Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
28 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
0
votes
0answers
44 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
7
votes
2answers
236 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
-2
votes
2answers
531 views

Removing the Security Alert Outlook pops up for internal network domain clients - Remove security?

I have several Outlook clients on the internal network pointing to the internal DNS name of the Exchange 2010 SP1 R2 server. The name we're using is exchange2.example.local. Since new guidelines ...
-1
votes
1answer
26 views

web application audit task require my remote IP to be allowed on application network firewall [closed]

I want to audit a web application which is hosted on a web server sitting behind a cyberoam firewall. My task is to run a scan from my remote machine which has ISP MTNL broadband. My machine gets a ...
0
votes
1answer
50 views

New User Accounts have “Too Much” privileges Windows 7 Ultimate Edition SP1 x64

I am running Windows 7 Ultimate Edition SP1 x64 (Build 7601) in WORKGROUP mode (Non-NT_Domain, Non ADDS environment). I am the Administrator of these machines and Network. My setup is only a few ...
3
votes
1answer
26 views

Please clarify for me how tcpwrappers works

We've recently gone through a security audit and among several valid and other, quite pointless findings is one that states that tcpwrappers is not disabled. I've never used tcpwrappers so I don't ...
2
votes
2answers
526 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
2answers
2k views

How do I block IP addresses in SuSEFirewall?

Does SuSEfirewall in OpenSuSE 11 provide an easy way to block all traffic from a list of IP addresses? Ideally just a textfile into which I can put all IP addresses I want blocked, otherwise some ...
2
votes
2answers
73 views

Windows Server Administration - which services are safe to run internet facing?

Coming from a Linux background and now having to manage some Windows servers (2008R2 & 2012R2) I'm wondering which services are safe to run directly over the internet. The servers are all internet ...
0
votes
1answer
54 views

Recomendations for this mail server setup?

EMAIL SERVER SETUP Hey, its my first time using serverfault but I hope the community can help. I am trying to build a secure email system using Linux, Postfix, Dovecot and MySQL. I have read on ...
29
votes
4answers
7k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
2
votes
2answers
128 views

MySQL allows entry without Password [duplicate]

I have configured my MySQL Database to require passwords on all users, even root from the machine itself. Now I discovered that there are empty Users in my Database Reproduce: mysql -u root -p and ...
0
votes
1answer
52 views

How do I open specific ports on Linux (an AWS instance of RHEL v. 7)?

I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
8
votes
4answers
332 views

Paranoid Sysadmin -vs- Out-of-Date PHP version

How can a paranoid sysadmin confidently stay up-to-date with the latest stable PHP versions? (security fixes have been coming in pretty regularly). This is a Production server, and so "breaking ...
1
vote
2answers
4k views

How to fix “TCP/IP Sequence Prediction Blind Reset Spoofing DoS”

Just finished a Nessus scan and the only thing that came back was "TCP/IP Sequence Prediction Blind Reset Spoofing DoS" - It may be possible to send spoofed RST packets to the remote system. ...
0
votes
0answers
21 views

Tracking user activity in openvz container?

I have been trying to figure out a way to track user activity in an openvz container for a long time now (auditd like in KVM's). This is a PCI-DSS requirement. I can't seem to find any good ...
5
votes
3answers
205 views

Fixing the IIS tilde vulnerability

One of our IIS servers (IIS 7.5, Server 2008 R2) is apparently "vulnerable" to the tilde Short Filename disclosure issue. However, I'm having a hard time actually fixing the issue. So far, I've ...
-1
votes
1answer
1k views

How to block incoming login attempts to postfix, pop3, imap? [closed]

We are running CentOS 6.5 and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or fail2ban, but ...
0
votes
2answers
43 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
-1
votes
1answer
19 views

Run two mysql process on one data directory

I would like to launch two mysql process on one data directory (/var/lib/mysql) I have two servers, web-01 and web-02 but web-01 locked mysql data directory, and i would like to break this security. ...
0
votes
1answer
15 views

