Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
23 views

Is is possible to have an Admin account manage both Exchange 2013 (on prem) and Office 365?

We are in hybrid mode and a few people are asking me to create an additional account for them so they can administer O365 and use a different account for on prem exchange. After troubleshooting on my ...
0
votes
0answers
25 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...
3
votes
5answers
84 views

Should I enable automatic security updates on a Ubuntu server? [closed]

I can't seem to find an agreed answer on this anywhere, so I figured I'd ask it myself. I have five Ubuntu servers running either 12.04 or 14.04, should I enable automatic security updates on these ...
3
votes
0answers
28 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
1
vote
1answer
124 views

How to prevent a XenU domain from being saved

Xen (like other) virtual machines allows VMs to be saved and resumed. Xen on Debian Lenny, for instance, is configured to save and resume virtual machines on Dom0 restarts. Is it possible to have ...
3
votes
3answers
2k views

Apache getting hammered by nonsense requests, how to stop?

My VPS is getting hammered with attempts on random files/directories that don't exist on my server, in the order of roughly twice every second. Presumably it's just a bot trying to figure out whether ...
1
vote
1answer
163 views

Which “try_files” nginx directive is best for the zero-day exploit?

So far I have been using the following in the php location of my nginx config files try_files $uri $uri/ /index.php?$query_string; However, I just saw in the Wordpress Codex guide that for the ...
2
votes
0answers
77 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
-1
votes
2answers
35 views

Change Mail Password, leave user system password

I have a Debian Jessie server that provides (web-)mail using postfix, dovecot and roundcube. To log-in to roundcube webmail, I have to use my system user name and password. This seems like a major ...
0
votes
1answer
163 views

CentOS vs Ubuntu Wordpress server security

I am building out a new Wordpress server for a web developer redesigning my companies website. I originally decided to go with CentOS due to stability. However it appears based on the versions of ...
0
votes
1answer
820 views

Event 4625 Audit Failure NULL SID failed network logons

In a small environment comprised of one Windows Small Business Server 2011 server of relatively limited use (domain controller / Active Directory and DNS, Group Policy, DHCP, file server, print ...
0
votes
0answers
16 views

Postfix: rewrite “From” header and Sender Envelope with SASL username [duplicate]

I set up an authenticated mail server, in which a user needs an account to send mail. The SMTP username is the sender's email. The problem is that any authenticated user can send email with any from ...
4
votes
5answers
2k views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
1answer
14 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
-1
votes
1answer
57 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
1
vote
2answers
70 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
0
votes
0answers
82 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
21
votes
4answers
5k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
1
vote
2answers
2k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
1
vote
1answer
152 views

Fail2ban not starting [WARNING 'findtime' not defined]

It was working fine until i added a new jail [apache-postflood]. If i remove it then it works, so whats wrong with the "findtime" ? . Here's the output: sudo fail2ban-client start WARNING 'findtime' ...
1
vote
1answer
45 views

is there a tool for windows 7 that can find which program is modifying a particular file [duplicate]

My system is infected by a malware that keeps modifying a particular configuration file. Is there a way/tool to find out which program is making change to a particular file? I am simply looking for a ...
4
votes
7answers
3k views

Web Application Vulnerability Scanner suggestions? [closed]

I'm looking for a new tool for the ol' admin toolkit and would value some suggestions. I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along ...
0
votes
1answer
64 views

Allowing services to specific hosts using firewalld

Introduction On my database server (CentOS 7) I want to allow access to port 3306 (MySQL) from specific web front-ends (10.10.40.6 and 10.10.40.7 in my example). On top of that I want to allow access ...
0
votes
0answers
29 views

Security implications of wide WAN subnet

I have a server at OVH and say my public IP adress is xx.xx.xx.81 and the gateway is at xx.xx.xx.254. To reach the gateway, I need pfSense to be configured static WAN IP with xx.xx.xx.81/24, i.e. the ...
3
votes
2answers
1k views

SSHD - blocking password authentication

On several systems I have this sshd_config Port 22 Protocol 2 PermitRootLogin no StrictModes yes PasswordAuthentication no ChallengeResponseAuthentication no MaxStartups 2 AllowUsers john joe Can ...
0
votes
1answer
1k views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
0
votes
0answers
14 views

Separate bridge for each VM?

