Security is not a product, but a process.

learn more… | top users | synonyms (1)

14
votes
7answers
5k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
9
votes
13answers
11k views

Relatively easy way to block all traffic from a specific country?

I know this sounds terrible, but I have a web app that has no users in the Philippines, but is constantly bombarded by spammers, carders testing cards, and other BS from there. I can see in the logs ...
8
votes
4answers
725 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
2
votes
4answers
5k views

How to find out what files an installer (rpm, deb) created?

I need to find out all the file system modifications an installer did. Most likely the installed package is an rpm or deb, but an app could of course be simply copied over or compiled and installed ...
2
votes
3answers
381 views

Securing and Monitoring a Virtual Private Server

After nearly a decade (yikes) of hosting my personal websites and applications with a decent shared web hosting provider (the one in pittsburgh) I've decided its time to venture out on my own and try ...
6
votes
3answers
1k views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
6
votes
2answers
6k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
6
votes
2answers
2k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
9
votes
1answer
755 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
7
votes
8answers
5k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
5
votes
9answers
739 views

Remote Desktop Security

I currently run Remote Desktop on my home computer (Vista Ultimate). It is always on so I can access things from my home computer when I am not there. I have a linksys firewall and use port forwarding ...
4
votes
2answers
4k views

MySQL log shows 3 root users, 2 without passwords? Why?

Our MySQL log displayed a warning on restart about 2 root users not having passwords. I went into MySQL and checked all users: mysql> select * from mysql.user; and see: Host | User ...
3
votes
1answer
4k views

Cookie Authentication in Apache

I'm trying to set up a reverse proxy in Apache. The user will be required to log in, and will then be sent a cookie. I want Apache to check the cookie. Is there a way to do this? EG, right now my ...
20
votes
3answers
32k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
9
votes
4answers
51k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
8
votes
6answers
511 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
7
votes
3answers
4k views

Directory that a user can read, but root can't?

There's a directory underneath my homedir called ".gvfs". As my regular user account, I can read it just fine: ~ $ ls -lart ~raldi/.gvfs total 4 dr-x------ 2 raldi raldi 0 2009-05-25 22:17 . ...
5
votes
8answers
750 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
4
votes
2answers
18k views

View Remote Desktop access logs on Win 2003

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying ...
4
votes
1answer
5k views

Prevent service accounts from logging in locally or remotely

We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using ...
3
votes
3answers
1k views

Open Source XML Firewalls? [closed]

Does anyone know of any open source XML firewalls that provide equivalent functionality to DataPower, Vordel, etc?
2
votes
1answer
982 views

How should I structure my users/groups/permissions for a web server?

How should I setup permissions in the most secure way on my dedicated server which I'm running FTP + Nginx on? I want FTP to be able to read/write files and I want Nginx to be able to read/write the ...
1
vote
2answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
6
votes
5answers
3k views

Protect files on NTFS volume from Domain Administrators

We're a small company with a 2008R2 domain on which we have a file server with several shared volumes. We have a number of IT staff in the domain administrators role, because effectively we're all on ...
5
votes
1answer
135 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
4
votes
1answer
1k views

IIS 7.5 and above - enable schannel cipher DHE_RSA_AES_128_GCM following patch KB2992611 - Is this safe?

I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS); TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ...
4
votes
10answers
6k views

How do you prevent users from using USB drives which circumvent security

We need a way to prevent users from copying anything to and from USB drives unless they are a system administrator. What can be done to remove this access for security purposes.
3
votes
1answer
135 views

Limited SSH access for log retrieval

I want to have limited access to a Linux server to be able to grab a certain set of logs. Ideally, I would like to be able to run rsync locally to grab the logs from the server and for security ...
3
votes
1answer
3k views

Setting the secure flag on cookies from Outlook Web Access

I'm running Exchange 2007 SP3 which is exposing outlook web access over only HTTPS. However the server delivers the sessionid cookie without the secure flag set. Even though I don't have port 80 open, ...
3
votes
1answer
459 views

Suspicious activity in access logs - someone trying to find phpmyadmin dir - should I worry?

I was looking over the access logs for a server that we are running on Amazon Web Services. I noticed that someone was obviously trying to find the phpmyadmin directory - they (or a bot) were trying ...
3
votes
1answer
3k views

allowing index access only with .htaccess

I have this in my .htaccess file, in the site root: Options -Indexes <directory ../.*> Deny from all </directory> <Files .htaccess> order allow,deny deny from all </Files> ...
2
votes
2answers
2k views

Webserver logs: “Morfeus F***ing Scanner”

I've just found these accesses in my web server log files: ::ffff:218.38.136.38 109.72.95.175 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner" ...
2
votes
3answers
3k views

IIS reveals internal IP address in content-location field

Referring: http://support.microsoft.com/kb/q218180/, there is a known issue in IIS4/5/6 whereby it will reveal the internal IP of a web server in the content-location field of the HTTP header. We ...
2
votes
3answers
451 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
2k views

Netstat: How to know if it's Human or Bot/Spider/DDOS

I'm using the following command to check how many connections I have from a single ip netstat -anp |grep ':80' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n If it's DDOS attack(500+ ...
1
vote
4answers
7k views

Security permissions for remote shared folders

I have two servers running Windows Server 2003, and I want copy files from one server (A), programmatically with a windows service running under the Local System account, to a shared folder on the ...
1
vote
2answers
152 views

Linux EC2 Instance Security Consideration

I am going to host a web site in Amazon EC2 instance which would be a Linux instance. My web application will be developed using PHP, Apache and MySql. As I am new to Linux and Amazon EC2 environment, ...
1
vote
2answers
290 views

How to secure a windows 2008 server

I have a new Windows 2008 server box coming online in a co-hosted environment. It will host asp.net web applications with sql back-end. What is the best way to secure it? It will run IIS7 and SQL ...
1
vote
7answers
9k views

How to hide web server name and openssh version on linux when scanning server ports?

How to hide web server name and openssh version on linux when scanning server ports? when i nmap'ed(nmap -A -T4 192.168.40.12) ip server from the outside, the one shows: Starting Nmap 4.62 ( ...
0
votes
1answer
182 views

Locking down a box on the Internet [closed]

I'm a developer who is looking to put a new service on the Internet. I am new to administering systems and frankly I seem a little lost at where I should start with putting something on the web. My ...
10
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
7
votes
5answers
311 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
3answers
4k views

Does windows Remote Desktop have any protection against brute force attacks?

If I were to have a server (Windows Server 2008) out on the internet that is allowed Remote Desktop connections, is there anything to stop random people from trying brute-force Username/password ...
4
votes
3answers
2k views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
3
votes
2answers
4k views

OpenVPN bad source address from client

I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client ...
3
votes
3answers
5k views

Disable directory listings with 404 instead of 403

I've disabled directory listings like so... Options -Indexes When I try and access a directory like this:- www.example.com/secret/ I get a 403 Forbidden response. However, I want a 404 Not ...
3
votes
5answers
5k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this ...