WRT160NL Linksys Cisco Wifi router

There is a WRT160NL Cisco Wifi router, and has to decrease the wifi range, so it cannot go outside of the office. I tried to find this settings on the admin page, but I have not found yet. Does ...
2
votes
1answer
350 views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
36
votes
6answers
22k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
-1
votes
1answer
24 views

What are the MOST Important Things to Configure on a WAF? Specifically Barracuda Web Application Firewall

I will be hosting a web application on a cloud provider. This will be protected behind a WAF specifically Barracuda's Web Application Firewall Vx. I do not have too much experience with WAF ...
4
votes
1answer
2k views

Does www-data user need a real shell?

Interestingly enough, on my Ubuntu derivative with nginx installed with apt, the www-data user has a shell: $ cat /etc/passwd www-data:x:33:33:www-data:/var/www:/bin/sh Shouldn't this be set to ...
0
votes
2answers
40 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
0
votes
0answers
36 views

how do I set restrict anonymous to 2

I want to change the registry setting for restrictanonymous to "2" (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous). I created a script to do this but noticed the setting kept on going ...
-1
votes
1answer
116 views

Misuse of the statistics script of Plesk? [closed]

I downloaded the log file from the web server, and found many strange entries. Why is a statistics script called so terribly often? What do all the junk referrers do there? Looks like some ...
-1
votes
2answers
475 views

Techniques for securing mod_php for shared hosting (WAMP)? [duplicate]

I've setup a web server for production use. The OS is Windows Server, and it runs Apache 2.0 and PHP 5.3 as an apache module (and MySQL too...). It is used to host several virtual hosts (Apache ...
0
votes
1answer
45 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
0
votes
0answers
51 views

Disable Keyboard on Ubuntu Kiosk Touch PC

I'm in the middle of deploying a series of Kiosk PC's with a minimal Ubuntu server and a web enabled Application(Rails) on it. The hardware are Shuttle All-in-one PC's at the moment. The PC starts ...
1
vote
2answers
68 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...
0
votes
1answer
160 views

Security Risks of catch-all email address [closed]

What additional security issues does an MTA and email client face if a catch-all email address is setup on an sub-domain (that isn't published/publicly listed anywhere) compared with setting up ...
8
votes
3answers
579 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
0
votes
4answers
469 views

Permissions set to 555. How can another user modify the files? [duplicate]

I run an Ubuntu 12.04 x64 VPS with Vesta, and a site in PHP. It has been hacked several times with injected code that looks like this: <?php ...
0
votes
0answers
27 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
2answers
92 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
10
votes
6answers
3k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
2
votes
0answers
122 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
3
votes
0answers
701 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
0
votes
1answer
121 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
-5
votes
2answers
85 views

Should I touch nothing when I run production service server? [closed]

I am going to run my first public game service server later. And many people advise not to touch anything if it's running well. I agree with them. But one thing I am curious is, the security updates. ...
1
vote
1answer
139 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
-4
votes
4answers
81 views

Blocking another Win 2008 R2 admin from accesing some important folders [closed]

I have sold half my dedicated server to somebody but I dont want them accessing my web hosted Plesk files for my Wordpress website. As some of them are custom and confidential. I gave them local ...
1
vote
1answer
67 views

.htaccess query string blocking phpmyadmin [closed]

After phpmyadmin login, I get this error message Error in Processing Request Error: 403 Error text: Forbidden" I found that removing the following lines from .htaccess it doesn't give any error ...
1
vote
1answer
744 views

net.inet.tcp.blackhole option on Fedora

This link of freebsdblog.org suggests a configuration option for FreeBSD that tells the system to drop all packages arriving from the network to a closed port and thus somewhat securing your system ...
0
votes
1answer
250 views

Getting lots of traffic from russia to an unpublished site

I am currently building a website. Currently nobody knows about it but it is already reachable for testing purposes. Now I saw, that I get a lot of traffic from russia (Its a german website hosted on ...