Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
2answers
52 views

How to limit dynamic DNS updates

First off, I'm sorry if this is vague, but I'm not very familiar with DNS or DNS terminology. What I'm trying to do: I want to limit what hostnames are allowed to dynamically update DNS. I don't ...
0
votes
2answers
678 views

How do I set permissions for uploading media in WordPress? (Ubuntu 14.04.1, nginx 1.4.6)

I'm having trouble finding the correct permissions for running a WordPress site on my droplet. I followed this guide to configure the site: How To Configure Secure Updates and Installations in ...
1
vote
1answer
69 views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
42
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
2
votes
2answers
833 views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
-1
votes
1answer
51 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
1
vote
2answers
870 views

How to detect NX/XD bit under Windows

I'm trying to find a way to detect (using software) if the system I'm on has 'No eXecute' bit capability. Under Linux I would simply list the CPU features using /proc/cpuinfo but I found nothing in ...
0
votes
1answer
40 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
-1
votes
2answers
66 views

Can't update to latest PHP version. Centos 7 [closed]

I'm unable to update to the latest PHP package. I ran yum update php and it updated to PHP 5.4.16. Reran the update command to see if there was any newer versions and stated there was no packages ...
0
votes
0answers
18 views

PHP Change log Centos 7 [duplicate]

Might be a silly question but Im looking at the change log for PHP by running this command - rpm -q --changelog php | grep CVE See all the CVE's listed does that mean they have been patched in the ...
0
votes
0answers
11 views

LANCOM 1781VAW disconnects any VPN connection after 1 hour. Why?

I have a small infrastructure here and we are wondering why our lancom-router (1781VAW) disconnects any vpn connection after 60 minutes. how could i troubleshoot this? is this maybe a security ...
1
vote
2answers
47 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
1k views

Site2Site tunnel via SSL VPN?

i have tried convincing my opposite office of the tunnel in question to get site-2-site ipsec up and running. However they are not really into that and run everything via SSL VPN.. Is it possible to ...
27
votes
8answers
48k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
2
votes
3answers
2k views

Linux /etc/security/limits.conf explanation

Can anyone explain (or know of a source) that provides details about the items in limits.conf? The man page doesn't give much detail. For example it says: rtprio maximum realtime priority allowed ...
0
votes
1answer
46 views

Network Security: Lan Manager Authentication Level

I'm a little bit confused by the explanation provided for the setting "Network Security: LAN Manager AUthentication Level" in group policies. The provided explanation only talks about clients and ...
8
votes
3answers
949 views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
-1
votes
1answer
91 views

How is Docker being used in VPS hosting? [closed]

I'm curious how Docker is being used to host VPS 's ? e.g. I get that it's very fast to boot, but I've heard that security of Docker is not enough to keep people out of the main system... How are ...
16
votes
10answers
12k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
2
votes
3answers
5k views

How to configure a network to block gmail but allow google apps mail?

Google app mail loads via http://mail.google.com/a/[domain] and gmail loads via http://mail.google.com/mail. How can I block computers on my LAN from accessing gmail urls but at the same time permit ...
0
votes
1answer
44 views

Windows server private shared folders

What is the best practice for sharing private home folders with the users (Windows Fileserver with AD)? I was asked this question today after someone watched this video, and it got me thinking.. ...
4
votes
1answer
57 views

Multiple websites on multiple servers - seperate mysql or not

I currently have 2 Debain boxes (VPS - 4Gb memory) and am hosting a variety of websites of different importance, some ore production sites, others are demo/staging/test sites. Approximately 15-20 ...
1
vote
1answer
34 views

Windows 7 Unchangable AppLocker Rules

I have a windows 7 image that appears to be using an applocker ruleset that I'm unable to modify or disable. Performing the following appears to have no effect on this enforced AppLocker mystery ...
0
votes
0answers
27 views

Disable Keyboard on Ubuntu Kiosk Touch PC

I'm in the middle of deploying a series of Kiosk PC's with a minimal Ubuntu server and a web enabled Application(Rails) on it. The hardware are Shuttle All-in-one PC's at the moment. The PC starts ...
0
votes
1answer
3k views

Windows: disable remote access of local drive, even by domain admin

We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In ...
0
votes
0answers
26 views

Meraki Z1: protection of corporate devices from personal devices

My company employees about 600-700 remote employees, each of whom is issued a corporate IP phone an a thin client compute endpoint. In our current deployment, both devices are configured (defaults ...
0
votes
0answers
28 views

Apache2 + Chroot + PHP global prepend

I have a Debian Wheezy server with PHP 5.4 and Apache 2.4 . I have following problem: User A has home dir /home/user_a with public directory /home/user_a/public_html User B has home dir ...
0
votes
1answer
103 views

