Security is not a product, but a process.
19
votes
8answers
2k views
How to prevent zero day attacks
Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks.
Therefore, what can be done to prevent ...
19
votes
5answers
1k views
How to secure your CA's private key?
I'm about to implement my own Certification Authority (CA) for interal use only.
Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted.
...
19
votes
7answers
5k views
How do I responsibly dispose of backup tapes?
Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social ...
19
votes
5answers
1k views
Avoid to keep command in history
I use bash and I would like to avoid some commands being kept in the history.
Is it possible to do that for the next command only?
Is it possible to do that for the entire session?
19
votes
4answers
7k views
Why do people tell me not to use VLANs for security?
As per title, why do people tell me not to use VLANs for security purposes?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
19
votes
3answers
478 views
Suspicious .htaccess File
This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks!
RewriteEngine On
...
19
votes
7answers
2k views
IT Audit checklist
I recently have taken on the position of a one man show for a company that is going to have an audit. The network isn't anywhere close to prepared and I have been looking for a general audit ...
19
votes
5answers
8k views
How useful is mounting /tmp noexec?
Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
19
votes
2answers
11k views
What's best practice for communication between Amazon EC2 instances?
I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far:
Web Server -- Apache
Database Server ...
18
votes
16answers
1k views
Why is it bad to have a weak mysql user password?
I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
18
votes
6answers
1k views
Bad to be logged in as admin all the time?
At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group.
I have serious ...
18
votes
2answers
35k views
How can I allow one user to su to another without allowing root access?
I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root).
For instance, I'd like to ...
18
votes
3answers
18k views
How do I block specific IPs and IP ranges in IIS7?
I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
18
votes
2answers
287 views
Best Practices for updating a previously unmaintained server RHEL5.7
A new RedHat EL5.6 server has been recently put under my care. It is immediately obvious that, for the previous 12 months, little to no attention has been given to any sort of package updates.
...
18
votes
2answers
31k views
Howt to grant network access to LocalSystem account?
How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account?
Background
When accessing the network, the LocalSystem account acts as the computer on the network:
...
17
votes
13answers
2k views
Reasons to not allow people into the server room
I have worked at a few hosting companies and seen two schools of thought on this
Do not allow customers into the server room. The argument is basically it raises security (this news story is ...
17
votes
10answers
883 views
Is there a reason to upgrade Internet Explorer on Windows Server?
I never use Internet Explorer on my Windows Servers. Is there any reason I should upgrade Internet Explorer (version 6 or 7 to 7 or 8)?
17
votes
9answers
992 views
User password age/complexity policy
Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
17
votes
13answers
2k views
Physical server security
A lot of time and columns are spent discussing securing a server from outside attacks. This is perfectly valid because it's easier for an attacker to use the Internet to break your server than it is ...
17
votes
9answers
802 views
Steps to take when technical staff leave
How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
17
votes
3answers
1k views
How are cached Windows credentials stored on the local machine?
How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
17
votes
3answers
871 views
Securely wipe an entire Linux server with itself
I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running.
OS is SL6. ...
16
votes
6answers
1k views
Is it okay to use a SSH key with an empty passphrase?
When I first learned how to make ssh keys, the tutorials I read all stated that a good passphrase should be chosen. But recently, when setting up a daemon process that needs to ssh to another machine, ...
16
votes
4answers
3k views
Minimum permissions for a user to perform a mysqldump?
I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...
16
votes
7answers
3k views
Easiest way to send encrypted email?
To comply with Massachusetts's new personal information protection law, my company needs to (among other things) ensure that anytime personal information is sent via email, it's encrypted. What is the ...
16
votes
8answers
23k views
What security risks are there with employees using Dropbox?
Are there any particular security concerns to keep in mind with company-wide use of Dropbox file sharing / versioning / backing up, and are there specific options or settings that would be recommended ...
16
votes
5answers
774 views
What's the sneakiest thing you ever had to deal with as a sysadmin?
