Security is not a product, but a process.

learn more… | top users | synonyms (2)

13
votes
7answers
10k views

Automatically check for Security Updates on CentOS or Scientific Linux?

We have machines running RedHat-based distros such as CentOS or Scientific Linux. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. ...
1
vote
1answer
76 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...
1
vote
1answer
46 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
177 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [closed]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
0
votes
0answers
46 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
1answer
29 views

MySQL via SSL on VPC private subnet

Is an SSL connection recommended when connecting to a MySQL database server via a private subnet? SSL provides encryption but SSL causes a performance hit. The MySQL database server only serves ...
9
votes
2answers
2k views

Why is “AcceptEnv *” considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
1
vote
1answer
33 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
1
vote
1answer
53 views

Roundcube does not add IP address information into sent emails

Usually the mail client is supposed to add IP information into emails, in order for the sender to be tracked. But when you send emails from Roundcube Webmail/0.8.4+, the IP address of the server is ...
0
votes
2answers
129 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
42 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
0
votes
0answers
23 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
1answer
733 views

Memory Pressure Protection Feature for TCP Stack - Provided by Microsoft Security Update KB967723

We've been having a lot of funky issues with some of our web based applications that allow clients to submit lot of image files to our servers. Lots of ports are used in the process. ...
7
votes
2answers
161 views

Storing AWS credentials securely on a personal machine

How can I securely store AWS credentials on personal machines? In detail: Everybody in our team requires AWS security credentials for doing administrative tasks (credentials are separated by role). ...
4
votes
7answers
10k views

How to disable CD-ROM and USB for normal users in Linux?

How can access to CD-ROM and USB be disabled for normal users in Linux? As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. ...
-1
votes
5answers
631 views

Securing Remote Desktop Server on Windows 7 For Internet Use

I have a desktop and laptop both running Windows 7 Professional. My goal is to secure the desktop so that I can securely use "Remote Desktop" over the Internet from ONLY the laptop. I have already ...
0
votes
1answer
33 views

Detect files of folders which do not inherit permissions from their parent

Is there an easy way to find any files/folders (recursively) within a directory which do not inherit permissions from their parent. i.e. To gauge the effects of selecting "replace permissions on ...
0
votes
2answers
251 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
0
votes
2answers
5k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
0
votes
1answer
86 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
90 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
5
votes
8answers
674 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
19
votes
2answers
1k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
1
vote
2answers
829 views

Getting Windows 7 to run Scripts from Other Shares then NETLOGON

I have several Windows Server 2003 Environments I administer. These are separate disparate domains with their own structures and policies. I generalize as much as possible when I administer these ...
-1
votes
3answers
158 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
2
votes
1answer
311 views

Duplicate Administrator Accounts

Somehow, I have a Windows 2003 Server that has two local Administrator accounts that have the same SID (S-21-xxxxxxxxx-500). Therefore, normal utilities don't let me delete them. (Can't delete a ...
2
votes
1answer
49 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
0
votes
1answer
578 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
3
votes
2answers
1k views

Debian: automatic notification of updates?

What's the simplest way of getting notified of security updates for packages I have installed on my Debian system?
63
votes
13answers
30k views

What steps do you take to secure a Debian server?

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
0
votes
1answer
127 views

Security Auditing on Ubuntu 14.04 LTS

The Tiger security auditing tool has been a standard install in the past. However, it doesn't look like Tiger is being updated. Is Tiger still a valid security auditing tool on Ubuntu 14.04. If ...
-1
votes
1answer
44 views

Is www-data considered a non-privileged user on Apache?

Great Apache Hardening post that recommends "Run Apache from non-privileged account" because "Default apache configuration is to run as nobody or daemon." Is www-data:www-data considered a ...
0
votes
1answer
34 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?
4
votes
2answers
612 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
2
votes
1answer
619 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
12
votes
13answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to ...
10
votes
2answers
2k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
1
vote
1answer
70 views

Is storing password hashes in plain text dangerous?

We have a server that is going to be managed through a chef cookbook. Each user for the system is configured using hashes from /etc/shadow. Can we safely store these shadow hashes in our ...
0
votes
1answer
41 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
1
vote
0answers
15 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
1
vote
2answers
43 views

Ability to use SSH Key / PEM for web authentication in lieu of password protection?

I've been trying to figure out a way to lock down our dev site even more, and the idea came up that instead of using IP centric + Password protection, using something more akin to a PEM key, like I ...
2
votes
1answer
143 views

chattr - How to change file +i attribute without using chattr

Here`s the problem. My server got probably hacked. I would like to change a config file, but it is immutable (has the +i attribute), so I can't edit it. trying to execute a "chattr -i" on the file ...
3
votes
7answers
1k views

What can I do to replace FTP?

I'd like to replace FTP access with systems that are more secure. Sending passwords in plain text with no encryption is unacceptable and with single-sign-on growing, becoming less acceptable daily. ...
-2
votes
1answer
161 views

Prevent/Stop Namespace Mining [duplicate]

Enviroment: Plesk v12, latest Windows Server 2012 SmarterMail My web hosting provider told me that someone hacked into my server a couple of weeks ago and was hitting various mail servers (Gmail, ...
2
votes
1answer
100 views

Is the server still vulnerable to attack if we don't turn off cgi.fix_pathinfo?

The /etc/nginx/sites-available/default file that comes with nginx installation has the following content: # You may add here your # server { # ... # } # statements for each of your virtual hosts to ...
-2
votes
1answer
64 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
13
votes
4answers
335 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
1
vote
1answer
375 views

Apache 2.4/PHP-FPM ProxyPassMatch and access restriction

I've got Apache/PHP setup exactly like this: https://wiki.apache.org/httpd/PHP-FPM It includes the ProxyPassMatch rule as mentioned: ProxyPassMatch ^/(.*\.php)$ ...
-1
votes
1answer
44 views

Making Private Domain Marriage Public Domain Name - Revisited

I'm building a server with Windows Server 2012 and I've checked many articles on the net about "naming" your internal domain. Interestingly, most of the comments are from 2009. As we all know, times ...