Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
7answers
367 views

Host's sysadmins - can they view files?

Just a quick question. When using shared hosting, can system admins (employed by the host) access your files and read your database connectionstring details? Can they also access your database, and ...
3
votes
4answers
702 views

Windows XP: Modifying permissions - remove ability to run installers?

In this question, I outlined the situation at my workplace regarding some of the office workers' children and the computers that we've provided for them to use. Long story short, it turned out that ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server? [closed]

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
3
votes
4answers
1k views

Am I at risk by leaving a test FTP account available on the server?

I have two Filezilla server instances on different WAN connections, both mapping to the same /test directory on the file server. To validate that clients have connectivity I have a read/list only ...
0
votes
1answer
55 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
0
votes
2answers
3k views

How to chroot VirtualHosts on a Apache server?

I have a FreeBSD server (company's OS of choice). Currently we run several websites on each of the webservers. Websites are in PHP which is run in Apache Module mode. At the Apache is not chrooted so ...
0
votes
1answer
12 views

VBulletin 3.6, disable “Invalid SQL” errors

VBulletin likes to dump SQL query and database metadata in case of query-error. I do not find it entertaining from security point of view. Is there a way to disable this and just show "something went ...
0
votes
1answer
11 views

vSphere-created node complaining about ECDSA fingerprint?

I just cloned an Ubuntu template in vSphere Client, just like I've done hundreds of times before. It didn't give me any errors, however when I went to SSH into this server to test it, I get the ...
1
vote
1answer
26 views

How often does an SSAE 16 audit have to be performed in order to be good enough for HIPPA compliance

I need to find a dedicated hosting service that has (among other things) passed SSAE 16 audit. I found one that had the audit performed between 1/1/2013 and 6/1/2013. Should that be considered current ...
4
votes
4answers
2k views

Wildcard SSL behaves inconsistently across browsers / OS's / computers

I've got a wildcard SSL certificate installed on a domain hosted with Media Temples Dedicated Virtual 4.0. Here's a simple example page that I'm trying to serve over SSL: ...
2
votes
2answers
117 views

Forwarding access to a subset of ssh-agent identitites

I work for two companies (let's call them RedCorp and BlueCorp). They both trust me but they don't trust each other, and I don't want to expose either's secrets to the other. My laptop's ssh-agent ...
1
vote
1answer
25 views

Does it make sense to remove NFS from a simple web server?

Does it make sense security- and performance-wise to remove NFS on a simple server which has ~10 Wordpress websites? Or is simply stopping the services enough?
1
vote
1answer
42 views

ACS - Where to find Audit Logs

I think i got the Audit Collection service working. Where do I see the Audit Logs from my Managed Agents? I looked in my Operations Manger Console: Monitoring - Microsoft Audit Collection Services - ...
1
vote
1answer
174 views

Encrypting SMB traffic with Samba

We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting: server signing = ...
3
votes
2answers
190 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
4
votes
3answers
3k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
0
votes
1answer
63 views

Strange TCP Flood / Flood from Port 445

Good Evening. Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump: 23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length ...
0
votes
0answers
42 views

Docker non-root secure?

If I set up a Docker container on an Ubuntu server, and then let it run arbitrary/untrusted code like uploaded PHP, Python etc. as a NON-ROOT user. Is this totally contained and secure by ...
1
vote
3answers
1k views

What “Syn Proxy Servers” are recommended? Or how to build one?

My questions are: 1.) What is a recommended "SYN PROXY SERVER" to filter bogus SYN Attacks and only forward "handshaked" valid connections to the host behind it (to be protected). I search the term, ...
0
votes
1answer
144 views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
0
votes
1answer
14 views

Viewing older entries for lastb on linux

I have a server (Amazon Linux) that has been up for 261 days: [server]$ uptime 16:29:46 up 261 days, 4:47, 1 user, load average: 0.05, 0.16, 0.18 I am trying to find out if there have been any ...
0
votes
0answers
14 views

SQL 2012 IPSec or SSL

I have a requirement to secure connections to SQL server. (at transit that is) - TDE will be used for encryption at rest. SQL provides two options which are either certificate based SSL or Windows ...
2
votes
1answer
50 views

Is default Apache version in Ubuntu 14.04 secure?

I have installed apache on ubuntu server 14.04 using apt-get. I set up a simple site, uploaded a few pictures etc, the website is working. I've decided to take a look at security of the thing using ...
7
votes
7answers
4k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
1
vote
4answers
289 views

Nmap: what is the difference between “nmap <target>” and “nmap -sS <target>”?

