Security is not a product, but a process.

learn more… | top users | synonyms (2)

26
votes
8answers
1k views

Is there a danger in fake OpenID providers?

I've been wondering. Since anybody can start an OpenID provider, and since there is no central authority that approves OpenID providers, why won't fake OpenID providers become a problem? For example, ...
26
votes
2answers
773 views

Why is it bad to have root writing files to a directory not owned by root?

This came up in a comment to another question and I'd love it if someone could explain the reasons for this to me. I suggested having Apache log the errors for a given VHost to a user's home ...
26
votes
4answers
12k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
26
votes
3answers
2k views

Is it safe to reboot a server open to the internet?

Specifically I have an iptables ruleset defined on a server running CentOS. Am I guaranteed / can I guarantee / how can I guarantee that when networking comes online (either at machine boot, or after ...
25
votes
9answers
3k views

Is packet sniffing for passwords on a fully switched network really a concern?

I administer a number of linux servers that require telnet access for users. Currently the user's credentials are stored locally on each server and the passwords tend to be very weak and there is no ...
25
votes
9answers
2k views

What should I do about a “misbehaving” user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
25
votes
5answers
6k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
25
votes
7answers
3k views

MITM attacks - how likely are they?

How likely are "Man in the Middle" attacks in internet security? What actual machines, apart from ISP servers, are going to be "in the middle" of internet communications? What are the actual risks ...
25
votes
7answers
4k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
25
votes
8answers
18k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
25
votes
4answers
722 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
25
votes
5answers
18k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
25
votes
7answers
2k views

Puppet Security and Network Topologies

Background: I am finally setting aside some time to join the 21st Century and look at Puppet. As it stands today we version control all server configurations in a repository that is held internally ...
23
votes
9answers
2k views

A partner wants a copy of our written IT security policy and I'm not sure what to do

My company is working with another company and as part of the contract they are requesting a copy of my company's written IT Security Policy. I don't have a written IT security policy, and I'm not ...
23
votes
11answers
2k views

Is fingerprint authentification secure?

Is OS authentication more secure by using fingerprint reader than a (strong) password? Can that be hacked easily? By the way, where is the fingerprint stored? On the hardware chip or on filesystem? ...
23
votes
3answers
51k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
23
votes
3answers
4k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
22
votes
10answers
4k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
22
votes
8answers
6k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
22
votes
5answers
2k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
22
votes
10answers
18k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
22
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
22
votes
8answers
3k views

Secure Network Filesystems for Linux: What are people doing?

NFSv3 is widespread, but the default security model is... quaint. CIFS can use Kerberos authentication, but without POSIX semantics it's a non-starter. AFS never did encrypt traffic on the wire and ...
22
votes
3answers
6k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
21
votes
2answers
57k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
21
votes
2answers
671 views

Isn't it a huge security issue to include the MAC address inside of an IPv6 address (=default)?

Many times you don't want to be identified while surfing. For one thing your browsing history might be sold without your knowledge, and with no benefit to you.
21
votes
3answers
2k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
20
votes
16answers
1k views

Why is it bad to have a weak mysql user password?

I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
20
votes
8answers
2k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
20
votes
7answers
8k views

How do I responsibly dispose of backup tapes?

Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social ...
20
votes
2answers
1k views

Why should I start to replace Windows Server 2003?

Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis. I have heard that I should replace it by something "newer" and more "modern". Why should ...
20
votes
4answers
11k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
20
votes
10answers
3k views

How to track superuser activities

I'd like to know what are the best approaches for tracking superuser activities on a Linux environment. Specifically, I'm looking for these features: A) Logging keystrokes to a secured syslog ...
19
votes
4answers
3k views

Ordinary users are able to read /etc/passwd, is this a security hole?

ls -l /etc/passwd gives $ ls -l /etc/passwd -rw-r--r-- 1 root root 1862 2011-06-15 21:59 /etc/passwd So an ordinary user can read the file. Is this a security hole?
19
votes
12answers
2k views

What language for starting on Linux?

I am about to begin a 4-year information security degree at Purdue. The degree does not call for any programming courses. So the only time I will be able to take one is the occasional elective. So ...
19
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...
19
votes
5answers
47k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
19
votes
2answers
1k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
19
votes
5answers
5k views

Minimum permissions for a user to perform a mysqldump?

I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...
19
votes
3answers
545 views

Suspicious .htaccess File

This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks! RewriteEngine On ...
19
votes
2answers
22k views

How bad is setting MySQL's bind-address to 0.0.0.0?

I'm trying to allow a remote server to access a MySQL instance that currently shares a Linux server with a web app. According to the documentation the only way this would be possible (unless I'm not ...
19
votes
2answers
835 views

Best Practices for updating a previously unmaintained server RHEL5.7

A new RedHat EL5.6 server has been recently put under my care. It is immediately obvious that, for the previous 12 months, little to no attention has been given to any sort of package updates. ...
19
votes
8answers
2k views

IT Audit checklist

I recently have taken on the position of a one man show for a company that is going to have an audit. The network isn't anywhere close to prepared and I have been looking for a general audit ...
19
votes
3answers
23k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
18
votes
6answers
2k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
18
votes
2answers
6k views

Possible to change email address in keypair?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.) I've now changed my email address. Is it possible to change the email address on ...
18
votes
2answers
2k views

nologin in /etc/shells is dangerous.. WHY?

I found this on the internet, while putting up a FTP server in FreeBSD. Putting nologin into /etc/shells potentially creates a back door by which those accounts can be used with FTP. (see: ...
18
votes
5answers
13k views

Does fail2ban do Windows?

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
18
votes
5answers
12k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
17
votes
13answers
2k views

Reasons to not allow people into the server room

I have worked at a few hosting companies and seen two schools of thought on this Do not allow customers into the server room. The argument is basically it raises security (this news story is ...