Security is not a product, but a process.
13
votes
2answers
629 views
how do i perform root actions from non-root account?
I want to be able to restart services from a php-script. running under the www-user account.
What's the preferred way to perform these actions?
I recon I can place create a file with que'd commands, ...
9
votes
6answers
1k views
How difficult is it to setup a mailserver?
I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data.
How much of a PITA is it to setup my own mailserver? Should I go for an ...
9
votes
2answers
6k views
How do I deploy an internal certificate authority?
IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
12
votes
9answers
4k views
SSH server zero-day exploit - Suggestions to protect ourselves
According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there.
There is some proof of concept code in here and some reference:
...
23
votes
9answers
2k views
What should I do about this user?
What should I do about this user? The user is:
Downloading pornography
Attempting unauthorized access
Running hacking software
Sending unsolicited email
Installing software / tampering with the ...
8
votes
12answers
1k views
Securing SSH server against bruteforcing
I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN servern... but do want it to be secure.
I just renewed my ...
6
votes
4answers
3k views
How do you manage service account credentials (passwords)?
In a Windows environment how do you address the following issues with service accounts?
Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
18
votes
3answers
18k views
How do I block specific IPs and IP ranges in IIS7?
I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
13
votes
7answers
3k views
Should we disable the root user?
Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
10
votes
3answers
725 views
Finding how a hacked server was hacked
I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do?
The best answer is ...
10
votes
7answers
6k views
How to log every linux command to a logserver
I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver.
I'm interested in any and all methods to do this. I would expect ...
10
votes
11answers
1k views
Site hacked, looking for security advice [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
Last weekend my company's site was hacked.
They did the nicest thing of doing that on a Friday evening so we only noticed the ...
6
votes
8answers
2k views
How to detect a hidden process in linux?
We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
6
votes
7answers
496 views
What are the most essential tools for Linux security? [closed]
I'm running a hobby Debian sever hosting a few web sites, software repositories, and some other apps. There are tons of all kinds of network security enhancement tools available. Firewalls, hardening ...
6
votes
7answers
351 views
Keeping up with security
After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the ...
5
votes
9answers
664 views
Remote Desktop Security
I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding ...
3
votes
1answer
3k views
Cookie Authentication in Apache
I'm trying to set up a reverse proxy in Apache. The user will be required to log in, and will then be sent a cookie. I want Apache to check the cookie. Is there a way to do this?
EG, right now my ...
2
votes
3answers
272 views
Securing and Monitoring a Virtual Private Server
After nearly a decade (yikes) of hosting my personal websites and applications with a decent shared web hosting provider (the one in pittsburgh) I've decided its time to venture out on my own and try ...
30
votes
2answers
3k views
Why do I have to edit /etc/sudoers with visudo?
I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
12
votes
4answers
866 views
Is iLO safe enough to be hung on the WAN
I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ?
How do you guys secure iLO ? Do you put it behind a firewall ?
Would you use a ...
9
votes
6answers
2k views
Should I bother to block these rather lame attempts at hacking my server?
I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like:
66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
8
votes
6answers
400 views
Why shouldn't root be allowed to login via ssh?
why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
7
votes
4answers
7k views
Does fail2ban do Windows?
Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
6
votes
1answer
490 views
Is it possible to hide a malicious alias in Bash on Linux?
Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
3
votes
2answers
6k views
View Remote Desktop access logs on Win 2003
Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying ...
3
votes
1answer
2k views
Prevent service accounts from logging in locally or remotely
We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using ...
13
votes
11answers
3k views
Chinese Hacker-Bots attempting to exploit our systems 24/7
Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
9
votes
6answers
1k views
Does disabling root login enhance security?
I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html
I assume that, if everybody uses a public key ...
7
votes
1answer
3k views
How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)
I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
7
votes
6answers
3k views
How can I log users' bash commands?
I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
7
votes
2answers
574 views
What is the best way to allow a domain user to start and stop services on the machine?
What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
4
votes
3answers
2k views
iptables — OK, **now** am I doing it right?
This is a follow up to a previous question where I asked whether my iptables config is correct.
CentOS 5.3 system.
Intended result: block everything except ping, ssh, Apache, and SSL.
Based on ...
3
votes
1answer
653 views
Setting the secure flag on cookies from Outlook Web Access
I'm running Exchange 2007 SP3 which is exposing outlook web access over only HTTPS. However the server delivers the sessionid cookie without the secure flag set. Even though I don't have port 80 open, ...
2
votes
1answer
840 views
allowing index access only with .htaccess
I have this in my .htaccess file, in the site root:
Options -Indexes
<directory ../.*>
Deny from all
</directory>
<Files .htaccess>
order allow,deny
deny from all
</Files>
...
2
votes
3answers
404 views
How to find out if my server is compromised?
I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
2
votes
2answers
720 views
Read access control with Mercurial and Apache
I've set up Mercurial via Apache (hgwebdir.cgi).
I would like to have the same functionality as when using Subversion and AuthzSVNAccessFile, in which I can restrict which user has read or write ...
1
vote
4answers
1k views
Netstat: How to know if it's Human or Bot/Spider/DDOS
I'm using the following command to check how many connections I have from a single ip
netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
If it's DDOS attack(500+ ...
1
vote
8answers
4k views
How to hide web server name and openssh version on linux when scanning server ports?
How to hide web server name and openssh version on linux when scanning server ports?
when i nmap'ed(nmap -A -T4 192.168.40.12) ip server from the outside, the one shows:
Starting Nmap 4.62 ( ...
0
votes
2answers
544 views
How To Set iptables log rules for PSAD with UFW?
For PSAD to work, I need to add the following iptables rules and enable packet logging :
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG
I ...
0
votes
1answer
172 views
Locking down a box on the Internet [closed]
I'm a developer who is looking to put a new service on the Internet. I am new to administering systems and frankly I seem a little lost at where I should start with putting something on the web.
My ...
0
votes
2answers
140 views
Linux EC2 Instance Security Consideration
I am going to host a web site in Amazon EC2 instance which would be a Linux instance. My web application will be developed using PHP, Apache and MySql. As I am new to Linux and Amazon EC2 environment, ...
5
votes
2answers
8k views
What is muieblackcat?
I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports
System.Web.HttpException: A public action method 'muieblackcat' was not found on controller...
This is ...
5
votes
3answers
2k views
Does windows Remote Desktop have any protection against brute force attacks?
If I were to have a server (Windows Server 2008) out on the internet that is allowed Remote Desktop connections, is there anything to stop random people from trying brute-force Username/password ...
2
votes
3answers
248 views
Procedures for confirming a suspected hack? (Linux)
I'm trying to compile a procedure for when ever there is a suspicion, perhaps from netflow data or something like that, that a server could be compromised. The logic being, that you should think about ...
2
votes
2answers
387 views
bind9 in a chroot jail - necessary or not?
I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
2
votes
2answers
872 views
Webserver logs: “Morfeus F***ing Scanner”
I've just found these accesses in my web server log files:
::ffff:218.38.136.38 109.72.95.175 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner"
...
1
vote
2answers
635 views
OpenVPN bad source address from client
I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server:
Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client ...
1
vote
1answer
473 views
How should I structure my users/groups/permissions for a web server?
How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
1
vote
2answers
135 views
Apache security
I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep ...
1
vote
2answers
306 views
Distributing SQL Server on Internet regarding security issue
We are going to put our servers in two places to keep high level redundancy and to avoid bandwidth critics. The two servers are on different LANs but communicate over a WAN network (via Internet). One ...
