Security is not a product, but a process.
1
vote
2answers
965 views
MySQL LOAD DATA INFILE user privilege settings
I understand that users must have FILE privilege on *.* in order to use the LOAD DATA INFILE command without using LOCAL—which sends the file data through the client—but when GRANTing FILE ...
1
vote
3answers
1k views
IIS reveals internal IP address in content-location field
Referring: http://support.microsoft.com/kb/q218180/, there is a known issue in IIS4/5/6 whereby it will reveal the internal IP of a web server in the content-location field of the HTTP header.
We ...
1
vote
2answers
995 views
How can I prevent users from seeing my PHP source code?
I tried to access my website recently and I saw something disturbing -- users could download the index.php file and see its contents, the PHP code!
How is this possible, for Apache to serve up PHP ...
1
vote
2answers
115 views
What do I have to configure on my server to increase security from default?
I am setting up a Windows 2003 machine to host a website, are there any settings that I should pay special attention to in regards to security?
In other words, is there dangerous default setting I ...
0
votes
1answer
254 views
find common string to block IPs
Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables?
Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
261 views
New system administrator - Any security suggestions?
We hired a new system administrator and this will be the first time delegating this sensitive task to a third person. He's a good guy but we are still wondering about security.
What do you recommend ...
0
votes
0answers
596 views
changing ssh port. Useful?
i will buy a dedicated server soon. I would like to know if changing the default port of ssh may be useful for security or it's completly useless.
And if it's useful which ports range should I change ...
0
votes
3answers
111 views
Any ideas about securing a Windows 2003 enterprise X64 gameserver?
I have a MUonline (link) gameserver running on Windows 2003 enterprise X64. I had a website running there too. I do not know much about security here so I'm asking for some tips or tutorials you know ...
0
votes
2answers
6k views
How to open port 1433 on windows 2003
How can I enable port 1433 on windows server 2003 to enable SQL connections?
I don't have any hardware firewall just plain windows 2003 with sp2
-4
votes
2answers
216 views
Portscan attacks from somewhere
I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole.
My snort logs (yes I'm using snort! I see you are ...
-5
votes
2answers
326 views
Email Administrator on failed login
Is there a way to have the server email me when there is a failed login? I have hundreds of hacking attempts and I'd like to know as soon as it happens.
Thanks!
<--- Woot! I'm making progress!!!!
...
33
votes
9answers
5k views
Why is SSH password authentication a security risk?
Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
71
votes
16answers
7k views
How do I protect my company from my IT guy? [closed]
I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT.
Of course, I'll interview carefully, check references, and run a ...
47
votes
8answers
45k views
Dealing with HTTP w00tw00t attacks
I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this:
My apache version is apache v2.2.3 and I use mod_security2.c
This were the entries from the ...
15
votes
4answers
36k views
How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?
We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
14
votes
5answers
2k views
Updating production Ubuntu boxes the dos and don'ts
Every so often I login to production web/db/tools boxes and see the typical message:
30 packages can be updated.
16 updates are security updates.
My question is, how do all of you handle updates on ...
9
votes
7answers
542 views
Career shift to security - learning tracks? [closed]
I've had to learn enough to be dangerous (if only to myself), managing the firewalls, switches, etc for small networks over the past ten years. However, I know there's a pretty massive gap between ...
9
votes
12answers
688 views
When I have to administrate an existing Linux server what's the best way to check if it is secure?
There are many tutorials on how to set up a new secured server.
But what if I have to administrate a server someone else had set up some time ago and I don't know much about its configuration yet?
...
9
votes
8answers
10k views
Should I have to enable automatic update on Debian lenny stable?
I have installed a new Linux Debian lenny server that will be a LAMP and a Subversion server.
Should I have to enable automatic updates?
If I enable it, I am sure that I have the latest security ...
7
votes
5answers
8k views
What steps should I take to secure Tomcat 6.x?
I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible.
I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory ...
33
votes
12answers
8k views
What do you do about staff and personal laptops?
Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database.
This is one ...
