Tagged Questions

Security is not a product, but a process.

learn more… | top users | synonyms (2)

-2
votes
1answer
77 views

How can I check if my server is using ssl 3? [duplicate]

How can I check if my server is using ssl 3? When I run openssl version command I get this. OpenSSL 1.0.1 14 Mar 2012 Thanks.
11
votes
2answers
6k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
0
votes
1answer
112 views

Powershell script for specifically OU

Need help with hte following, a script that can export all members of a specifically OU with in that multiple security groups. Location of the OU is; OU=Security Groups,OU=Public ...
0
votes
1answer
45 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
0
votes
0answers
30 views

do automatic updates (unattended-upgrades) still work with third party repository?

If I install nginx from the nginx repository by appending the following to the end of the /etc/apt/sources.list file: deb http://nginx.org/packages/mainline/debian/ trusty nginx deb-src ...
0
votes
1answer
56 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
0
votes
4answers
50 views

where should the site root directory be? [closed]

Where should I put my site root directory "my_site"? Any best practice? /var/www/my_site/ /var/local/sites/my_site/ /usr/share/wwww/my_site/ /usr/local/my_site/ /opt/my_site/ /srv/my_site/
0
votes
0answers
22 views

how to run a web app: users/groups to use for each component?

How do you organize your users/groups to run the different components of your web app? Any best practices? The answer of this question (What permissions should my website files/folders have on a ...
-3
votes
1answer
27 views

Secure SSH access [duplicate]

I am making a website and I am using a droplet made in digital ocean as my dev server. (No stg or prd yet) The problem is that I am using Dynamic IP and if I blocked access on port 22 to my current ...
5
votes
1answer
50 views

W2K8R2 - A way to convert effecitve Group Policy settings to import on stand-alone machines for local policy?

If I have a relatively robust domain environment (e.g. 20 Security related Group Policy Objects) applying to my servers as a baseline set of policy settings and I have a stand-alone server that I want ...
0
votes
1answer
52 views

OpenBSD chroot for nginx/Apache file permissions

I haven't been able to find a satisfying answer on Goole or the various Stack forums: I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions ...
0
votes
0answers
20 views

Check Unix Credentials on Apache Server Web App

I am building a number of web apps served by apache for internal use and I really want to have them use unix credentials for access. I know a few ways I could do this but all of them seems to expose ...
1
vote
1answer
32 views

Ways to follow newly discovered vulnerabilities?

I happened to be in a situation where I am in charge for 100+ systems on top of my job as a programmer. Everything we run is Linux (Debian, Ubuntu, Centos) and gladly our sysadmin set everything with ...
0
votes
1answer
62 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
0
votes
1answer
74 views

Http 1.1 protocol detected

I have a CentOS server and we had a Retina security scan. I have no idea how to fix this vulnerability. Can you point me in the right direction? We are running nginx.
2
votes
1answer
47 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
3
votes
3answers
623 views

How is a private data center more secure than a public cloud?

I have customers in the financial services industry that insist that a SaaS hosted on public clouds like Amazon's are not as secure as colocation in a private data center. However, I can't find ...
1
vote
1answer
100 views

Security risks of using Google DNS to resolve names on a private net (192.168.x.x)?

Are there any known risks associated with using a public DNS versus a DNS which we or our partners control? Our solution involves a few embedded devices so using Google DNS would give us a degree of ...
-2
votes
1answer
107 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
-1
votes
1answer
50 views

IIS 8.5 Securing FTP [closed]

I have a IIS installation on Windows Server 2012 R2. I need to provide FTP access to a website. Its only one person. The easiest way to make it secure is to make an ip-restriction and only ...
0
votes
0answers
31 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
0
votes
1answer
58 views

“File not found” from bash script executed by Apache (CentOS)

I have a bash script that sets up a classpath for accessing a series of JARs (it's tf, the cross-platform, command line tool for Team Foundation Server). The file structure is something like: ...
1
vote
1answer
144 views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
2answers
62 views

Is PHP 5.3.3 on RHEL 6.5 receiving security fixes?

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check: $ php -v PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08) However, the PHP website claims that ...
1
vote
1answer
70 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
5
votes
1answer
2k views

Why are some CentOS 5 boxes still vulnerable to ShellShock after upgrading Bash?

I have two CentOS 5.10 boxen where I have upgraded bash to the latest version. However, in one of the boxes, bash is still vulnerable to CVE-2014-7169 (I am using the test from this ServerFault ...
3
votes
1answer
129 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
1
vote
1answer
44 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
175 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [closed]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
1
vote
1answer
74 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...
0
votes
0answers
46 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
1answer
29 views

MySQL via SSL on VPC private subnet

Is an SSL connection recommended when connecting to a MySQL database server via a private subnet? SSL provides encryption but SSL causes a performance hit. The MySQL database server only serves ...
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
68
votes
6answers
44k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
2
votes
4answers
148 views

Disable Windows Share Without Administrator Access

We have a folder on a windows server shared to provide access to an important application. When the application is being updated we (DBAs) change the permissions on the share to deny all access to it ...
1
vote
1answer
32 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
1
vote
1answer
51 views

Roundcube does not add IP address information into sent emails

Usually the mail client is supposed to add IP information into emails, in order for the sender to be tracked. But when you send emails from Roundcube Webmail/0.8.4+, the IP address of the server is ...
0
votes
1answer
18 views

Set base directory for dynamic virtual hosts

I use Dynamic VirtualHosts for a hosting service I run. Currently, it only allows static sites, however I'm working on a new version which will support PHP. This clearly opens some security issues. ...
0
votes
0answers
22 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
2answers
123 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
39 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
7
votes
2answers
159 views

Storing AWS credentials securely on a personal machine

How can I securely store AWS credentials on personal machines? In detail: Everybody in our team requires AWS security credentials for doing administrative tasks (credentials are separated by role). ...
0
votes
1answer
28 views

Detect files of folders which do not inherit permissions from their parent

Is there an easy way to find any files/folders (recursively) within a directory which do not inherit permissions from their parent. i.e. To gauge the effects of selecting "replace permissions on ...
0
votes
1answer
80 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
88 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
0
votes
2answers
248 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
-1
votes
3answers
158 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
0
votes
1answer
543 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
-1
votes
1answer
44 views

Is www-data considered a non-privileged user on Apache?

Great Apache Hardening post that recommends "Run Apache from non-privileged account" because "Default apache configuration is to run as nobody or daemon." Is www-data:www-data considered a ...
0
votes
1answer
34 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?