Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
3answers
95 views

Secure Administration AD Domain

I have a project to securize my Active Directory infrastructure. To do that, one of my colleague told me about the possibility to create another AD domain in the forrest just for administration. That ...
1
vote
2answers
95 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
1
vote
4answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
24 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
1
vote
0answers
22 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
3
votes
3answers
3k views

what's the difference b/w MMC.exe and certmgr.msc

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove ...
0
votes
0answers
11 views

Secure an external linux distro

I have a fairly complex situation, I have researched all the parts required before asking this question. I am trying to make a bootable linux distro on which I have an app that is located on an ...
0
votes
0answers
12 views

Error with security constraint in Tomcat

I have a problem setting up a login with password in a web application, but returns me a 404 error when I try to access the website. My first step was add a new role and user in tomcat-users.xml: &...
1
vote
1answer
36 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
0
votes
0answers
32 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
0answers
15 views

RSH from Linux to WIN7 and access COM port

I have a script(run on a Linux machine) , and does the following rsh to a Windoes machine (rsh XX.XX.XX.XX CMD) cd to a directory (cd YY) run a script (say ZZ.pl --someargument) it runs fine when ...
0
votes
1answer
27 views

Do “Old Passwords” have an expiration?

There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc. Do these "old passwords" have an expiration? ...
0
votes
1answer
30 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
18
votes
11answers
10k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
15
votes
2answers
11k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
4
votes
2answers
24k views

Remote Desktop Connection Denied because the user account is not authorized for remote login

I have set up Terminal Services in Windows 2003. Which is part of the domain. That server is not DC. It has only one role: Terminal Server When I'm trying to log in to it via RDP as an Domain ...
0
votes
2answers
41 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
-1
votes
1answer
29 views

FTP Port Protocol Type

I recently switched to a different VPN provider, therefore did a fresh server installation. Before I proceed, please keep in mind that I am not super experienced with server stuff. I am having a ...
2
votes
1answer
18 views

Insider threat and Office 365 - STIGs or similar results?

Office 365 is a convenient way to keep work in-synch between multiple computers and smart phones. However, for cases where one is contractually obligated to safe guard and protect a client data and ...
0
votes
1answer
38 views

Secure way of granting access to production database

We are currently using the FedEx Ship Manager in our warehouse and would like to automate the process of entering customer shipping information automatically. Inside the ship manager there is an ...
0
votes
0answers
38 views

Tornado server on port 80/443, any issues?

I would like to run an application based on the Tornado web server in a production environment. The performance requirements are low. Since I don't need a load balancer, I wonder if it is OK to have ...
0
votes
0answers
29 views

VPN revocation error?

I have managed to successfully configure a SSTP VPN connection on my internal client PC, but only through registry fixes. I keep getting this error relating to checking to see if the server has been ...
1
vote
1answer
63 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
3
votes
1answer
27 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
20
votes
3answers
36k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
2
votes
5answers
8k views

Prevent SSH from advertising its version number

The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client. If I telnet to my host on port 22 it tells me the exact version of SSH I am ...
0
votes
1answer
79 views

Windows Server 2012 - How to get the username/password of an IP that is trying to connect using RDS?

I'm new to server admin, hence my apologies if this is a very basic question. I was going through my server's event log when I noticed under 'Application and Service Logs > Microsoft > Windows > ...
32
votes
2answers
4k views

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

I'm unsure if this should be asked here or over on security.stackexchange.com... Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print ...
1
vote
0answers
43 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
0
votes
1answer
3k views

PureFTPd : How to have user isolation?

I've installed pureFTPd, with a mysql database on a debian distribution. I used the following tutorial. But now if I'm logging, I see that I'm in the /Data/www/MyUserDirectory. AND I can browse to /. ...
1
vote
1answer
53 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
1
vote
0answers
37 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
-2
votes
1answer
74 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
14
votes
7answers
10k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
2
votes
3answers
609 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
0
votes
2answers
116 views

Gateway Anti-Virus vs Desktop Anti-Virus

I need your help with a question on Gateway Anti-Virus and Desktop/Server Anti-virus. The example I have is the following: You have a network of 50 machines (Desktops/Servers) which includes a ...
2
votes
2answers
93 views

Run command after N failed local login attempts

Any good ways of running a linux command (shell script for instance) when N failed local login attempts happens? Maybe using pam_tally?
1
vote
2answers
56 views

Is Office365 Message Encryption actually secure?

I'm looking at implementing Office365 Message Encryption for our organization. My question is this: is it actually more secure than regular (unencrypted) email for messages sent to users outside the ...
0
votes
0answers
61 views

Docker / LXC and PCI-DSS Compliance

We are in payment space and we have built out a lot of our processes in Docker for development environment purposes. Now, we are thinking about converting our production environment which is in Xen (...
0
votes
1answer
2k views

How to set Windows Services permissions from Powershell?

I need to grant a specific account SERVICE_START permissions for a given Windows service. There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and ...
-4
votes
2answers
49 views

Config to allow SQL Server to be connected through CloudFlare?

I have already known the risk of exposing SQL Server database on the Internet, but please look at my situation: I have two instances of SQL Server: production (default instance SQLEXPRESS) and dev (...
1
vote
0answers
47 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
29
votes
5answers
2k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
0
votes
0answers
73 views

Authentication Configuration with IIS 8.5 on Windows Server 2012

I have a site hosted using IIS on a Windows Server 2012 R2 server. The application is configured to use an application pool that uses the NetworkService account as the application pool identity. The ...
8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: -...
4
votes
2answers
990 views

Using UUIDs for passwords

Does anyone have an opinion on using UUIDs as passwords? This is intended for accounts created for external users, such as customer access to private SFTP folders. Or are people using public key ...
0
votes
2answers
1k views

vsftpd whitelisting

How do you whitelist IPs for the service to allow only certain subnets on? Do I use IPTables or is there an easier way like IPWrappers Do you have to register the service for it to work with ...
2
votes
1answer
45 views

Can I verify the integrity of an amazon instance?

If my Amazon EC2 credentials are stolen at time D, can I verify the integrity of the root volume by: Lookup the instance in EC2 API, check the time the primary network interface was attached, and ...
1
vote
3answers
134 views

proftpd is accessing my.cnf

I use proftpd for virtual FTP hosting with MySQL. I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files. Question is what for and why? type=AVC msg=...