This is an extremely basic question but also one I can't really seem to find an answer for, despite looking through the nmap documentation (man, online, and google). My question is, what is the ...
4
votes
2answers
86 views

Multiple websites on multiple servers - seperate mysql or not

I currently have 2 Debian servers (VPS with 4 GB memory) and am hosting a variety of websites of differing importance: some are production sites, while others are demo/staging/test sites. ...
2
votes
2answers
225 views

Networking and network security book [closed]

i am in the early stages of producing a thesis 'Network security: Cost Vs Security', are there any books that can give me an insight to real world setups and costing of such systems, as I am purely ...
2
votes
1answer
171 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book? [closed]

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
13
votes
5answers
1k views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
4
votes
1answer
178 views

Sendmail - Is it secure, and really essential?

I have a web application server running Ubuntu. The Application is built in Python/Django, but does not have any specific use cases to send email. We have log management software that allows us to ...
4
votes
2answers
768 views

Which CentOS Version Should I Use?

I have some used rackmount servers (Dell R610, HP DL180 G6, HP DL360 G5) that I intend to use for on demand video streaming in a colocation environment. I would like to have them all on the same OS to ...
0
votes
2answers
39 views

is there a way from iptables/iproute to forward all traffic to my IDS and also keep the regular flow

The reason of this, is that to catch all packages into my IDS keeping my existing enviroment, so the IDS does not become a single point of failure. If route all my traffic into my IDS and from my IDS ...
1
vote
1answer
54 views

security group rules between EC2-classic and VPC server

We are currently using a set of Amazon EC2-classic servers for hosting our live and staging environments. We've got a couple of web servers and a background worker server in each environment. We've ...
3
votes
2answers
37 views

Docker remote access security

Assuming I am running several docker containers on a local server. When I give third parties ssh access to my server, any third party will have control over the docker manager. How can I make sure ...
2
votes
3answers
956 views

How to run a program marked as requiring elevation via UAC without actual elevation on Windows 7?

I have a program, specifically an installer, which is marked is requiring elevation with highestAvailable approach. I am using an administrator account with UAC at the highest level. Is it possible ...
0
votes
0answers
30 views

Information regarding netstat output

On netstat, I see my port 22 in connection with 122.225.97.99. Does this mean someone is accessing ssh .. OR is it just something related to ubuntu user@ubuntu:~$ netstat -ntu Active Internet ...
0
votes
1answer
43 views

Secure Database Password Contained Inside a File

I've got a Linux based application (Java) that connects to an external database (PostgreSQL) in the same LAN. However, due the sensitiveness of the database contents I would like to avoid the admins ...
-1
votes
1answer
42 views

How to load sites from your own server as localhost (ssh tunnel trickery)

I want to load a site from my server as if I'm on the server as localhost. Because some areas are restricted to localhost on a purpose. Now normal ssh tunnel like ssh -L 8080:localhost:80 ...
8
votes
2answers
20k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
1
vote
1answer
55 views

Validating SSL/TLS renegotiation flaw

Our vulnerability scanner (Saint-based) is claiming that a large number of devices and servers are susceptible to the SSL/TLS renegotiation flaw (CVE-2009-3555). Most of these servers and devices are ...
2
votes
0answers
30 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
-2
votes
1answer
97 views

VirtualBox Networking Lab Configuration [closed]

I'm creating a lab for a project that will test a network security defense product's effectiveness in detecting various attacks. I have a physical server with 32GB of RAM and VirtualBox to create the ...
0
votes
0answers
19 views

My Hosting Infected with CryptoPHP Script Hostgator [duplicate]

Before 10days Hostgator migrated server to Indian Servers , and they said it is highly secure, As for more than 10 days i am getting problems in My backend word press plugins, So last 10 days i was ...
3
votes
2answers
6k views

How do I prevent the Windows 2008 logon screen from showing user account names?

When I logon to Windows 2008 via the console or via RDP it shows me the names of user accounts already created as clickable buttons. How do I prevent this and make Windows 2008 ask me for a username ...
7
votes
2answers
141 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
23
votes
9answers
7k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
2
votes
0answers
59 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
0
votes
0answers
123 views

Can't get working Nginx secure link with rtmp

I'm trying to get Nginx secure link works with rtmp but I don't know what I'm doing wrong. Any help is appreciated. My Nginx conf: location /on_play { # set connection secure link ...
13
votes
3answers
1k views

Enable SSH shell access but disable SFTP access

I've searched for a viable answer to this question, and most of the answers include advice on why to not do it. However, here's the scenario, and what makes it necessary: I have a console app, and in ...
0
votes
3answers
62 views

aws ec2 security group and centos ip tables

I try to change the SSH port from 22 to another port (218). In AWS EC2, I shall add the rules in security group or in IP Tables? Is there any guideline/references recommended for EC2 Security ...