Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
2k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
1answer
27 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
5
votes
7answers
10k views

Should I use a login banner and if so, what should it say?

Are interactive login banners worth having? The general consensus is that they are, but what should the banner say? Some things that are being considered (no particular order): ownership of the ...
2
votes
2answers
121 views

IIS only serve requests with hostnames

What is the optimal way to configure IIS to block direct IP access to the server? Direct IP access is only used by malicious scanners that will troll the entire internet by ip looking for vulnerable ...
0
votes
1answer
923 views

How do I install OSSIM (Alientvault SIEM) manually?

AlienVault by defult is a .iso image. It installed on the core of Debian. I want to install it on Ubuntu 12.04. How can i do that?! Or is it possible or not?! (AlienVault is a SIEM product, it is an ...
21
votes
6answers
58k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
1answer
56 views

How does TeamViewer get through my firewall even though I set it to “No incoming connections”? [closed]

Here is my firewall settings: Clearly, firewall is on for both private and public networks and it is set to "Block all connections including programs on the list of allowed programs". I did not ...
0
votes
2answers
345 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
2answers
67 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
0
votes
1answer
31 views

Blocking requests matching HTTP_X_FORWARDED_SERVER header

Someone has setup a CDN server which is directing traffic to my server and setting the HOST header to match one of my real domains. Because of this, Apache uses the virtual host for my real domain ...
2
votes
2answers
91 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
10
votes
3answers
26k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
126
votes
4answers
114k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
1
vote
3answers
312 views

Apache httpd server 'is it possible': Alert on specific condition in access/error log

I'm just wondering is it there some module which can detect certain event in access/error log and if it matches it, to send an email with information. example: I want to detect when someone makes ...
7
votes
5answers
35k views

How can I know when a file was last read or accessed on Windows?

I need to determine if a particular file was accessed in the last, say, 2 days. Is this possible on Windows Server 2008 R2?
46
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

I love the idea of accessing servers via keys, so that I don't have to type in my password every time I ssh into a box, I even lock my user's (not root) password (passwd -l username) so it's ...
0
votes
1answer
58 views

Private communications between AWS EC2 instances

I have three EC2 instances with elastic IPs. Each one contains a server. Each server needs that TCP ports 8181, 2181, 2888 and 3888 are opened on each machine. Each server should have the possibility ...
2
votes
0answers
36 views

SSH: Security of Pubkey Authentication vs Password [migrated]

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and ...
1
vote
1answer
661 views

nginx - deny all *.php requests except index.php for security reasons

os: CentOS 7 nginx: 1.6.2 httpd: apache 2.4.6 cms: Drupal 7 After my server was compromised I removed all from server, reinstalled OS and soft, and restored data from backup. Now I configure all ...
1
vote
1answer
171 views

Is setting a Content Security Policy incompatible with Joomla's admin page?

I'd like to set a content security policy header for a Joomla website running on Apache 2.4. Using this configuration from h5bp and setting Header set Content-Security-Policy "script-src 'self'; ...
1
vote
1answer
34 views

Single row user security in MS SQL 2008 R2

I have a SQL Server 2008R2 question regarding making a single row in an odd way. situation: I have a student records database in which ~ 100 students might in-process in a given day. They enter a ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
0
votes
2answers
265 views

how limit php script to access parent host directory

I've a debian linux server with apache2.2 & php5 installed. I've created many virtual hosts on my apache server, each virtual host has a separate root directory & php is enabled for all of ...
2
votes
1answer
35 views

Concealing an RDP service with a website

Is there a way (using a proxy or otherwise) to conceal an RDP service listening on port 443, such that HTTPS requests made from a browser serve a website while RDP requests connect as normal?
2
votes
1answer
82 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
1
vote
0answers
54 views

SSH Passwords are working using IP address, but not when using the server name

We recently rebuilt one of our servers using Ubuntu 12.04 LTS and experienced something we haven't seen before. When we attempt to ssh into the box, we are able to ssh into the box if we use the ip ...
0
votes
1answer
505 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
3
votes
2answers
103 views

Secure with TLS/SSL

Is there any way to secure network traffic between any two applications with SSL even both applications don't support SSL mode? Diagram: (Host X (Application A) ) --------unsecured connection----- ...
1
vote
0answers
23 views

Tracing namespace mining culprit

I have a Centos 6x box with these installed: CXS + CSF + LFD. I'm trying to figure out how to effectively trace what MS is claiming namespace mining on my IP. From Microsoft: We have completed ...
0
votes
0answers
15 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
-1
votes
1answer
40 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
18 views

Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?

I have a interface where traffic is flowing from internet to NGINX server to application server. I want to monitor (IDS) the traffic flowing between Internet and NGINX at L3,4 and IPS the traffic ...
2
votes
1answer
45 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
9
votes
6answers
507 views

Security Admins toolkit? What's in yours? [closed]

Resource question :- I need to collate a list of security admin tools For: Web Network Wifi Server unix/Linux/windows/macosx SQL Xss Please state -links/version/os used/free v buy
0
votes
1answer
40 views

Windows server 2008 Admin password changes after logout

I have windows server 2008 with two administrator accounts and I have a fixed IP for it. I access the server with remote desktop but every time I logout of any of the 2 admin accounts i can't login ...
1
vote
1answer
78 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
40
votes
10answers
11k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
2
votes
1answer
94 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
0
votes
1answer
82 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
1
vote
1answer
95 views

how to block all requests from URLs with MSDOS device name using isapi filter cve 2007-2897

I recently had an audit report on my windows server 2008 R2 and it failed with the error/vulnerability: Microsoft asp.net ms-dos device name DoS www (443/tcp). I have not been able to find any ...
-1
votes
2answers
34 views

Creating Virtual Proxy Server

I know this is not this kind of forum, but I can't find anything in google that really answers my question. Is there possible to create a Proxy server running in a Virtual Machine using only 1 ...
5
votes
7answers
6k views

Why would you use EAP-TTLS instead of PEAP?

As I understood EAP-TTLS and PEAP share same level of security when implemented in wireless networks. Both only provide server side authentication via certificate. The drawback of EAP-TTLS can be ...
1
vote
1answer
67 views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...
0
votes
2answers
4k views

Allow service to interact with desktop

DC OS - Windows Server 2008 R2 Std Client OS - Windows XP, Windows 7 I have implemented Security policy through Network Policy Server and enabled Wired AutoConfig Services Automatically. While ...
-3
votes
1answer
103 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
12
votes
7answers
2k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
1
vote
1answer
23 views

Is is possible to have an Admin account manage both Exchange 2013 (on prem) and Office 365?

We are in hybrid mode and a few people are asking me to create an additional account for them so they can administer O365 and use a different account for on prem exchange. After troubleshooting on my ...
0
votes
0answers
25 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...