decade (yikes) of hosting my personal websites and applications with a decent shared web hosting provider (the one in pittsburgh) I've decided its time to venture out on my own and try ...
11
votes
6answers
2k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
9
votes
1answer
649 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
7
votes
8answers
3k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
6
votes
7answers
1k views

What are the most essential tools for Linux security? [closed]

I'm running a hobby Debian sever hosting a few web sites, software repositories, and some other apps. There are tons of all kinds of network security enhancement tools available. Firewalls, hardening ...
5
votes
9answers
708 views

Remote Desktop Security

I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding ...
3
votes
1answer
3k views

Cookie Authentication in Apache

I'm trying to set up a reverse proxy in Apache. The user will be required to log in, and will then be sent a cookie. I want Apache to check the cookie. Is there a way to do this? EG, right now my ...
9
votes
4answers
27k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...