Security is not a product, but a process.

learn more… | top users | synonyms (1)

33
votes
8answers
7k views

What are best practices for managing SSH keys in a team?

I work with small teams (<10) of developers and admins with the following characteristics: Most members of the team have >1 personal computer, most of which are portable Team members have access ...
32
votes
9answers
16k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
32
votes
4answers
6k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact secure?...
32
votes
2answers
4k views

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

I'm unsure if this should be asked here or over on security.stackexchange.com... Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print ...
31
votes
5answers
2k views

Will everyone having Globally Accessible IP's in IPv6 be kind of a security nightmare? [duplicate]

Possible Duplicate: Switch to IPv6 and get rid of NAT? Are you kidding? I'm thinking about the way that in IPv4 most of the time you have a single point to configure a firewall on, mainly your ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
31
votes
5answers
19k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
30
votes
7answers
8k views

Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)

I have a question about our Exchange Server: Do you think it is a good idea to refuse incoming external e-mails that have our own domain in the ending? Like external eMail from fake@example.com? ...
30
votes
6answers
82k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
30
votes
7answers
15k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
30
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
30
votes
7answers
5k views

MITM attacks - how likely are they?

How likely are "Man in the Middle" attacks in internet security? What actual machines, apart from ISP servers, are going to be "in the middle" of internet communications? What are the actual risks ...
30
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
30
votes
1answer
3k views

Is MariaDB a secure replacement for MySQL?

I've been using MariaDB, "an enhanced, drop-in replacement for MySQL" on my Debian stable servers for years, because of its increased performance. However I've noticed that it appears to lag with ...
29
votes
5answers
9k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
29
votes
7answers
7k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
29
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
29
votes
3answers
3k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
29
votes
5answers
3k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
29
votes
8answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
28
votes
8answers
7k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
27
votes
10answers
30k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
27
votes
1answer
15k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file /etc/apache2/...
27
votes
8answers
1k views

Is there a danger in fake OpenID providers?

I've been wondering. Since anybody can start an OpenID provider, and since there is no central authority that approves OpenID providers, why won't fake OpenID providers become a problem? For example, ...
27
votes
8answers
19k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
27
votes
2answers
874 views

Why is it bad to have root writing files to a directory not owned by root?

This came up in a comment to another question and I'd love it if someone could explain the reasons for this to me. I suggested having Apache log the errors for a given VHost to a user's home ...
27
votes
1answer
4k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
27
votes
3answers
2k views

Is it safe to reboot a server open to the internet?

Specifically I have an iptables ruleset defined on a server running CentOS. Am I guaranteed / can I guarantee / how can I guarantee that when networking comes online (either at machine boot, or after ...
26
votes
9answers
3k views

Is packet sniffing for passwords on a fully switched network really a concern?

I administer a number of linux servers that require telnet access for users. Currently the user's credentials are stored locally on each server and the passwords tend to be very weak and there is no ...
26
votes
8answers
2k views

What should I do about a “misbehaving” user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
26
votes
6answers
2k views

How do I convince my company to invest in IT - domains, security, etc.?

I work for a small-medium size retailer which has half a dozen high street stores and a website. The IT situation is currently in a very basic state. As being "Head of IT" is only a small part of my ...
26
votes
9answers
14k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
26
votes
4answers
768 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
26
votes
2answers
35k views

How bad is setting MySQL's bind-address to 0.0.0.0?

I'm trying to allow a remote server to access a MySQL instance that currently shares a Linux server with a web app. According to the documentation the only way this would be possible (unless I'm not ...
26
votes
7answers
2k views

Puppet Security and Network Topologies

Background: I am finally setting aside some time to join the 21st Century and look at Puppet. As it stands today we version control all server configurations in a repository that is held internally ...
25
votes
8answers
12k views

How do I responsibly dispose of backup tapes?

Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social ...
25
votes
3answers
13k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
24
votes
11answers
2k views

Is fingerprint authentification secure?

Is OS authentication more secure by using fingerprint reader than a (strong) password? Can that be hacked easily? By the way, where is the fingerprint stored? On the hardware chip or on filesystem? ...
24
votes
2answers
701 views

Isn't it a huge security issue to include the MAC address inside of an IPv6 address by default

Many times you don't want to be identified while surfing. For one thing your browsing history might be sold without your knowledge, and with no benefit to you.
23
votes
3answers
6k views

What kinds of security vulnerabilities does providing DNSSEC expose?

I was planning to sign my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider (namely ...
23
votes
10answers
6k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
23
votes
8answers
6k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
23
votes
5answers
3k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
23
votes
15answers
4k views

Recommend an intrusion detection system (IDS/IPS), and are they worth it?

I have tried out various network-based IDS and IPS systems throughout the years and have never been happy with the results. Either the systems were too difficult to manage, only triggered on well-...
23
votes
3answers
37k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
23
votes
4answers
13k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
23
votes
8answers
4k views

Secure Network Filesystems for Linux: What are people doing?

NFSv3 is widespread, but the default security model is... quaint. CIFS can use Kerberos authentication, but without POSIX semantics it's a non-starter. AFS never did encrypt traffic on the wire and ...
22
votes
15answers
28k views

Is there an alternative to /dev/urandom?

Is there some faster way than /dev/[u]random? Sometimes, I need to do things like cat /dev/urandom > /dev/sdb The random devices are "too" secure und unfortunately too slow for that. I know that ...
22
votes
15answers
4k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because we ...
22
votes
5answers
10k views

Minimum permissions for a user to perform a mysqldump?

I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...