Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
1answer
49 views

TCP echo server security [closed]

I am setting up a Linux server similar to a TCP echo server and am wondering about security issues I should be concerned about. This will be a bare bones Centos/KDE server with no additional files ...
0
votes
1answer
47 views

Lean but effective linux IDS / IPS / WAF? [closed]

I'm looking for a lean but effective IDS/IDP/WAF solution for my tiny VPS webserver. Currently I already use iptables and psad but a lot of the web server scanning attempts slip through. I use ngingx ...
0
votes
1answer
136 views

Workaround needed to run FileMaker Server 12 Admin Console with the new Java security model

As of Java 7 update 51 (7u51), there is a requirement for a new Permissions attribute (introduced in 7u25) that prevents the FileMaker Server 12 Admin Console from running. This also affects the ...
23
votes
4answers
677 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
1
vote
1answer
47 views

Secure installation of KVM VPS?

I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain ...
0
votes
1answer
22 views

In sysctl.conf settings, what is the difference between 'all' & 'default'?

In context of sysctl.conf settings, what is the difference between (all vs. default) like net.ipv4.conf.all.accept_source_route & net.ipv4.conf.default.accept_source_route in sysctl settings ? ...
1
vote
1answer
23 views

How to configure fail2ban for constant refreshes

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want ...
3
votes
3answers
952 views

Lock Workstation Glitch? (AD/Windows XP)

I was playing with a lab setup recently (Windows 2003 R2 x32 SP2, Windows XP SP3, Active Directory) and noticed that if I locked the workstation, the following strange behaviour appeared: I have a ...
2
votes
1answer
130 views

What should I do if an necessary client application has to run on an older (vulnerable) framework?

A client needs to have .NET Framework 4 installed and not patched so their software running on their Windows 2008 R2 Server functions properly. This sparks the questions: When is it okay to ...
2
votes
1answer
43 views

Serving multiple web-service instances [closed]

We're building an API-based web solution on Python which is going to be delivered to individual customers. Each customer is going to have a separate dataset. Currently, it's not a problem to deploy ...
39
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
-1
votes
1answer
52 views

Block All Ips from editing files on server [duplicate]

We have been under recent attacks from a hacker and we need to be able to stop all IP addresses from editing files except for the ones at our office. I know how to do this via an .htaccess file ...
1
vote
1answer
61 views

what are the security implication of intentionally leaking a ssl certificate?

I have a website (http://example.com) which makes some requests to http://localhost:12345 in its javascript. I want to open this website over https but due to mixed content some browsers throw ...
0
votes
2answers
36 views

Security Help? Is this a safe way of doing things?

I am running Apache with Debian. At the moment to share my site I am just setting up my router to foward my local ip on port 80. So anyone who wanted to look at my site can just type in my router's ...
-1
votes
1answer
29 views

How to access a file or directory from another server without copying it over? [closed]

Sorry if this is a dumb question. I have my reasons for wanting to do this. I am looking for a way to possibly access directories that are dependencies without actually having to copy them to my ...
0
votes
1answer
39 views

Protect against inadvertent command entry

I have a couple boxes in production and then some in a test environment. Anyone have any clever ways to protect against typing in inadvertent commands into boxes? i.e. I want to put a confirmation ...
0
votes
4answers
297 views

New system administrator - Any security suggestions? [closed]

We hired a new system administrator and this will be the first time delegating this sensitive task to a third person. He's a good guy but we are still wondering about security. What do you recommend ...
2
votes
2answers
50 views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
3
votes
2answers
203 views

Smartphone email safety

My boss is confident that Blackberry phones are safe for company use (having it connect to the email server, etc.). He is less confident about iPhones. Regarding connecting to a corporate email server ...
3
votes
1answer
44 views

Ban IP Address on unsuccessful login on Server 2003

I'm regularly under brute force attacks on my Windows Server 2003 with Citrix installed. How can I automatically ban IP addresses that have several unsuccessful login attempts ? This question has ...
3
votes
1answer
41 views

Microsoft Multi-factor Authentication not working with RDP

I am installing a new remote access server, where I need multi-factor authentication for RDP access (=a call back to the user's cell phone after they enter their credentials). The problem is that the ...
1
vote
0answers
47 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
-1
votes
1answer
31 views

Multi-tenant site and global privacy issues [closed]

I have a multi-tenant website. It has been hosted in the USA for many years with no problem. In recent years my customers in Australia, Canada and the EU have shared concerns as their countries ...
2
votes
2answers
735 views

MySQL log shows 3 root users, 2 without passwords? Why?

Our MySQL log displayed a warning on restart about 2 root users not having passwords. I went into MySQL and checked all users: mysql> select * from mysql.user; and see: Host | User ...
0
votes
1answer
28 views

An account failed to log on Message on Windows 2008 R2

I'm having hundreds of messages in my Security Event System like: An account failed to log on. Failure Reason: Unknown user name or bad password. Caller Process Name: ...
2
votes
0answers
61 views

What kind of hacking attempt is this? [closed]

This past week, my traffic logs are showing many hits (usually with repeated tries) for a url from perhaps 30+ different ip addresses all over the world. This is not a url that should garner more than ...
0
votes
1answer
24 views

In apache how do you validate that the logged in username matches the directory name?

