Security is not a product, but a process.

learn more… | top users | synonyms (1)

11
votes
6answers
33k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
0
votes
1answer
111 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
0
votes
0answers
30 views

Zentyal - Samba Issue : A logged in user cannot access home folder

0 down vote favorite I have a very strange issue : I can login to my domain with my username/password and when i try to access my home folder (lets say \Knosos\myname ) i receive an access denied ...
1
vote
1answer
34 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...
0
votes
0answers
56 views

How do I require a sudo password on Google Compute Engine instances?

The default configuration of Google Compute Engine instances allows administrators to run all commands via sudo without specifying a password. This seems like a security weakness, because the theft of ...
1
vote
3answers
703 views

Erase Sharp Printer Hard Disk?

I have a number of Sharp MX-M550 printers that are at the end of their useful life. Each device has a hard disk. Can anyone advice as to how I go about erasing the drives either whilst they're in ...
1
vote
1answer
53 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
0
votes
0answers
32 views

Windows File Security settings

I would like some input on a problem I am working on. The scenario is as following. I have a folder which has security settings (permissions) that are inherited. One of them is a permission entry for ...
4
votes
6answers
38k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
0
votes
0answers
17 views

OpenVpn Client credentials security, key crt generation

I'm curious what is Your opinion on openvpn client crt/key security In most cases (tutorials), the clients key/crt are generated on the same openvpn server, and no one cares about the future. This is ...
2
votes
7answers
2k views

Enabling xp_cmdshell in a production environment

A SQL developer on a project I am working on has asked whether it would be possible to enable xp_cmdshell on the production database as it is easier to export CSV files using xp_cmdshell than to write ...
1
vote
2answers
84 views

Security implications of using relative paths in the PATH enivronmental variable?

We had an audit just flag us for having relative paths inside out $PATH env variable. I am uncertain if this is truly a security concern and would like to reach out to everyone to see if this is ...
0
votes
1answer
28 views

Understanding Apache rules in <Directory> directive

I have tried reading the manual although to be honest I am still finding it hard to understand and get my head around what the Order/Allow actually does. I have the following code inside a virtual ...
0
votes
0answers
29 views

How to respond to password crack on SSH server? [duplicate]

Update: I'd already read How do I deal with a compromised server? but was hoping for advice specific to a password crack (such as using fail2ban), as well as info about whether this could be an OS bug....
0
votes
1answer
38 views

What is the best way to isolate vhosts on a linux server?

Firstly, I'm wondering what is the best way to isolate Apache's vhosts from each other. I suppose this has something todo with the Linux filesystem as well, since it's not a good practise to have ...
56
votes
4answers
12k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
2
votes
2answers
64 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
4
votes
2answers
4k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
2
votes
2answers
43 views

Is it possible to encrypt a virtual machine or container so the host is not able to read any of its data? [duplicate]

I'm wondering whether it would be theoretically possible for a cloud hosting provider to run an application for a customer where the customer doesn't trust the hosting provider with the data in the ...
1
vote
0answers
29 views

Determine server damage - File injected possibly through ProFTPD [duplicate]

I just found a file at the /tmp/ directory named .<?php passthru($_GET['cmd']);echo 'm3rg3';?> Owner and GroupOwner are "proftpd" and "nogroup", respectively, as follows: -rw-r--r-- 1 proftpd ...
0
votes
1answer
49 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
10
votes
8answers
27k views

Is using integrated security (SSPI) for accessing SQL Server better for web applications?

When deploying web applications (.net) to a production environment, is it better to use integrated security or does it even matter? It seems to me that if a hacker breaks the web server, it won't ...
0
votes
0answers
10 views

How do I supply username and password to dovecot's fts_solr plugin?

I setup solr-tomcat with password protection (on Ubuntu 16_04) and now would like to connect fts_solr from my dovecot IMAP server. However, I cannot find a way to supply username and password in the ...
1
vote
0answers
21 views

How I can look from that script runs sendmail?

my problem is that some script in php or some other script or program is sending spam. I am not able to trace where this program runs. do the following: ps aux | grep sendmail nginx 28286 0.0 ...
1
vote
0answers
16 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
61 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN msg=audit(...
15
votes
9answers
7k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
3
votes
1answer
360 views

How to verify installation of ImageMagick is not vulnerable to CVE-2016-3714

CVE-2016-3714 was announced on May 3, 2016. This vulnerability unfortunately goes by the name, ImageTragick and has received some press (for example, this ArsTechnica article). Until updated ...
1
vote
0answers
43 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...
0
votes
0answers
78 views

Jenkins 2.x disable initial admin setup

we're using Jenkins as a cron server adding/starting crons via api. We created a vagrant box installing the jenkins. Since version 2.0 jenkins require to create an admin account (link) before disable ...
0
votes
0answers
15 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
0
votes
0answers
19 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
0
votes
1answer
148 views

PSAD does not start on Ubuntu 14.04

I complied PSAD from source, compilation went smoothly however when I run this command: sudo psad --sig-update I got this: Can't load '/usr/lib/psad/x86_64-linux-gnu-thread-multi/auto/Date/Calc/...
-1
votes
1answer
24 views

Setting up an ssh authentication server

I have some 30 Media Temple grid servers and I need to manage the access of 15 or so developers to those servers. Is it possible, and more importantly secure, to setup a server who's only job is to ...
2
votes
1answer
45 views

How to secure configuration management server

There are many configuration management software options nowadays (Chef, Puppet, CFEngine, Ansible...) which offer an architecture with their repository on a central server and clients communicating ...
2
votes
3answers
208 views

AWS Security Groups vs Windows Firewall

Is it considered best practice to disable the Windows Firewall on an Amazon EC2 instance, and control traffic only via EC2 Security Groups? If I open a port on the server firewall, and then open the ...
14
votes
6answers
21k views

Securing a SuperMicro IPMI BMC

I've recently acquired a SuperMicro X8DTU-F motherboard, which has a built-in BMC, which basically runs the IPMI system. It turns out to be a small Linux system running on an ARM processor. ...
-1
votes
1answer
23 views

Allow run /sbin/ifconfig to user

So, I want to allow some user to execute ifconfig. I'd created a special group "if" and done user to own this group. And now I'm going to do "chown root:if ifconfig". But I think: What wrong thing ...
0
votes
0answers
33 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
2
votes
0answers
48 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 09:...
2
votes
2answers
25 views

How much protection is provided for my remote centos vps by using certificate-only root login

I have two leased centos servers, one to run mysql for backends to the web and mail server on the other, as well as data from my android apps. I am only planning to give access to the data server if ...
1
vote
0answers
239 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
0
votes
1answer
44 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
0
votes
0answers
35 views

WordPress site with no traffic; MySQL reporting 300-500 queries per second, frequently crashing

My server is running Debian 7.10 (Apache 2.2.22, MySQL 5.5.47, PHP5). It's a VPS. I've tried to summarise the issue in the title. I'm running a very small, private WordPress blog which is only ...
2
votes
1answer
47 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
2answers
28 views

Is it necessary to secure TCP traffic for PHP FPM over shared private VPS network?

There are lots of recommended practices and tutorials for securing various components of a LEMP/LAMP stack when running in a cluster whose private network traffic is shared by other, potentially ...
6
votes
5answers
18k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
2
votes
0answers
17 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
1
vote
3answers
258 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
2
votes
3answers
98 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...