I have been experimenting with network settings ever since I got a new dedicated server for some root-started unprivileged LXC containers a few months back and have finally arrived at what might be a ...
7
votes
3answers
4k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
0
votes
1answer
102 views

How can the mutt shell-escape feature be disabled?

We are thinking of offering mutt for our member's email client. The user's shell is instead the mutt application launched on their Maildir folder. It works great so far but one huge problem is the ...
3
votes
1answer
38 views

How to handle vulnerability searches in IIS?

I have a web server running an ASP.NET web application on IIS 8.5. I noticed that several 404 errors were logged by the application which are not related to my application in anyway. Here are few ...
1
vote
1answer
41 views

Secure connection errors without SSL

I have several users who are encountering messages about secure connections to the server when trying to access my website. We've had this on Mac (iphone, ipad and macbook w/ safari) & Windows ...
1
vote
1answer
47 views

Access to “Windows Security” logs for “eventlog” group

Security logs are not available for users in eventlog group. I've checked this down to security event log file. eventlog group has all permissions. Unfortunately I cannot add my user to ...
-6
votes
2answers
47 views

How to protect Windows Server 2008 r2 from persons, which have physical access to computer? [closed]

One server is available for other users, and we think that someone may steal passwords from it. I can not set a password on boot, because sometimes there is electricity failure, and UPS can hold it ...
3
votes
6answers
6k views

Why can't I drag/drop a file for editing in notepad in Windows Server 2008?

When notepad is run, I can drag/drop a file to open it, but then it can't save the file. When I run notepad elevated to save the file, I can no longer drag/drop to open the file. I understand its a ...
0
votes
1answer
41 views

How to deny access on files to several groups easily?

Currently I'm working with permissions on files on the network with Windows Server 2012 Active Directory as follows: I set up one domain controller, on the domain controller I create users and groups. ...
0
votes
1answer
35 views

Block an http referrer on the server level

I am seeing multiple fake http referrers to several sites on my server, which for the most part doesn't bother me, except that they distort visitor stats. I have filtered the questionable domains out ...
9
votes
6answers
11k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
2
votes
1answer
636 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
0
votes
1answer
147 views

Reverse a command and disable su on Ubuntu

Whilst following an online guide on how to secure Ubuntu server, I ran this command on one of my test VM's. sudo dpkg-statoverride --update --add root admin 4750 /bin/su I know the intention of ...
0
votes
1answer
68 views

How to eliminate Security Warning message on EC2 Instance wizard

I've set up the AWS Free Tier, and configured a Windows Server. I took the defaults pretty much. There was 1 security group it created with 3 security rules it provided by default, and I didn't ...
1
vote
2answers
37 views

Opening outgoing ports on dedicated machine

I have a website where I have been working with another person on a game server listing site. It queries the game servers and shows information etc. Anyway upon talking to the creator of the script he ...
0
votes
0answers
142 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
3
votes
7answers
1k views

Why do https connections take longer to establish than straight http connections?

Why is it that Secured HTTP Connection (https) is Slower then than typical HTTP (http)? Just interested in knowing only. Thanks.
1
vote
2answers
56 views

building a SIEM, should I send logs or get them from the gathering machine?

I am working in a Linux environment, I would like to gather all the logs from the machine pool on a unique machine X. There are several log files I need to move and I am not sure about the way I ...
0
votes
2answers
3k views

EC2 instance always ask me to enter passphrase for the pem during connection

The pem file is generated by AWS console I was able to connect using the EC2 remote web interface, using the same pem file The permission of pem is 600 already Error.. ssh -i ~/test.pem -v ...
0
votes
1answer
33 views

Protect Chef config when a node is compromised

Imagine that one node of a system gets compromised. If I understand correctly hacker will be able to get all configs for all servers in a system using chef's API. Is that correct? If yes, is there a ...
2
votes
3answers
23k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
2
votes
2answers
1k views

Encrypting SMB traffic with Samba

We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting: server signing = ...
-1
votes
1answer
27 views

Use 1 executable file to be distributed accross 100 client PROS and CONS guys? [closed]

for easy updates of our internal system I'm planning to use just 1 exe located at the server and just put a shortcut in my clients pointed at the exe in the server. PROS and CONS guys? Server 2008 R2 ...
2
votes
1answer
437 views

Host Header Attack with reverse proxies

So I was tasked with researching a problem that was identified by an Acunetix web security scan. Here are the details about the scan: Host_header_attack Automated Detection of Host Header Attacks I ...