Security is not a product, but a process.

learn more… | top users | synonyms (2)

16
votes
2answers
17k views

How bad is setting MySQL's bind-address to 0.0.0.0?

I'm trying to allow a remote server to access a MySQL instance that currently shares a Linux server with a web app. According to the documentation the only way this would be possible (unless I'm not ...
16
votes
1answer
563 views

What's the importance of the email address in the DNS SOA lookup?

Is there a real importance in this, except to publish the email address of the person responsible for some DNS zone? In our BIND configuration, we put a mailling list as the responsible for our ...
15
votes
3answers
366 views

My site seems to be hijacked… but only when visited from another site… how?

My website is altoonadesign.com if you type it directly in your browser it takes you to the correct site. However if you do a search for "altoona design" and click on the link to my site you get ...
15
votes
3answers
43k views

What are the IUSR and IWAM accounts for in IIS?

I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment: Why are they there? What's the difference between them? Do the names ...
15
votes
10answers
4k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
15
votes
10answers
490 views

Should core system servers be able to connect to the internet for maintenance/support?

A couple of our servers have Oracle maintenance licenses. Our hardware vendor asked there was internet connection in the server room. Our policy is that all machines in that room is isolated from the ...
15
votes
3answers
9k views

How secure is a bluetooth keyboard against password sniffing?

In a situation where an admin will enter sensitive information into a keyboard (the root password), what is the risk that a bluetooth keyboard (ship by default with Mac systems these days) would put ...
14
votes
5answers
698 views

What is meant when IT Infrastructure people refer to the “Stack”

Can someone please define what exactly is the "Stack". I know its an industry term but its very vague. I am referring to Infrastructure terminology not "Stack" in terms of memory allocation.
14
votes
5answers
38k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
14
votes
2answers
736 views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
14
votes
5answers
5k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
11answers
4k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
14
votes
8answers
13k views

Should I have to enable automatic update on Debian lenny stable?

I have installed a new Linux Debian lenny server that will be a LAMP and a Subversion server. Should I have to enable automatic updates? If I enable it, I am sure that I have the latest security ...
14
votes
2answers
568 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
14
votes
3answers
3k views

How can I set up VLANs in a way that won't put me at risk for VLAN hopping?

We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration: One significant detail is ...
14
votes
5answers
13k views

Cygwin SSHd Autoblock Failed Logins

I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
14
votes
8answers
9k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
14
votes
7answers
4k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
14
votes
7answers
4k views

Good low power server/pc for firewall? [closed]

Does anyone know of a low power server/pc that have 2 NIC's, so it can be used for a (OpenBSD) firewall? Sandra
14
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
14
votes
6answers
3k views

How difficult is it to setup a mailserver?

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data. How much of a PITA is it to setup my own mailserver? Should I go for an ...
14
votes
5answers
10k views

Does fail2ban do Windows?

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these ...
14
votes
5answers
2k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
14
votes
6answers
12k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
14
votes
3answers
597 views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
14
votes
1answer
8k views

WEP/WPA/WPA2 and wifi sniffing

I know that WEP traffic can be "sniffed" by any user of the WIFI. I know that WPA/WPA2 traffic is encrypted using a different link key for each user, so they can't sniff traffic... unless they ...
13
votes
11answers
801 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
13
votes
4answers
1k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
13
votes
14answers
17k views

Alternatives to RSA SecurID? [closed]

Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
13
votes
11answers
3k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
13
votes
3answers
576 views

Does my Oracle DBA need root access?

My Oracle DBA Colleague is requesting root access on our production servers. He is arguing that he need it to perform some operations like rebooting the server and some other tasks. I do not not ...
13
votes
5answers
992 views

Which bots and spiders should I block in robots.txt?

In order to: Increase security of my website Reduce bandwidth requirements Prevent email address harvesting
13
votes
2answers
849 views

Are subdomains public information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
13
votes
5answers
698 views

Encrypted offsite backups - where to store the encryption key?

In addition to regular onsite backups (kept in a fire resistant safe), we also send tapes offsite once a month, encrypted with AES. So if our site is one day vaporised by an alien heat ray, we should ...
13
votes
2answers
4k views

Possible to change email address in keypair?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.) I've now changed my email address. Is it possible to change the email address on ...
13
votes
3answers
626 views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
13
votes
1answer
932 views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
13
votes
2answers
2k views

Auto-booting and Securing a Linux Server with an Encrypted Filesystem

I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data. ...
13
votes
2answers
19k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server?

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
13
votes
4answers
848 views

Reliable software keylogger detection?

I may be dreaming here, But is there a reliable method for keylogger software detection? I'm primarily a developer but I run a couple servers and the thing that worries me most is a software ...
13
votes
6answers
4k views

What are some secure alternatives to FTP? [closed]

This Hacker News story is all about the downsides of FTP. The only reason I might set up FTP is that it's easy. I know about and use scp already, but sometimes I want to share files with someone ...
12
votes
13answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to ...
12
votes
14answers
1k views

Sysadmin bad habits

I think it would be interesting to have a list of bad habits you observe related to system administration. For example: Always using root on servers Sharing account passwords Inserting passwords on ...
12
votes
23answers
1k views

Is being paranoid a required 'quality' for Sys/Net administrators?

Is being Paranoid considered an (unspoken) 'requirement' for a Sys/Net admin to have (obviously for security reasons)? Is there such a thing as being overly paranoid?, or should we be trustful of ...
12
votes
3answers
934 views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
12
votes
8answers
1k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
12
votes
13answers
3k views

Password expiration policies [closed]

Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
12
votes
9answers
5k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
12
votes
3answers
26k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks