Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
2answers
4k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
0
votes
1answer
47 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
55 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
5
votes
8answers
670 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
19
votes
2answers
1k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
1
vote
2answers
797 views

Getting Windows 7 to run Scripts from Other Shares then NETLOGON

I have several Windows Server 2003 Environments I administer. These are separate disparate domains with their own structures and policies. I generalize as much as possible when I administer these ...
-1
votes
3answers
145 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
2
votes
1answer
300 views

Duplicate Administrator Accounts

Somehow, I have a Windows 2003 Server that has two local Administrator accounts that have the same SID (S-21-xxxxxxxxx-500). Therefore, normal utilities don't let me delete them. (Can't delete a ...
2
votes
1answer
41 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
-1
votes
1answer
152 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
3
votes
2answers
1k views

Debian: automatic notification of updates?

What's the simplest way of getting notified of security updates for packages I have installed on my Debian system?
62
votes
13answers
29k views

What steps do you take to secure a Debian server?

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
0
votes
1answer
70 views

Security Auditing on Ubuntu 14.04 LTS

The Tiger security auditing tool has been a standard install in the past. However, it doesn't look like Tiger is being updated. Is Tiger still a valid security auditing tool on Ubuntu 14.04. If ...
-1
votes
1answer
33 views

Is www-data considered a non-privileged user on Apache?

Great Apache Hardening post that recommends "Run Apache from non-privileged account" because "Default apache configuration is to run as nobody or daemon." Is www-data:www-data considered a ...
0
votes
1answer
34 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?
4
votes
2answers
593 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
2
votes
1answer
524 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
12
votes
13answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to ...
10
votes
2answers
2k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
1
vote
1answer
63 views

Is storing password hashes in plain text dangerous?

We have a server that is going to be managed through a chef cookbook. Each user for the system is configured using hashes from /etc/shadow. Can we safely store these shadow hashes in our ...
0
votes
1answer
31 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
1
vote
0answers
14 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
1
vote
2answers
35 views

Ability to use SSH Key / PEM for web authentication in lieu of password protection?

I've been trying to figure out a way to lock down our dev site even more, and the idea came up that instead of using IP centric + Password protection, using something more akin to a PEM key, like I ...
2
votes
1answer
74 views

chattr - How to change file +i attribute without using chattr

Here`s the problem. My server got probably hacked. I would like to change a config file, but it is immutable (has the +i attribute), so I can't edit it. trying to execute a "chattr -i" on the file ...
3
votes
7answers
1k views

What can I do to replace FTP?

I'd like to replace FTP access with systems that are more secure. Sending passwords in plain text with no encryption is unacceptable and with single-sign-on growing, becoming less acceptable daily. ...
-2
votes
1answer
88 views

Prevent/Stop Namespace Mining [duplicate]

Enviroment: Plesk v12, latest Windows Server 2012 SmarterMail My web hosting provider told me that someone hacked into my server a couple of weeks ago and was hitting various mail servers (Gmail, ...
2
votes
1answer
77 views

Is the server still vulnerable to attack if we don't turn off cgi.fix_pathinfo?

The /etc/nginx/sites-available/default file that comes with nginx installation has the following content: # You may add here your # server { # ... # } # statements for each of your virtual hosts to ...
-2
votes
1answer
53 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
12
votes
4answers
321 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
1
vote
1answer
210 views

Apache 2.4/PHP-FPM ProxyPassMatch and access restriction

I've got Apache/PHP setup exactly like this: https://wiki.apache.org/httpd/PHP-FPM It includes the ProxyPassMatch rule as mentioned: ProxyPassMatch ^/(.*\.php)$ ...
-1
votes
1answer
37 views

Making Private Domain Marriage Public Domain Name - Revisited

I'm building a server with Windows Server 2012 and I've checked many articles on the net about "naming" your internal domain. Interestingly, most of the comments are from 2009. As we all know, times ...
0
votes
1answer
80 views

How to block spambots and about security

Is it normal to have many many lines in /var/log/kern.log about UFW block? For example: Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me ...
0
votes
1answer
29 views

Under what conditions in Apache installations is AddHandler application/x-httpd-php .php required?

I am a security researcher who has been running into multiple cases where file upload forms can be exploited, allowing attacker-controlled PHP code to be interpreted by the server, leading to remote ...
3
votes
2answers
160 views

Securing elasticsearch

There appears to be a serious lack of information on this despite the fact that as installed elasticsearch is extremely exploitable. My main fear in using it is that as a non-expert I have no idea ...
10
votes
8answers
4k views

Best file system for external (USB) hard drives/USB memory media

Almost all external USB hard drive and USB memory media/sticks come today preformatted with FAT32. As far as I know the only advantage of the file system is the compatibility among OSes and devices. ...
0
votes
2answers
65 views

IE11: Allow display of local HTML files

How can I enable Internet Explorer 11 that has Enhanced Protected Mode turned on to display local HTML files? This is very annoying also I see the security need behind this feature. Can someone ...
1
vote
0answers
64 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
10
votes
9answers
3k views

Multiple *NIX Accounts with Identical UID

I am curious whether there is a standard expected behavior and whether it is considered bad practice when creating more than one account on Linux/Unix that have the same UID. I've done some testing on ...
0
votes
1answer
44 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
0
votes
0answers
33 views

RHEL 5 with PHP 5.1.6 VS RHEL 6 with PHP 5.3.3: Security implications

Using only the RHEL Repositories, RHEL 5 considers PHP 5.1.6 to be up to date, and RHEL 6 considers PHP 5.3.3 to be up to date. My question is: Are security updates/patches backported so that 5.1.6 ...
-1
votes
3answers
40 views

Is it possible to configure inheritance for EC2 VPC Security Groups?

We'd like to be able to access the instances in our VPC from the various public IPs that we have in our corporate network. Is it possible to create security groups (like operator-security-group) and ...
-2
votes
1answer
263 views

How can I upgrade apache in Ubuntu 14.04 LTS

I'm running an Ubuntu server 14.04 LTS (Long Time Support), it comes with Apache/2.4.7. However, Apache 2.4.10 is out, with some security fixes I'd like to have. So how can I get these security ...
-4
votes
3answers
1k views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts: Default SSH port is moved from its default Firewall blacklists an IP ...
0
votes
0answers
18 views

Restrictions for remote Vmware View users

We have a Vmware View VDI infrastructure with several thousands of users that can log on from the internal network and from Internet thru a VMware View Security Server. We want to restrict ...
2
votes
0answers
895 views

What does the red x icon mean next to a user in folder permissions (Windows 7) [duplicate]

In trying to debug various strange issues on a machine, I found something strange - when I go to C:\Users\administrator and get properties, security tab, it lists the users (the local admin account, ...
0
votes
1answer
118 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
-1
votes
1answer
50 views

What is it that makes BSD a popular choice for firewalls? [closed]

What is it that makes BSD a popular choice for firewalls? Is the kernel generally more secure?
-1
votes
2answers
40 views

Multiple non-http services, 1 static IP [closed]

I have an issue where we have several non-http(s) services which we would like to access from across the WAN. SSH is a primary protocol we'd be using, FTP as well. Here's how things are laid out. We ...
3
votes
2answers
285 views

Centrally managing logins to lots of linux machines

We have a growing collection of servers, both physical and virtual, which we need to login into. Login is usually with SSH, using an RSA key pair rather than a password (which is switched off in SSH ...
-2
votes
1answer
38 views

Unix Server Protection from Physical Access?

I'm working to license our software to some buyer. Our software will be ran from an unix server that is physically controlled by the buyer. Is there any way to prevent the buyer who have physical ...