Security is not a product, but a process.

learn more… | top users | synonyms (1)

9
votes
4answers
34k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
8
votes
6answers
464 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
5
votes
8answers
705 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
4
votes
2answers
14k views

View Remote Desktop access logs on Win 2003

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying ...
4
votes
1answer
4k views

Prevent service accounts from logging in locally or remotely

We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using ...
3
votes
2answers
3k views

MySQL log shows 3 root users, 2 without passwords? Why?

Our MySQL log displayed a warning on restart about 2 root users not having passwords. I went into MySQL and checked all users: mysql> select * from mysql.user; and see: Host | User ...
3
votes
3answers
1k views

Open Source XML Firewalls? [closed]

Does anyone know of any open source XML firewalls that provide equivalent functionality to DataPower, Vordel, etc?
2
votes
1answer
908 views

How should I structure my users/groups/permissions for a web server?

How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
1
vote
2answers
2k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
13
votes
3answers
19k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
13
votes
11answers
3k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
6
votes
5answers
2k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
6
votes
3answers
3k views

Directory that a user can read, but root can't?

There's a directory underneath my homedir called ".gvfs". As my regular user account, I can read it just fine: ~ $ ls -lart ~raldi/.gvfs total 4 dr-x------ 2 raldi raldi 0 2009-05-25 22:17 . ...
5
votes
1answer
115 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
4
votes
10answers
5k views

How do you prevent users from using USB drives which circumvent security

We need a way to prevent users from copying anything to and from USB drives unless they are a system administrator. What can be done to remove this access for security purposes.
3
votes
1answer
2k views

Setting the secure flag on cookies from Outlook Web Access

I'm running Exchange 2007 SP3 which is exposing outlook web access over only HTTPS. However the server delivers the sessionid cookie without the secure flag set. Even though I don't have port 80 open, ...
3
votes
1answer
2k views

allowing index access only with .htaccess

I have this in my .htaccess file, in the site root: Options -Indexes <directory ../.*> Deny from all </directory> <Files .htaccess> order allow,deny deny from all </Files> ...
2
votes
3answers
440 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
2k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
1
vote
4answers
6k views

Security permissions for remote shared folders

I have two servers running Windows Server 2003, and I want copy files from one server (A), programmatically with a windows service running under the Local System account, to a shared folder on the ...
1
vote
2answers
151 views

Linux EC2 Instance Security Consideration

I am going to host a web site in Amazon EC2 instance which would be a Linux instance. My web application will be developed using PHP, Apache and MySql. As I am new to Linux and Amazon EC2 environment, ...
1
vote
3answers
3k views

IIS reveals internal IP address in content-location field

Referring: http://support.microsoft.com/kb/q218180/, there is a known issue in IIS4/5/6 whereby it will reveal the internal IP of a web server in the content-location field of the HTTP header. We ...
1
vote
2answers
273 views

How to secure a windows 2008 server

I have a new Windows 2008 server box coming online in a co-hosted environment. It will host asp.net web applications with sql back-end. What is the best way to secure it? It will run IIS7 and SQL ...
1
vote
7answers
7k views

How to hide web server name and openssh version on linux when scanning server ports?

How to hide web server name and openssh version on linux when scanning server ports? when i nmap'ed(nmap -A -T4 192.168.40.12) ip server from the outside, the one shows: Starting Nmap 4.62 ( ...
0
votes
4answers
825 views

Is there a static, server-side vulnerability/virus/malware/BadThings™ scanner?

We run a shared hosting webserver with the usual LAMP stack. It is up and running since many years ago (uhm, Apache-1.3 and PHP-3 days?) and went through many iterations. We strive to have good ...
0
votes
1answer
182 views

Locking down a box on the Internet [closed]

I'm a developer who is looking to put a new service on the Internet. I am new to administering systems and frankly I seem a little lost at where I should start with putting something on the web. My ...
8
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
6
votes
3answers
4k views

Does windows Remote Desktop have any protection against brute force attacks?

If I were to have a server (Windows Server 2008) out on the internet that is allowed Remote Desktop connections, is there anything to stop random people from trying brute-force Username/password ...
4
votes
2answers
823 views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
3
votes
2answers
3k views

OpenVPN bad source address from client

I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client ...
3
votes
3answers
4k views

Disable directory listings with 404 instead of 403

I've disabled directory listings like so... Options -Indexes When I try and access a directory like this:- www.example.com/secret/ I get a 403 Forbidden response. However, I want a 404 Not ...
3
votes
5answers
3k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this ...
2
votes
3answers
4k views

Do I have to have an ssl certificate for my mail server?

Question is really simple. If I want to setup a mail server, do i have to have it or is it just a security issue? What kind of problems can it cause?
2
votes
3answers
353 views

Procedures for confirming a suspected hack? (Linux)

I'm trying to compile a procedure for when ever there is a suspicion, perhaps from netflow data or something like that, that a server could be compromised. The logic being, that you should think about ...
2
votes
3answers
659 views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
2
votes
2answers
1k views

Webserver logs: “Morfeus F***ing Scanner”

I've just found these accesses in my web server log files: ::ffff:218.38.136.38 109.72.95.175 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner" ...
2
votes
2answers
130 views

What do I have to configure on my server to increase security from default?

I am setting up a Windows 2003 machine to host a website, are there any settings that I should pay special attention to in regards to security? In other words, is there dangerous default setting I ...
1
vote
2answers
161 views

Apache security

I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep ...
1
vote
2answers
486 views

Distributing SQL Server on Internet regarding security issue

We are going to put our servers in two places to keep high level redundancy and to avoid bandwidth critics. The two servers are on different LANs but communicate over a WAN network (via Internet). One ...
1
vote
2answers
2k views

How does IPCOP, dansGuardian and Squid work?

I would like to learn more about how the following works firewalling with IPCOP, web content filtering by Dans Guardian web caching with the Squid. I have visited their web sites but I am having ...
1
vote
2answers
3k views

MySQL LOAD DATA INFILE user privilege settings

I understand that users must have FILE privilege on *.* in order to use the LOAD DATA INFILE command without using LOCAL—which sends the file data through the client—but when GRANTing FILE ...
1
vote
2answers
2k views

How can I prevent users from seeing my PHP source code?

I tried to access my website recently and I saw something disturbing -- users could download the index.php file and see its contents, the PHP code! How is this possible, for Apache to serve up PHP ...
0
votes
1answer
392 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
309 views

New system administrator - Any security suggestions? [closed]

We hired a new system administrator and this will be the first time delegating this sensitive task to a third person. He's a good guy but we are still wondering about security. What do you recommend ...
0
votes
0answers
676 views

changing ssh port. Useful?

i will buy a dedicated server soon. I would like to know if changing the default port of ssh may be useful for security or it's completly useless. And if it's useful which ports range should I change ...
0
votes
3answers
128 views

Any ideas about securing a Windows 2003 enterprise X64 gameserver?

I have a MUonline (link) gameserver running on Windows 2003 enterprise X64. I had a website running there too. I do not know much about security here so I'm asking for some tips or tutorials you know ...
0
votes
2answers
8k views

How to open port 1433 on windows 2003

How can I enable port 1433 on windows server 2003 to enable SQL connections? I don't have any hardware firewall just plain windows 2003 with sp2
-5
votes
2answers
665 views

Email Administrator on failed login

Is there a way to have the server email me when there is a failed login? I have hundreds of hacking attempts and I'd like to know as soon as it happens. Thanks! <--- Woot! I'm making progress!!!! ...
-5
votes
2answers
415 views

Portscan attacks from somewhere

I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole. My snort logs (yes I'm using snort! I see you are ...