15
votes
10answers
3k views
I just did a chmod -x chmod
So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
11
votes
3answers
20k views
Iptables: How to allow only one ip through specific port?
How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?
Thanks
27
votes
4answers
1k views
Is a Self Signed SSL Certificate a False Sense of Security?
Is a Self Signed SSL certificate a false sense of security?
If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
16
votes
5answers
5k views
What are the exact protocol level differences between SSL and TLS?
This is a technical deep dive after this overview question was asked.
What are the protocol differences between SSL and TLS?
Is there really enough of a difference to warrant a name change? (versus ...
12
votes
8answers
1k views
is this a hack attempt?
Looking through my 404 logs I noticed the following two URLs, both of which occurred once:
/library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ
and
...
12
votes
13answers
3k views
Password expiration policies [closed]
Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
9
votes
1answer
8k views
How can I restrict the java plugin to run only on certain sites in Internet Explorer?
I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question.
I find the security of Java ...
7
votes
8answers
11k views
How to prevent a LOIC (DDOS) attack?
The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
7
votes
7answers
581 views
Securing WordPress Blog Installation
Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?
23
votes
4answers
2k views
Are self-signed SSL certificates secure?
I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc.
Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443.
Is this in fact ...
19
votes
5answers
1k views
How to secure your CA's private key?
I'm about to implement my own Certification Authority (CA) for interal use only.
Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted.
...
12
votes
3answers
33k views
What are the IUSR and IWAM accounts for in IIS?
I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment:
Why are they there?
What's the difference between them?
Do the names ...
10
votes
6answers
734 views
How to choose a cloud service for backups
I am thinking of using a cloud service to backup one of my client's website.
My (clients) main concerns are (in decreasing order of importance)
Protection of IP (trade secrets, source code), user ...
8
votes
3answers
463 views
What are some best practices when taking over IT at a new company?
I thought this would make for a good topic with some interesting suggestions.
What are the first things you would do when taking over IT at a new organization?
What are some red flags you would look ...
17
votes
9answers
802 views
Steps to take when technical staff leave
How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
8
votes
4answers
593 views
Remote Root Login
I know one of the first things you do to secure a server is disallowing remote root login.
Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
4answers
2k views
Securing file system for secure SFTP server
This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
7
votes
7answers
1k views
Storing rarely used single-purpose passwords
How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as:
Administrator/root password when everyone logs on using their own ...
6
votes
3answers
689 views
SELinux in the Real World
Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it.
I personally have several ...
5
votes
1answer
440 views
Adding port forwardings programmatically on a ControlMaster SSH session
I just found out about the ControlMaster/ControlPath feature of OpenSSH, which allows you to use a single SSH connection to run multiple terminals.
As I often use SSH to use port forwarding to get ...
4
votes
3answers
2k views
How to Open help (.chm) files over unc path
When I try and open a help file (.chm) that resides on a unc path I get the following error:
"Navigation to the webpage was canceled".
If I copy the file locally I am able to open it.
I imagine there ...
2
votes
2answers
301 views
How to find an unauthorized person's entry point to a server
We're running an in house dedicated server with 100's of sites on it. Some of these sites were very insecure and the box was not managed very well. Some one got in, messed up a bunch of stuff and is ...
22
votes
5answers
4k views
Functional implications of differences in SSL and TLS
I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command).
What I don't ...
18
votes
2answers
31k views
Howt to grant network access to LocalSystem account?
How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account?
Background
When accessing the network, the LocalSystem account acts as the computer on the network:
...
16
votes
4answers
3k views
Minimum permissions for a user to perform a mysqldump?
I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...
13
votes
11answers
720 views
Is there a standard method of proving password security to non-mathematicians?
My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
11
votes
2answers
2k views
The Story of secure user-authentication in squid
once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network:
<the Internet>
...
10
votes
4answers
524 views
Common PHP setup insecurity?
I work with the systems administration at a university and just stumbled across something which is probably common, but was quite a shock to me.
All public_html directories and web areas are stored ...
8
votes
1answer
2k views
SSH passphrase remembered in MacOSX Snow Leopard
I am facing a very strange situation with Snow Leopard.
I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