What's the most devious thing a user has ever done that you've had to deal with? Obviously, we've all seen quite a lot of malice from unfriendly users, but how about from so-called friendly users?
In ...
16
votes
2answers
1k views
nologin in /etc/shells is dangerous.. WHY?
I found this on the internet, while putting up a FTP server in FreeBSD.
Putting nologin into /etc/shells potentially creates a back door by
which those accounts can be used with FTP.
(see: ...
16
votes
5answers
5k views
What are the exact protocol level differences between SSL and TLS?
This is a technical deep dive after this overview question was asked.
What are the protocol differences between SSL and TLS?
Is there really enough of a difference to warrant a name change? (versus ...
16
votes
1answer
322 views
What's the importance of the email address in the DNS SOA lookup?
Is there a real importance in this, except to publish the email address of the person responsible for some DNS zone?
In our BIND configuration, we put a mailling list as the responsible for our ...
16
votes
6answers
1k views
Is OpenID this easy to hack or am I missing something?
For those Relying Parties (RP) that allow the user to specify the OpenID Provider (OP), it seems to me than anyone that knows or guesses your OpenID could
Enter their own OP address.
Have it ...
15
votes
10answers
3k views
I just did a chmod -x chmod
So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
15
votes
14answers
5k views
How can I destroy data on a failed hard disk without voiding warranty?
Suppose I have a hard disk with data I don't want to expose to a third party. The warranty period for that disk still lasts. Now the disk starts malfunctioning.
I can't use a disk wiping program on a ...
15
votes
3answers
356 views
My site seems to be hijacked… but only when visited from another site… how?
My website is altoonadesign.com if you type it directly in your browser it takes you to the correct site. However if you do a search for "altoona design" and click on the link to my site you get ...
15
votes
5answers
592 views
What are the “to-do” on protecting Windows server facing the web?
I currently begin to deploy Windows servers facing the web.
And I would like to know what are you way of protecting your servers ? What softwares are you using ?
On Linux, i'm using Fail2ban to ...
15
votes
4answers
36k views
How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?
We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
15
votes
10answers
431 views
Should core system servers be able to connect to the internet for maintenance/support?
A couple of our servers have Oracle maintenance licenses. Our hardware vendor asked there was internet connection in the server room. Our policy is that all machines in that room is isolated from the ...
14
votes
19answers
2k views
How should I securely wipe data from a hard drive?
How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
14
votes
8answers
9k views
How do I know if my Linux server has been hacked?
What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
14
votes
5answers
632 views
What is meant when IT Infrastructure people refer to the “Stack”
Can someone please define what exactly is the "Stack". I know its an industry term but its very vague. I am referring to Infrastructure terminology not "Stack" in terms of memory allocation.
14
votes
5answers
4k views
Can an attacker sniff data in a URL over HTTPS?
Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
3answers
2k views
How can I set up VLANs in a way that won't put me at risk for VLAN hopping?
We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration:
One significant detail is ...
14
votes
8answers
2k views
What are main steps doing forensic analysis of linux box after it was hacked?
What are main steps doing forensic analysis of linux box after it was hacked?
Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
14
votes
5answers
2k views
Updating production Ubuntu boxes the dos and don'ts
Every so often I login to production web/db/tools boxes and see the typical message:
30 packages can be updated.
16 updates are security updates.
My question is, how do all of you handle updates on ...
14
votes
7answers
9k views
Monitor an incoming SSH session in real time
Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you ...
14
votes
10answers
3k views
How can I increase ssh security? Can I require both a key and password?
I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
14
votes
5answers
8k views
How can I chroot ssh connections?
I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
14
votes
3answers
374 views
What should I consider to secure SVN on Windows? [closed]
Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
13
votes
11answers
720 views
Is there a standard method of proving password security to non-mathematicians?
My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
13
votes
14answers
13k views
Alternatives to RSA SecurID? [closed]
Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
