Security is not a product, but a process.

learn more… | top users | synonyms (1)

29
votes
4answers
15k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
29
votes
8answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
28
votes
7answers
4k views

MITM attacks - how likely are they?

How likely are "Man in the Middle" attacks in internet security? What actual machines, apart from ISP servers, are going to be "in the middle" of internet communications? What are the actual risks ...
27
votes
8answers
6k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
27
votes
5answers
7k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
27
votes
7answers
5k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
27
votes
8answers
1k views

Is there a danger in fake OpenID providers?

I've been wondering. Since anybody can start an OpenID provider, and since there is no central authority that approves OpenID providers, why won't fake OpenID providers become a problem? For example, ...
27
votes
1answer
3k views

Is MariaDB a secure replacement for MySQL?

I've been using MariaDB, "an enhanced, drop-in replacement for MySQL" on my Debian stable servers for years, because of its increased performance. However I've noticed that it appears to lag with ...
27
votes
4answers
6k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
27
votes
2answers
792 views

Why is it bad to have root writing files to a directory not owned by root?

This came up in a comment to another question and I'd love it if someone could explain the reasons for this to me. I suggested having Apache log the errors for a given VHost to a user's home ...
27
votes
3answers
2k views

Is it safe to reboot a server open to the internet?

Specifically I have an iptables ruleset defined on a server running CentOS. Am I guaranteed / can I guarantee / how can I guarantee that when networking comes online (either at machine boot, or after ...
26
votes
9answers
9k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
26
votes
9answers
3k views

Is packet sniffing for passwords on a fully switched network really a concern?

I administer a number of linux servers that require telnet access for users. Currently the user's credentials are stored locally on each server and the passwords tend to be very weak and there is no ...
26
votes
3answers
59k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
26
votes
2answers
9k views

Possible to change email address in keypair?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.) I've now changed my email address. Is it possible to change the email address on ...
26
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
26
votes
4answers
753 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
26
votes
7answers
2k views

Puppet Security and Network Topologies

Background: I am finally setting aside some time to join the 21st Century and look at Puppet. As it stands today we version control all server configurations in a repository that is held internally ...
25
votes
10answers
22k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
24
votes
11answers
2k views

Is fingerprint authentification secure?

Is OS authentication more secure by using fingerprint reader than a (strong) password? Can that be hacked easily? By the way, where is the fingerprint stored? On the hardware chip or on filesystem? ...
24
votes
2answers
690 views

Isn't it a huge security issue to include the MAC address inside of an IPv6 address by default

Many times you don't want to be identified while surfing. For one thing your browsing history might be sold without your knowledge, and with no benefit to you.
24
votes
3answers
9k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
23
votes
5answers
2k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
23
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
22
votes
10answers
5k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
22
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
22
votes
8answers
3k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
22
votes
2answers
2k views

Why should I start to replace Windows Server 2003?

Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis. I have heard that I should replace it by something "newer" and more "modern". Why should ...
22
votes
4answers
12k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
22
votes
8answers
3k views

Secure Network Filesystems for Linux: What are people doing?

NFSv3 is widespread, but the default security model is... quaint. CIFS can use Kerberos authentication, but without POSIX semantics it's a non-starter. AFS never did encrypt traffic on the wire and ...
21
votes
16answers
1k views

Why is it bad to have a weak mysql user password?

I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
21
votes
6answers
60k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
21
votes
7answers
9k views

How do I responsibly dispose of backup tapes?

Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social ...
21
votes
5answers
15k views

Does fail2ban do Windows?

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
21
votes
2answers
27k views

How bad is setting MySQL's bind-address to 0.0.0.0?

I'm trying to allow a remote server to access a MySQL instance that currently shares a Linux server with a web app. According to the documentation the only way this would be possible (unless I'm not ...
20
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...
20
votes
2answers
2k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
20
votes
5answers
7k views

Minimum permissions for a user to perform a mysqldump?

I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...
20
votes
3answers
26k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
20
votes
10answers
3k views

How to track superuser activities

I'd like to know what are the best approaches for tracking superuser activities on a Linux environment. Specifically, I'm looking for these features: A) Logging keystrokes to a secured syslog ...
19
votes
4answers
3k views

Ordinary users are able to read /etc/passwd, is this a security hole?

ls -l /etc/passwd gives $ ls -l /etc/passwd -rw-r--r-- 1 root root 1862 2011-06-15 21:59 /etc/passwd So an ordinary user can read the file. Is this a security hole?
19
votes
12answers
2k views

What language for starting on Linux? [closed]

I am about to begin a 4-year information security degree at Purdue. The degree does not call for any programming courses. So the only time I will be able to take one is the occasional elective. So ...
19
votes
6answers
2k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
19
votes
8answers
17k views

Should I have to enable automatic update on Debian lenny stable?

I have installed a new Linux Debian lenny server that will be a LAMP and a Subversion server. Should I have to enable automatic updates? If I enable it, I am sure that I have the latest security ...
19
votes
3answers
565 views

Suspicious .htaccess File

This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks! RewriteEngine On ...
19
votes
2answers
1k views

Best Practices for updating a previously unmaintained server RHEL5.7

A new RedHat EL5.6 server has been recently put under my care. It is immediately obvious that, for the previous 12 months, little to no attention has been given to any sort of package updates. ...
19
votes
3answers
2k views

Securely wipe an entire Linux server with itself

I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running. OS is SL6. ...
19
votes
4answers
13k views

How secure is a bluetooth keyboard against password sniffing?

In a situation where an admin will enter sensitive information into a keyboard (the root password), what is the risk that a bluetooth keyboard (ship by default with Mac systems these days) would put ...
18
votes
13answers
2k views

Reasons to not allow people into the server room

I have worked at a few hosting companies and seen two schools of thought on this Do not allow customers into the server room. The argument is basically it raises security (this news story is ...
18
votes
13answers
2k views

Physical server security

A lot of time and columns are spent discussing securing a server from outside attacks. This is perfectly valid because it's easier for an attacker to use the Internet to break your server than it is ...