Security is not a product, but a process.

learn more… | top users | synonyms (1)

-1
votes
0answers
17 views

Can LAN Manager Authentication Level in Group Policy be set differently for a wireless connection?

I seem to be seeing the following behavior and wondering how it is possible: A client machine (external) generally has no trouble connecting to hosts in our RDS-based environment. When the same ...
-1
votes
1answer
18 views

Ethernet Communicator Non-Supporting of Port Forwarding?

The security contractor has installed a node on the network for the burglary alarm system. It uses IP to communicate the alarm signals. It has some kind of call home feature and supports DHCP as ...
4
votes
1answer
51 views

How to securely install Windows executables across the network using SCCM?

We would like to install various Windows software (.exe) using SCCM but have noticed that SCCM uses a domain admin account when pushing executables. Thus, we are concerned that the account's password ...
0
votes
1answer
29 views

Which registry key corresponds to “Log on as a service”?

I want to be able to set this value programmatically (preferably via WMI). It must live in the registry or some other location. Yes, I know how to do it via MMC using secpol.msc, but I need to ...
1
vote
1answer
22 views

Webserver | IIS | Configuring to not run certain files

I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP. Lets assume the a user is able to upload a trojan onto my server, either through a ...
2
votes
1answer
26 views

Can I block a file execution with AppLocker?

We currently use a combination of a regular and an "advanced/fancy" endpoint malware protection, in the advanced malware app, I can feed a SHA256 hash of an executable into the advanced platform and ...
0
votes
1answer
37 views

Virtual web server configuration dmz [closed]

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running: - Mail server - WEB server for enterprise website and ecommerce. the esxi server has an iscsi ...
0
votes
0answers
19 views

How can I automate the retrieval and usage of passwords from within a script?

We have automated scripts that access certain devices and are getting the passwords for the devices from a root-read-only plain-text file. Is there some kind of architecture we can use so that we can ...
-1
votes
0answers
22 views

Universal management System abuse [duplicate]

Our ISP have told us that our machine ( universal management tool ) is being abuse. What they send us as log files was this: Jun 13 08:37:37 penfold postfix/smtpd[6176]: connect from unknown[x.x.x.x] ...
4
votes
1answer
117 views

Server2k8: Prevent membership in a group based on membership in another group

I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, ...
0
votes
1answer
23 views

Azure SQL - Sudden connection spike

At first: This is my first question on Serverfault. I am not sure if it fits better on Information Security. If so, please leave a comment and I will move the question. Question My company is ...
0
votes
0answers
11 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
0answers
7 views

Is it secure to do “chroot” SFTP directory without actually setting owner to be root?

I don't know if this sounds wrong, but I have a use case where I need to run a cron job and rsync the data into the SFTP file directory. Typically SFTP set up on the Internet would suggest to set the ...
0
votes
1answer
19 views

Google Apps password change not reflected across all devices

We have a paid Google Apps account and I recently changed the password for one of our users. I confirmed the password change by logging into gmail.com using the new password. The old password isn't ...
1
vote
0answers
9 views

I can installa “Ossec” on xenserver host?

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
0
votes
0answers
13 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
3
votes
1answer
40 views

Debian - Warning: Possible LKM Trojan installed

I am running chkrootkit every night on 3:04. More than 1 year it was not returning any problems but 1 month ago this warning started to appear: ======================= Checking `lkm'... ...
0
votes
1answer
31 views

What users should have access to sudo? (node, php, ftp…)

Before I begin, feel free to suggest a better title for this question. I've registered on Digitalocean and installed a LEMP stack. This is my first time configuring a server from scratch. Even though ...
12
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
0
votes
1answer
18 views

XSS Vulnerability with PCI RapidComply

I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
7
votes
1answer
118 views

Is is possible to disable Certificate Transparency (audit log checking) of certificates in Chrome?

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on ...
0
votes
1answer
24 views

is there security risk when running tomcat7 on port 80

I have setup a server with tomcat7 running on port 80. I have googled around and found out that since port 80 is a "magic port" it needs root privileges to be bound. For this reason most comments i ...
0
votes
2answers
53 views

What IP address should I use for a device that I want to break network access to?

