Security is not a product, but a process.

learn more… | top users | synonyms (1)

9
votes
1answer
806 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
5
votes
2answers
5k views

MySQL log shows 3 root users, 2 without passwords? Why?

Our MySQL log displayed a warning on restart about 2 root users not having passwords. I went into MySQL and checked all users: mysql> select * from mysql.user; and see: Host | User |...
3
votes
1answer
4k views

Cookie Authentication in Apache

I'm trying to set up a reverse proxy in Apache. The user will be required to log in, and will then be sent a cookie. I want Apache to check the cookie. Is there a way to do this? EG, right now my ...
8
votes
6answers
525 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
5
votes
8answers
762 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
4
votes
1answer
6k views

Prevent service accounts from logging in locally or remotely

We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using ...
4
votes
2answers
20k views

View Remote Desktop access logs on Win 2003

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying ...
2
votes
1answer
1k views

How should I structure my users/groups/permissions for a web server?

How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
8
votes
2answers
3k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
6
votes
5answers
3k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
5
votes
1answer
2k views

IIS 7.5 and above - enable schannel cipher DHE_RSA_AES_128_GCM following patch KB2992611 - Is this safe?

I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS); TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ...
4
votes
10answers
6k views

How do you prevent users from using USB drives which circumvent security

We need a way to prevent users from copying anything to and from USB drives unless they are a system administrator. What can be done to remove this access for security purposes.
3
votes
1answer
224 views

Limited SSH access for log retrieval

I want to have limited access to a Linux server to be able to grab a certain set of logs. Ideally, I would like to be able to run rsync locally to grab the logs from the server and for security ...
2
votes
3answers
455 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
2
votes
5answers
3k views

How to log commands/logins in linux?

I'm feeling that some people are using the root, how i can log all commands and connections times including ips made to the server (ssh) from all users? history command is not enough
1
vote
4answers
8k views

Security permissions for remote shared folders

I have two servers running Windows Server 2003, and I want copy files from one server (A), programmatically with a windows service running under the Local System account, to a shared folder on the ...
1
vote
2answers
293 views

How to secure a windows 2008 server

I have a new Windows 2008 server box coming online in a co-hosted environment. It will host asp.net web applications with sql back-end. What is the best way to secure it? It will run IIS7 and SQL ...
1
vote
2answers
153 views

Linux EC2 Instance Security Consideration

I am going to host a web site in Amazon EC2 instance which would be a Linux instance. My web application will be developed using PHP, Apache and MySql. As I am new to Linux and Amazon EC2 environment, ...
7
votes
5answers
312 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the brats^H^H^...
6
votes
3answers
5k views

Does windows Remote Desktop have any protection against brute force attacks?

If I were to have a server (Windows Server 2008) out on the internet that is allowed Remote Desktop connections, is there anything to stop random people from trying brute-force Username/password ...
4
votes
6answers
39k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
4
votes
5answers
6k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this http://www.puschitz....
4
votes
4answers
2k views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
3
votes
2answers
4k views

OpenVPN bad source address from client

I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client [192.168....
3
votes
3answers
9k views

Do I have to have an ssl certificate for my mail server?

Question is really simple. If I want to setup a mail server, do i have to have it or is it just a security issue? What kind of problems can it cause?
2
votes
3answers
442 views

Procedures for confirming a suspected hack? (Linux)

I'm trying to compile a procedure for when ever there is a suspicion, perhaps from netflow data or something like that, that a server could be compromised. The logic being, that you should think about ...
2
votes
6answers
14k views

Is IPSec the only way to encrypt Microsoft SMB (CIFS) traffic?

I'm looking for ways to encrypt Microsoft SMB data traffic between a client and Windows server or filer appliance. This is not about encrypting the authentication but the actual data transfer. Is ...
2
votes
2answers
133 views

What do I have to configure on my server to increase security from default?

I am setting up a Windows 2003 machine to host a website, are there any settings that I should pay special attention to in regards to security? In other words, is there dangerous default setting I ...
1
vote
2answers
2k views

How can I prevent users from seeing my PHP source code?

I tried to access my website recently and I saw something disturbing -- users could download the index.php file and see its contents, the PHP code! How is this possible, for Apache to serve up PHP ...
1
vote
1answer
2k views

How can I auto-block IPs attacking my server?

It seems that some script kiddie started attacking one of my servers by trying to fetch all sorts of URLs that may be related to Wordpress vulnerabilities. I don't even have WP installed on the server,...
1
vote
2answers
4k views

MySQL LOAD DATA INFILE user privilege settings

I understand that users must have FILE privilege on *.* in order to use the LOAD DATA INFILE command without using LOCAL—which sends the file data through the client—but when GRANTing FILE ...
1
vote
4answers
8k views

There are currently no logon servers available

I am running a Windows 7 laptop that is joined to my company's domain. When I installed Windows 7, I created an account for myself, joined to the domain, and it had been working quite well even though ...
1
vote
2answers
481 views

How to limit dynamic DNS updates

First off, I'm sorry if this is vague, but I'm not very familiar with DNS or DNS terminology. What I'm trying to do: I want to limit what hostnames are allowed to dynamically update DNS. I don't ...
1
vote
2answers
168 views

Apache security

I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep ...
1
vote
2answers
153 views

Should I sudo as root or use a public key [duplicate]

I have read a few times to disable root login and sudo as root using another user. But is using a public key as good if not better security?
0
votes
2answers
132 views

Methods to ban bots, force attacks on my server

I've been getting some bots trying to get hold of my database by mass attacking /sertup/scripts.php of various database program. I wanna ban such activities. The closest I found was this: http://www....
-5
votes
2answers
507 views

Portscan attacks from somewhere

I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole. My snort logs (yes I'm using snort! I see you are ...
29
votes
5answers
3k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
76
votes
5answers
9k views

How do I protect my company from my IT guy? [closed]

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT. Of course, I'll interview carefully, check references, and run a ...
44
votes
10answers
14k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
52
votes
3answers
21k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
35
votes
3answers
27k views

What's best practice for communication between Amazon EC2 instances?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far: Web Server -- Apache Database Server --...
20
votes
8answers
19k views

Should I have to enable automatic update on Debian lenny stable?

I have installed a new Linux Debian lenny server that will be a LAMP and a Subversion server. Should I have to enable automatic updates? If I enable it, I am sure that I have the latest security ...
69
votes
5answers
61k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
17
votes
6answers
6k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
23
votes
4answers
13k views

Why do people tell me not to use VLANs for security?

As per title, why do people tell me not to use VLANs for security purposes? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches ...
35
votes
5answers
32k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
21
votes
2answers
31k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...