Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
42 views

OpenSCAP incorrectly reporting false for RHSA-2014:1306: bash security update (Important)

I'm using the following command to test for RHSA-2014:1306 on CentOS 5.9: oscap oval eval --id oval:com.redhat.rhsa:def:20141306 com.redhat.rhsa-all.xml The result is: Definition ...
1
vote
2answers
1k views

How to secure Apache for shared hosting environment? (chrooting, avoid symlinking…)

I'm having problems dealing with Apache configuration: the problem is that I want to limit each user to his own docroot (so, a chroot() would be what I'm looking for), but: Mod_chroot works only ...
-4
votes
3answers
1k views

Allow non-root process to listen on port 80 without doing anything drastic [duplicate]

For reasons beyond my comprehension, GlassFish refuses to play ball with iptables. That is, with all the correct redirection rules in place, it won't receive any redirected traffic. So I'm at plan B ...
2
votes
1answer
116 views

Are Elastic Beanstalk's environment variables an appropriate place to store secret values?

I have deployed my Django application to Elastic Beanstalk with the intention of using its environment variable configuration interface to store my API keys instead of storing them in my source (as ...
0
votes
0answers
25 views

PSAD does not start on Ubuntu 14.04

I complied PSAD from source, compilation went smoothly however when I run this command: sudo psad --sig-update I got this: Can't load ...
0
votes
1answer
29 views

Apache Security Issue with VirtualHosts

I have setup Apache 2.2+php 5.3.3 on CentOS 6.6 and are running virtual hosts with their document roots setup like /var/www/domainFoldername and their virtual hosts configuration in httpd.conf like: ...
4
votes
1answer
692 views

Traffic in a AWS virtual private cloud

On Amazon AWS, should I encrypt sensitive traffic between instances in a virtual private cloud? More specifically, is the traffic between the instances in such a VPC private as in a virtual network, ...
2
votes
1answer
88 views

Meraki Z1: protection of corporate devices from personal devices

My company employees about 600-700 remote employees, each of whom is issued a corporate IP phone an a thin client compute endpoint. In our current deployment, both devices are configured (defaults ...
0
votes
0answers
15 views

libvirt: can it provision network interfaces where the network backend is running in a domU rather than dom0?

Thanks to a great blog post, only slightly out of date [1] I've managed to configure a dom0 which has no networking at all: physical network interfaces are passed through to dedicated domU guests ...
0
votes
0answers
14 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
2
votes
0answers
28 views

Security concerns w/ physical vs virtual network gateways [closed]

I am in the process of setting up a private network that uses a gateway system for access to certain services on systems behind the network, e.g. ssh, ftp. I have some experience using virtualized ...
1
vote
1answer
31 views

Constant server pings

I've got a Python/Django app hosted on Heroku, monitored on New Relic, with logging tracked on Logentries. I've noticed a large amount of logs that are of the form: at=info method=HEAD ...
5
votes
3answers
4k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
136
votes
5answers
123k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
0
votes
0answers
26 views

PHP allow_url_fopen seciurity risks

There is theory (among some admins) that allow_url_fopen will put your server at risk because you can include external scripts (prior to PHP 5.2.0). Since PHP 5.2 there is different option ...
4
votes
5answers
6k views

SSH access problem: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

We have a server XXX ON Amazon EC2. SSH is running on a standard (22) port. I placed my pubkey at the /.ssh/authorized_keys file The fun thing is that YESTERDAY it was working great! But today, I ...
0
votes
0answers
36 views

How to prevent Apache from serving files owned by root?

I run multiple websites on a server using vhosts. I want to configure Apache to just serve files owned by the apache user. Also, only those files should be interpreted by PHP. How can set this ...
1
vote
3answers
179 views

How to disable the default document root in Apache?

I host some websites on my server running Apache Httpd. Each website has it's own domain or sub-domain and virtual host. Therefore, I need no default document root. Is it possible to disable ...
2
votes
2answers
114 views

Multi-site hosting security - ensure no scripts can run as Apache user, but only as each website's user

In setting up a hosting environment with multiple sites that should be isolated from each other, I did the obvious step of having PHP be configured so it runs as the user that's associated with each ...
0
votes
3answers
6k views

Windows: disable remote access of local drive, even by domain admin

We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In ...
0
votes
0answers
78 views

Amazon EC2 Abuse Report - SQL Injection Attempts

I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses. Just ...
1
vote
1answer
57 views

Is a jump server really necessary when using RDC to connect to Azure VM?

We are setting up a new Network which includes a VM in Azure. I can connect to this via RDC. However, our security guy wants me to access it through a second VM for security reasons. In other words, ...
0
votes
1answer
2k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
0answers
32 views

Website randomly not load some files

I have a single page web application who has recent HTML, JavaScript and CSS that interact with very old Classic ASP pages called using AJAX. In localhost all is working good, on the other hand in the ...
0
votes
1answer
15 views

How can I make sure only my VPN client can access public networks directly? [closed]

Presently, I go like this: Go to Starbucks Open my laptop (which may have 3 gmail accounts etc open in browser) Connect to their public network Sometimes have to press the "I agree" button in ...
1
vote
4answers
672 views

Apache2 ssl with ecc

Is it possible to configure Apache2 to use elliptic curve crypto (ecc) with SSL? This bug https://issues.apache.org/bugzilla/show_bug.cgi?id=40132 appears (to me) to indicate that this is supported, ...
4
votes
1answer
55 views

How to securely install Windows executables across the network using SCCM?

We would like to install various Windows software (.exe) using SCCM but have noticed that SCCM uses a domain admin account when pushing executables. Thus, we are concerned that the account's password ...
-1
votes
1answer
18 views

Ethernet Communicator Non-Supporting of Port Forwarding?

The security contractor has installed a node on the network for the burglary alarm system. It uses IP to communicate the alarm signals. It has some kind of call home feature and supports DHCP as ...
7
votes
1answer
193 views

Is is possible to disable Certificate Transparency (audit log checking) of certificates in Chrome?

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on ...
0
votes
2answers
4k views

How to disable anonymous access on LDAP

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd). I notice that if I run: ldapsearch -x -W -b ...
0
votes
1answer
87 views

Which registry key corresponds to “Log on as a service”?

I want to be able to set this value programmatically (preferably via WMI). It must live in the registry or some other location. Yes, I know how to do it via MMC using secpol.msc, but I need to ...
1
vote
2answers
156 views

Safety of sshpass and SFTP to dynamic host

I have a server with dedicated IP address A and a server with dynamic IP address B (routing via no-ip.org). A uploads a backup to B via sshpass: export SSHPASS=*** sshpass -e sftp **@** << ! ...
1
vote
1answer
25 views

Webserver | IIS | Configuring to not run certain files

I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP. Lets assume the a user is able to upload a trojan onto my server, either through a ...
0
votes
0answers
63 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
2answers
4k views

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account?

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account? I tried to run script under local system account on the client which ...
0
votes
2answers
1k views

I'm trying to connect to a user session who's using remote desktop on my windows server 2003

I'm trying to connect to a user session who's using remote desktop on my windows server 2003 × 2024, from task manager users but it comes up with Connect Password Required. I tried his password that ...
0
votes
1answer
48 views

Virtual web server configuration dmz [closed]

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running: - Mail server - WEB server for enterprise website and ecommerce. the esxi server has an iscsi ...
3
votes
4answers
131 views

Our server hosting provider asked for our root password

I work at a company that develops and hosts a small business critical system. We have an "Elastic cloud server" from a professional hosting provider. I recently got an email from them saying that ...
12
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
2
votes
1answer
29 views

Can I block a file execution with AppLocker?

We currently use a combination of a regular and an "advanced/fancy" endpoint malware protection, in the advanced malware app, I can feed a SHA256 hash of an executable into the advanced platform and ...
2
votes
2answers
35 views

Restrict access to .ssh folder over network shares

I run a small server running Ubuntu Server 14.04 and have just noticed that the .ssh folder in the users home directory is accessible via SMB and NFS. The SMB and NFS are both secured, however I ...
10
votes
9answers
6k views

How to disable responses to PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
2
votes
5answers
277 views

How to prevent remote code execution from a domain member server?

Is there a way, using a firewall, Group Policy setting, or other control, to prevent someone logged into a domain member from being able to remotely execute code on a domain controller (that they ...
0
votes
0answers
24 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
4
votes
1answer
119 views

Server2k8: Prevent membership in a group based on membership in another group

I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, ...
3
votes
6answers
47k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
1
vote
2answers
1k views

McAfee ePO server not displaying updated Product version number

I have recently been given Administrative rights to help maintain ePO on my companies network. From the group of machines that I am in charge of keeping up-to-date, a small amount of these machines ...
0
votes
1answer
31 views

Azure SQL - Sudden connection spike

At first: This is my first question on Serverfault. I am not sure if it fits better on Information Security. If so, please leave a comment and I will move the question. Question My company is ...
3
votes
1answer
47 views

Debian - Warning: Possible LKM Trojan installed

I am running chkrootkit every night on 3:04. More than 1 year it was not returning any problems but 1 month ago this warning started to appear: ======================= Checking `lkm'... ...
0
votes
1answer
27 views

Google Apps password change not reflected across all devices

We have a paid Google Apps account and I recently changed the password for one of our users. I confirmed the password change by logging into gmail.com using the new password. The old password isn't ...