I have an IPMI server on a super micro motherboard that I am unable to disable. There is not even a jumper to disable this either. After seeing all of the security issues that the IPMI server they ...
0
votes
1answer
32 views

TCP Keepalive: Why does an idled ESTABLISHED connection end after 60 seconds, instead of tcp_keepalive_time?

I am investigating ways to mitigate a server against DoS-type attacks. In one scenario, I've opened several hundred TCP connections to my webserver. I do not send any data after the initial TCP ...
2
votes
2answers
31 views

Restrict access to .ssh folder over network shares

I run a small server running Ubuntu Server 14.04 and have just noticed that the .ssh folder in the users home directory is accessible via SMB and NFS. The SMB and NFS are both secured, however I ...
0
votes
1answer
19 views

Block/Prevent Adminer - Apache [duplicate]

I found out that if someone was able to hack any FTP account on my server and upload Adminer they could alter the database. I tried Google'ing a way to block or prevent Adminer from working, but got ...
0
votes
0answers
20 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
1
vote
2answers
59 views

From a technical perspective, is my data insecure when using a public VPN like SecurityKiss?

I wonder if I understand well VPN. I connected to SecurityKiss, they provide a list of TunnelBlick configs. In order you to connect their VPN. (TUnnelBlick is OpenVPN based). Am I right : your IP is ...
0
votes
2answers
18 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
1answer
33 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
0
votes
0answers
11 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
23 views

Nginx Default/Welcome Page Suddenly Returns

I installed Nginx a number of months ago and deployed some code. I obviously deleted the default index.html Nginx default page. I know this for certain as PHP was not installed and so index.html was ...
0
votes
0answers
28 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
2answers
38 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
0
votes
3answers
57 views

Security concerns with enabling PowerShell on a production server [closed]

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET). One of my colleagues said to me ...
0
votes
0answers
43 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
3
votes
2answers
87 views

How worried should I be about unsecured HTTP on a “private” network?

So I've joined a new team, which develops and operates a service available on the Internet. It's aimed at B2B use rather than consumer, although anyone can sign up for a low-tier account to check it ...
1
vote
2answers
54 views

site-to-site vpn tunnel - does hardware matter? [closed]

I have been tasked with setting up 4 offices and connecting them all together so they can be on the same network. Does hardware really matter or could I build a decent machine in the low $1000's and ...
0
votes
1answer
17 views

How to manage access to nodes in a cluster?

I am about to set up a server cluster for our company's web applications. At the beginning there will be 3 hardware servers in Proxmox HA setup in a remote datacenter running about 20-30 VMs all ...
0
votes
0answers
23 views

Garbage files in public_html folder. Is this a security breach? [duplicate]

The public_html folder on my site just got uploaded with a ton of garbage html files with filenames such as vonzipper-sunglasses-men-25jh27.html and tumi-daypack-04po59.html as well as several files ...
1
vote
1answer
23 views

MS CRM: How secure is an Internet Facing Deployment (IFD)?

From a security perspective, how secure is an IFD deployment of MS CRM 2013 or CRM 2015? I know it's the recommended way to expose MS CRM to the net, but what are the vulnerabilties? Is it ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
0
votes
0answers
62 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
0answers
10 views

Application Virtualization Risk Through WAN / Internet

I was weighing pros and cons about the new mission critical system that through application virtualization, will allow my colleagues from 3 different countries to access it. Here are some background ...
-2
votes
1answer
26 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
2
votes
5answers
252 views

How to prevent remote code execution from a domain member server?

Is there a way, using a firewall, Group Policy setting, or other control, to prevent someone logged into a domain member from being able to remotely execute code on a domain controller (that they ...
0
votes
1answer
40 views

Can I use an IAM role to grant my Heroku app access to my Amazon S3 bucket?

Heroku: Using AWS S3 to Store Static Assets and File Uploads suggests using my AWS security credentials to enable my Heroku app to access my Amazon S3 bucket. However, isn't it better practice (as ...
0
votes
1answer
26 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
1
vote
1answer
72 views

Minimizing attack surface on fresh 2012 R2

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my ...
2
votes
2answers
103 views

Multi-site hosting security - ensure no scripts can run as Apache user, but only as each website's user

In setting up a hosting environment with multiple sites that should be isolated from each other, I did the obvious step of having PHP be configured so it runs as the user that's associated with each ...