Security is not a product, but a process.

learn more… | top users | synonyms (1)

17
votes
13answers
2k views

Reasons to not allow people into the server room

I have worked at a few hosting companies and seen two schools of thought on this Do not allow customers into the server room. The argument is basically it raises security (this news story is ...
17
votes
14answers
8k views

How can I destroy data on a failed hard disk without voiding warranty?

Suppose I have a hard disk with data I don't want to expose to a third party. The warranty period for that disk still lasts. Now the disk starts malfunctioning. I can't use a disk wiping program on a ...
17
votes
10answers
1k views

Is there a reason to upgrade Internet Explorer on Windows Server?

I never use Internet Explorer on my Windows Servers. Is there any reason I should upgrade Internet Explorer (version 6 or 7 to 7 or 8)?
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
17
votes
13answers
2k views

Physical server security

A lot of time and columns are spent discussing securing a server from outside attacks. This is perfectly valid because it's easier for an attacker to use the Internet to break your server than it is ...
17
votes
10answers
15k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ...
17
votes
5answers
2k views

What are the “to-do” on protecting Windows server facing the web?

I currently begin to deploy Windows servers facing the web. And I would like to know what are you way of protecting your servers ? What softwares are you using ? On Linux, i'm using Fail2ban to ...
17
votes
3answers
55k views

What are the IUSR and IWAM accounts for in IIS?

I'm looking for a good explanation of the IUSR and IWAM accounts used by IIS to help me better configure our hosting environment: Why are they there? What's the difference between them? Do the names ...
17
votes
9answers
1k views

Steps to take when technical staff leave

How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
17
votes
8answers
5k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
17
votes
7answers
15k views

Monitor an incoming SSH session in real time

Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you ...
17
votes
10answers
602 views

Should core system servers be able to connect to the internet for maintenance/support?

A couple of our servers have Oracle maintenance licenses. Our hardware vendor asked there was internet connection in the server room. Our policy is that all machines in that room is isolated from the ...
17
votes
3answers
2k views

Securely wipe an entire Linux server with itself

I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running. OS is SL6. ...
17
votes
6answers
2k views

Is OpenID this easy to hack or am I missing something?

For those Relying Parties (RP) that allow the user to specify the OpenID Provider (OP), it seems to me than anyone that knows or guesses your OpenID could Enter their own OP address. Have it ...
16
votes
19answers
3k views

How should I securely wipe data from a hard drive?

How do you recommend destroying sensitive information on a hard drive? I've used DBAN in the past, is that good enough?
16
votes
6answers
17k views

Cygwin SSHd Autoblock Failed Logins

I'm running Cygwin with an SSH deamon on a Windows Server 2008 machine. I was looking at the Event Viewer and noticed as much as 5 to 6 failed login attempts per second (brute force) for the last week ...
16
votes
8answers
24k views

What security risks are there with employees using Dropbox?

Are there any particular security concerns to keep in mind with company-wide use of Dropbox file sharing / versioning / backing up, and are there specific options or settings that would be recommended ...
16
votes
7answers
4k views

Easiest way to send encrypted email?

To comply with Massachusetts's new personal information protection law, my company needs to (among other things) ensure that anytime personal information is sent via email, it's encrypted. What is the ...
16
votes
3answers
18k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
16
votes
1answer
590 views

What's the importance of the email address in the DNS SOA lookup?

Is there a real importance in this, except to publish the email address of the person responsible for some DNS zone? In our BIND configuration, we put a mailling list as the responsible for our ...
15
votes
5answers
1k views

What is meant when IT Infrastructure people refer to the “Stack”

Can someone please define what exactly is the "Stack". I know its an industry term but its very vague. I am referring to Infrastructure terminology not "Stack" in terms of memory allocation.
15
votes
11answers
110k views

Best way to find the computer a user last logged on from?

I am hoping that somewhere in Active Directory the "last logged on from [computer]" is written/stored, or there is a log I can parse out? The purpose of wanting to know the last PC logged on from is ...
15
votes
3answers
374 views

My site seems to be hijacked… but only when visited from another site… how?

My website is altoonadesign.com if you type it directly in your browser it takes you to the correct site. However if you do a search for "altoona design" and click on the link to my site you get ...
15
votes
1answer
16k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
15
votes
10answers
6k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
15
votes
8answers
3k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
15
votes
10answers
5k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
15
votes
6answers
18k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
15
votes
6answers
7k views

What are some secure alternatives to FTP? [closed]

This Hacker News story is all about the downsides of FTP. The only reason I might set up FTP is that it's easy. I know about and use scp already, but sometimes I want to share files with someone ...
14
votes
14answers
1k views

Sysadmin bad habits

I think it would be interesting to have a list of bad habits you observe related to system administration. For example: Always using root on servers Sharing account passwords Inserting passwords on ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
14
votes
14answers
21k views

Alternatives to RSA SecurID? [closed]

Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
14
votes
11answers
883 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
14
votes
2answers
845 views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
14
votes
5answers
6k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
11answers
5k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
14
votes
2answers
648 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
14
votes
7answers
4k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
14
votes
3answers
3k views

How can I set up VLANs in a way that won't put me at risk for VLAN hopping?

We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration: One significant detail is ...
14
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
14
votes
6answers
4k views

How difficult is it to setup a mailserver?

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data. How much of a PITA is it to setup my own mailserver? Should I go for an ...
14
votes
7answers
4k views

Good low power server/pc for firewall? [closed]

Does anyone know of a low power server/pc that have 2 NIC's, so it can be used for a (OpenBSD) firewall? Sandra
14
votes
5answers
1k views

Which bots and spiders should I block in robots.txt?

In order to: Increase security of my website Reduce bandwidth requirements Prevent email address harvesting
14
votes
5answers
4k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
14
votes
7answers
14k views

Automatically check for Security Updates on CentOS or Scientific Linux?

We have machines running RedHat-based distros such as CentOS or Scientific Linux. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. ...
14
votes
3answers
947 views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
14
votes
1answer
271 views

What is the Rowhammer DRAM bug and how should I treat it?

DRAM chips are very tightly packed. Research has shown that neighboring bits can be flipped at random. What is the probability of the bug triggering at random in a server-grade DRAM chip with ECC ...
14
votes
2answers
28k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
14
votes
2answers
3k views

Auto-booting and Securing a Linux Server with an Encrypted Filesystem

I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data. ...
14
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...