PCI Failure due to HTTP Reverse Proxy Detection

We use Security Metrics for our PCI compliance scans. Haven't had any issues in the past but our most recent scan said we failed due to "HTTP Reverse Proxy Detection". I'm guessing this has to do with ...
1
vote
0answers
34 views

Owncloud - Proxy changes certificate

I'm running an owncloud server 7.0.2 with apache(Ubuntu host) and configured it to use a self-signed ssl certificate. Everything works fine on my home-PC On an other machine I would like to use the ...
0
votes
3answers
483 views

Apache2 ssl with ecc

Is it possible to configure Apache2 to use elliptic curve crypto (ecc) with SSL? This bug https://issues.apache.org/bugzilla/show_bug.cgi?id=40132 appears (to me) to indicate that this is supported, ...
0
votes
1answer
55 views

Do blocking input ports increases security?

1-Do blocking unused input ports in firewall increases system security? How? (as there is no daemon listening on those ports anyway) 2-Do dropping those unused ports will positively or negatively ...
0
votes
0answers
39 views

Intermittent SSH problems with a specific server from a specific Wifi router

I've been ssh'ing into a specific server from my home office via Wifi and Time Warner Cable internet for years with no problem. In recent months, I started having problems, where I'd be unable to ...
-4
votes
1answer
70 views

Restrict Access from certain machines to my Web Application in LAN [closed]

I am trying to deploy a Local Network web application, which should not necessitate a client login. The requirement is to block certain machines, (not users, just a few computers, the application ...
4
votes
1answer
34 views

How are files being added to site as apache, when site is running as FastCGI?

I have a web server that is running many different sites (standard vhosts setup, most sites are Joomla based, a few wordpress and other non-CMS sites) in a Parallels Automation 11.5 environment. The ...
-6
votes
1answer
41 views

encryption of fiber communications [closed]

We have to connect one site to another using leased fiber ( theoretically it's a dark one ) in order to replace a radio link. All servers are in one site. Both location now have Gigabit networks. Can ...
0
votes
2answers
435 views

How to transfer large files between two remotes by using a third machine?

I need to automatically mirror a large amount (terabytes) of files in two unix machines over a slow link (1 Mbps). This needs to be done frequently, but the data doesn't change too much (delta ...
2
votes
2answers
736 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
0
votes
2answers
270 views

Cannot select from new view in MySQL (can select from everything else)

I am a newbie to MySQL, being more accustomed to MSSQL. However, we have recently purchased the LabTech management software, which uses a MySQL back end. While writing a custom report to keep track ...
0
votes
1answer
39 views

Securing Webserver and Database

I need to secure an internal web server and sql db, that is going to be made public(www) At this stage im only looking to provide a reasonable amount of security($$) until it gets bigger at which ...
67
votes
6answers
45k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
0
votes
5answers
1k views

Is It Possible to Copy an AWS Security Group?

We have some security groups that have quite a few rules in them. Rather than having to recreate the same rules for a number of security groups just to accommodate minor differences, is it possible to ...
2
votes
1answer
72 views

Least-Privilege BUILTIN\Administrator Failure Configuring Application Control Policies with AppLocker

I asked this question over at SuperUser to no avail a while ago, before realizing that serverfault may be a better option. I'm configuring execution control on a computer running Windows 7 SP1 ...
0
votes
1answer
22 views

Set base directory for dynamic virtual hosts

I use Dynamic VirtualHosts for a hosting service I run. Currently, it only allows static sites, however I'm working on a new version which will support PHP. This clearly opens some security issues. ...
9
votes
5answers
9k views

What steps should I take to secure Tomcat 6.x?

I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible. I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory ...
4
votes
2answers
3k views

Password for GNU screen lockscreen command?

I have set a password for screen sessions in my .screenrc. It works great, any time I need to re-attach to a screen session I need to enter the password. There is another feature where you can ...
0
votes
1answer
52 views

Does DB2 accept SSL3 connections?

Does DB2 allow connection through Secure Sockets Layer version 3 (SSL3)? To be more exact, will a program using SSL3 connection get an access to DB2? or will it fail? If it does accept it, is there ...
1
vote
2answers
66 views

Safety of sshpass and SFTP to dynamic host

I have a server with dedicated IP address A and a server with dynamic IP address B (routing via no-ip.org). A uploads a backup to B via sshpass: export SSHPASS=*** sshpass -e sftp **@** << ! ...
10
votes
7answers
12k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
0
votes
0answers
6 views

Create a persistent mapping for a apppool identity

Can I create a persistent mapping for a apppool identity? For instance the IIS website "www.example.net" should access "\10.10.10.222\shared$" through F: My Website is MVC(5) so I think the ...
0
votes
0answers
20 views

How do I block all requests by default in vhost configuration?

I am setting up a site using standard apache vhost but I have multiple domains pointed at the server. I know the first vhost catches all the other names even if they are not listed under the vhost. ...