Sometimes you want to setup a directory structure in apache such that logged in users can only see their own directory. (i.e. the directory name and the username match.) What do you put in the ...
1
vote
1answer
35 views

How to unable mail.example.com from browser (ISPConfig)? [closed]

I am running under Debian 7 + ISPConfig 3. I have recently configured the dns (at OVH web hosting service) so that ISPConfig manages the dns zone. For foobar.com, I have a MX record that points to ...
13
votes
2answers
848 views

Are subdomains public information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
3
votes
1answer
975 views

Administrator/Guest Account Status “Not Applicable”?

I've never seen this before, and hope someone here can help explain this. The following screenshots were taken on a computer that is not a member of any domain, and therefore not having any Group ...
1
vote
1answer
42 views

Do linux security modules (LSM) run on virtual server (vServer)? [closed]

I have a vServer for 10 EUR/month from 1und1 and I know that it is not a dedicated machine (meaning I have less control). I know that I can use some the system as root, yet the kernel is untouchable. ...
10
votes
5answers
4k views

How did Matasano get hacked?

from: http://seclists.org/fulldisclosure/2009/Jul/0388.html If I understand it best from the posts from: http://news.ycombinator.com/item?id=723798 the Matasano guys left sshd internet accessible - ...
1
vote
0answers
38 views

Why can a local root turn into any LDAP user?

I know this has been asked here before, but I am not satisfied with the answers and don't know if it's ok to revive and hijack an older question. We have workstations that authenticate users on an ...
2
votes
0answers
64 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
0
votes
1answer
35 views

DDoS Attack Mitigation Techniques [duplicate]

Our hosting is set up on Amazon EC2 servers, which have been performing great. The problem we run into are spikes in requests for invalid URLs from scripts/bots looking for security holes. When ...
-1
votes
1answer
40 views

Misuse of the statistics script of Plesk?

I downloaded the log file from the web server, and found many strange entries. Why is a statistics script called so terribly often? What do all the junk referrers do there? Looks like some ...
20
votes
3answers
3k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
3
votes
2answers
171 views

How to protect server against brute-forcing of http authentication?

I have an CentOS/Apache server with a classical .htaccess system of login/password (authtype basic etc...) I have fail2ban and my iptables are setup to prevent sshd attacks, but I don't know what to ...
0
votes
0answers
16 views

How vulnerabilities in the Java affects application running in Tomcat/JBoss

I wonder what impact has Java vulnerabilities on application in Tomcat. For example Java 1.6u45 has many reported security bugs (Remote Security Vulnerability). You can easily exploit it on client ...
0
votes
1answer
46 views

Configure Apache to allow the access for the specific URL under VPN [closed]

Here is the case, I want to configure the Apache server so that some of the URLs can be accessed under VPN and some of them should be accessible with/without VPN. Here is my scenario Without VPN ...
2
votes
3answers
3k views

Completely disable CD/DVD Rom access to all users on Ubuntu 12.04 LTS?

We are using Ubuntu 12.04 LTS. Following is output fromuname -a command: Linux trainingmac1 3.2.0-32-generic #51-Ubuntu SMP Wed Sep 26 21:33:09 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux We are training ...
0
votes
1answer
79 views

LDAP throws Event ID 2887 warnings even after enabling “require signing”

I am running an AD LDS directory and, ever since configuring it, I have been seeing 2887 warning messages, so I have decided to follow this guide to have the server require LDAP signing. The problem ...
2
votes
0answers
13 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
0
votes
2answers
53 views

Dealing with Apache spam

I am recieving a lot of suspicious requests which cause Apache to use a lot of memory (over 1GB) [Mon Feb 24 09:48:29 2014] [error] [client 120.37.238.125] PHP Fatal error: Allowed memory size of ...
0
votes
2answers
72 views

Block a Non-ActiveSync Device from accessing Exchange 2010

We're trying to tighten security, and block users from accessing our mail server without having the proper MDM on their phones. With programs like Aqua Mail and CloudMagic, it seems like they go ...
-6
votes
1answer
49 views

Change original port number [closed]

The default port number for ssh is 22 is there a way to implement security by being obscure and changing the original number? So for example ssh would not be on port 22 it would be on lets say 2847.
0
votes
0answers
37 views

Mail Server: Postfix & Dovecot Security

For the fist time I decided to configure my own email server on a VPS from the scratch, I've been following some guides and doing some research but I've some doubts about the security of my Postfix ...
0
votes
1answer
39 views

what would happen when macchanger to gateway mac address? [closed]

I thought arpspoof GATEWAY_IP -t VICTIM_IP can be prevented by add a static arp entry on victim side, i.e. arp -s GATEWAY_IP GATEWAY_MAC I read ...
0
votes
3answers
80 views

Is it a good idea to only allows connections to be established in the LAN->DMZ direction?

I'm trying to setup the usual thing, with a DMZ containing servers that can be accessed from the internet, and a LAN that should be as secure as possible. I happen to also have total freedom on the ...
0
votes
0answers
21 views

Encrypt MySQL column with ssh-key forwarded by ssh-agent

I would like to keep sensitive data such as user's e-mail address in MySQL database in encrypted form. Is it possible to encrypt/decrypt mail column in MySQL using ssh-key forwarded by ssh-agent on ...