Security is not a product, but a process.

learn more… | top users | synonyms (1)

20
votes
3answers
34k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
20
votes
3answers
52k views

Network Service account accessing a folder share

I have a simple scenario. There's an application on ServerA that runs under the built-in Network Service account. It needs to read and write files on a folder share on ServerB. What permissions do ...
20
votes
3answers
31k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
20
votes
6answers
28k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
20
votes
2answers
1k views

Best Practices for updating a previously unmaintained server RHEL5.7

A new RedHat EL5.6 server has been recently put under my care. It is immediately obvious that, for the previous 12 months, little to no attention has been given to any sort of package updates. ...
19
votes
4answers
4k views

Ordinary users are able to read /etc/passwd, is this a security hole?

ls -l /etc/passwd gives $ ls -l /etc/passwd -rw-r--r-- 1 root root 1862 2011-06-15 21:59 /etc/passwd So an ordinary user can read the file. Is this a security hole?
19
votes
12answers
2k views

What language for starting on Linux? [closed]

I am about to begin a 4-year information security degree at Purdue. The degree does not call for any programming courses. So the only time I will be able to take one is the occasional elective. So ...
19
votes
6answers
5k views

Why would a university block incoming UDP traffic with destination port 53?

From my understanding DNS uses UDP and port 53. What undesirable things could happen if incoming UDP packets to port number 53 weren't blocked? UPDATE: Packets originate or are destined to the ...
19
votes
6answers
3k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
19
votes
10answers
23k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
19
votes
6answers
4k views

Is it okay to use a SSH key with an empty passphrase?

When I first learned how to make ssh keys, the tutorials I read all stated that a good passphrase should be chosen. But recently, when setting up a daemon process that needs to ssh to another machine, ...
19
votes
9answers
12k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
19
votes
5answers
35k views

How to check that an OpenVPN server is listening on a remote port without using OpenVPN client?

I need to check that an OpenVPN (UDP) server is up and accessible on a given host:port. I only have a plain Windows XP computer with no OpenVPN client (and no chance to install it) and no keys needed ...
19
votes
3answers
590 views

Suspicious .htaccess File

This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks! RewriteEngine On ...
19
votes
7answers
18k views

Monitor an incoming SSH session in real time

Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you ...
19
votes
3answers
3k views

Securely wipe an entire Linux server with itself

I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running. OS is SL6. ...
18
votes
13answers
2k views

Reasons to not allow people into the server room

I have worked at a few hosting companies and seen two schools of thought on this Do not allow customers into the server room. The argument is basically it raises security (this news story is ...
18
votes
14answers
10k views

How can I destroy data on a failed hard disk without voiding warranty?

Suppose I have a hard disk with data I don't want to expose to a third party. The warranty period for that disk still lasts. Now the disk starts malfunctioning. I can't use a disk wiping program on a ...
18
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
18
votes
13answers
2k views

Physical server security

A lot of time and columns are spent discussing securing a server from outside attacks. This is perfectly valid because it's easier for an attacker to use the Internet to break your server than it is ...
18
votes
3answers
68k views

What are the IUSR and IWAM accounts for in IIS?

I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment: Why are they there? What's the difference between them? Do the names ...
18
votes
3answers
46k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
18
votes
11answers
10k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
18
votes
8answers
7k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
18
votes
2answers
3k views

nologin in /etc/shells is dangerous.. WHY?

I found this on the internet, while putting up a FTP server in FreeBSD. Putting nologin into /etc/shells potentially creates a back door by which those accounts can be used with FTP. (see: ...
18
votes
10answers
721 views

Should core system servers be able to connect to the internet for maintenance/support?

A couple of our servers have Oracle maintenance licenses. Our hardware vendor asked there was internet connection in the server room. Our policy is that all machines in that room is isolated from the ...
18
votes
5answers
13k views

How can I chroot ssh connections?

I would like to setup a chroot jail for most (not all) users logging in though SSH. I've heard it's possible with the latest versions of openssh, but I've not been able to find out how to do it. The ...
17
votes
10answers
1k views

Is there a reason to upgrade Internet Explorer on Windows Server?

I never use Internet Explorer on my Windows Servers. Is there any reason I should upgrade Internet Explorer (version 6 or 7 to 7 or 8)?
17
votes
6answers
21k views

Cygwin SSHd Autoblock Failed Logins

I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
17
votes
5answers
2k views

What are the “to-do” on protecting Windows server facing the web?

I currently begin to deploy Windows servers facing the web. And I would like to know what are you way of protecting your servers ? What softwares are you using ? On Linux, i'm using Fail2ban to ...
17
votes
3answers
13k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
17
votes
6answers
85k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
17
votes
9answers
2k views

Steps to take when technical staff leave

How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
17
votes
7answers
4k views

Easiest way to send encrypted email?

To comply with Massachusetts's new personal information protection law, my company needs to (among other things) ensure that anytime personal information is sent via email, it's encrypted. What is the ...
17
votes
3answers
46k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
17
votes
6answers
6k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
17
votes
2answers
36k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
17
votes
6answers
13k views

What are some secure alternatives to FTP? [closed]

This Hacker News story is all about the downsides of FTP. The only reason I might set up FTP is that it's easy. I know about and use scp already, but sometimes I want to share files with someone ...
17
votes
6answers
2k views

Is OpenID this easy to hack or am I missing something?

For those Relying Parties (RP) that allow the user to specify the OpenID Provider (OP), it seems to me than anyone that knows or guesses your OpenID could Enter their own OP address. Have it ...
16
votes
19answers
4k views

How should I securely wipe data from a hard drive?

How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
16
votes
10answers
140k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
16
votes
7answers
24k views

What security risks are there with employees using Dropbox?

Are there any particular security concerns to keep in mind with company-wide use of Dropbox file sharing / versioning / backing up, and are there specific options or settings that would be recommended ...
16
votes
3answers
10k views

How to disable swap files in ESXi?

We are running a few Solaris / Linux VMs on ESXi that contain very sensitive encrypted data that eventually get decrypted as required in memory. Everything is fine, except for the ESXi swap files ...
16
votes
7answers
21k views

Automatically check for Security Updates on CentOS or Scientific Linux?

We have machines running RedHat-based distros such as CentOS or Scientific Linux. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. ...
16
votes
2answers
627 views

What is the Rowhammer DRAM bug and how should I treat it?

DRAM chips are very tightly packed. Research has shown that neighboring bits can be flipped at random. What is the probability of the bug triggering at random in a server-grade DRAM chip with ECC ...
16
votes
1answer
620 views

What's the importance of the email address in the DNS SOA lookup?

Is there a real importance in this, except to publish the email address of the person responsible for some DNS zone? In our BIND configuration, we put a mailling list as the responsible for our ...
16
votes
2answers
4k views

Automatically Applying Security Updates for AWS Elastic Beanstalk

I've been a fan of Heroku since it's earliest days. But I like the fact that AWS Elastic Beanstalk gives you more control over the characteristics of the instances. One thing I love about Heroku is ...
16
votes
2answers
3k views

Auto-booting and Securing a Linux Server with an Encrypted Filesystem

I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data. ...
16
votes
2answers
16k views

User per virtual host in Nginx

Is it possible in nginx configure different user per virtual host? Something like server { user myprojectuser myprojectgroup; ... }
15
votes
11answers
990 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...