Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
11 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
23 views

Nginx Default/Welcome Page Suddenly Returns

I installed Nginx a number of months ago and deployed some code. I obviously deleted the default index.html Nginx default page. I know this for certain as PHP was not installed and so index.html was ...
11
votes
2answers
497 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
0
votes
0answers
28 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
0answers
43 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
3
votes
2answers
87 views

How worried should I be about unsecured HTTP on a “private” network?

So I've joined a new team, which develops and operates a service available on the Internet. It's aimed at B2B use rather than consumer, although anyone can sign up for a low-tier account to check it ...
7
votes
7answers
11k views

How to detect rogue WIFI routers on a network?

My client recently changed their network policy so now all WIFI routers are disallowed from the network. They said they would be running some scans and that they would be able to find "rogue" WIFI ...
6
votes
3answers
777 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
1
vote
2answers
54 views

site-to-site vpn tunnel - does hardware matter? [closed]

I have been tasked with setting up 4 offices and connecting them all together so they can be on the same network. Does hardware really matter or could I build a decent machine in the low $1000's and ...
0
votes
1answer
17 views

How to manage access to nodes in a cluster?

I am about to set up a server cluster for our company's web applications. At the beginning there will be 3 hardware servers in Proxmox HA setup in a remote datacenter running about 20-30 VMs all ...
0
votes
0answers
23 views

Garbage files in public_html folder. Is this a security breach? [duplicate]

The public_html folder on my site just got uploaded with a ton of garbage html files with filenames such as vonzipper-sunglasses-men-25jh27.html and tumi-daypack-04po59.html as well as several files ...
0
votes
1answer
164 views

secAst lib prerequisites too new for Debian/Utuntu 12 LTS?

as requested in FAQ I wrote here the question (there is no question for this product yet on this site?) This Asterisk securing tool looks very nice so I tried to test it out: ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
39
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
0
votes
0answers
66 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
8
votes
5answers
24k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
1
vote
4answers
12k views

Password protect file folders on FTP site

We have an FTP site with a single username/password that we provide to people as they need it. We are unable to create a new username/password for every person that might need to access the site, but ...
-2
votes
1answer
26 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
0
votes
0answers
10 views

Application Virtualization Risk Through WAN / Internet

I was weighing pros and cons about the new mission critical system that through application virtualization, will allow my colleagues from 3 different countries to access it. Here are some background ...
3
votes
10answers
8k views

Real one-time passwords (OTP) on Linux other than S/Key? [closed]

Surely it is no good idea to log into a remote system from an untrusted computer. But sometimes it is plain necessary. Exposing an unencrypted SSH keyfile is no option of course. Entering a regular ...
0
votes
1answer
40 views

Can I use an IAM role to grant my Heroku app access to my Amazon S3 bucket?

Heroku: Using AWS S3 to Store Static Assets and File Uploads suggests using my AWS security credentials to enable my Heroku app to access my Amazon S3 bucket. However, isn't it better practice (as ...
0
votes
1answer
26 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
1
vote
1answer
73 views

Minimizing attack surface on fresh 2012 R2

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my ...
0
votes
1answer
2k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
0
votes
1answer
51 views

Extra SSL Certificate For Database Server?

I have three servers: Web-Server Database Server Database Replication Server In the upcoming days, I am going to order a SSL certificate for the Web-Server to deliver the data encrypted to the ...
0
votes
1answer
44 views

Do not allow all domain users to have access to a shared folder

This should be easy, but I just don't see it. And, first, I'm a programmer wearing the hat of an IT for lack of resource where I work (small company). I need to create a folder, inside our network ...
0
votes
4answers
218 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
17
votes
6answers
20k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
0
votes
0answers
27 views

How can I secure an insecure Meteor by using Nginx?

I have an insecure Meteor running on AWS. For those not familiar with Meteor, that means I am using the "insecure" package, which trades security for rapid prototyping. I only need our development ...
0
votes
1answer
46 views

Is it a security issue if I have GIT working copy in www?

If I checkout a working copy into the www root of my site, would that be a security vulnerability?
1
vote
1answer
25 views

Linux security implications for sudo, su to service account & add secondary group to admin Tomcat?

I have a named account to login to a Linux host. Tomcat is running under a Service Account named "tomcat" I periodically need to do admin functions like modify tomcat-users.xml which is configured ...
1
vote
1answer
16 views

Accept only new file uploads over SSH

We want to send files around between some linux hosts via OpenSSH, but we don't want clients to be able to list / retrieve / modify existing files on the server. In other words, it should be an ...
1
vote
2answers
371 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
0
votes
1answer
62 views

How do you use a SOCKS proxy?

I intended to call this question: "Are SOCKS proxies still relevant?" but thought it would be too vague. I know there are various SOCKS proxies that are actively maintained and developed (like ...
0
votes
2answers
69 views

do i need to filter the OUTPUT with iptables for a dedicated firewall box?

I already know how to setup a firewall using iptables, but after a visit of the IT Security Department, they said i need to filter the OUTPUT, but, it is pointless to me, i really can find an scenario ...
-1
votes
1answer
102 views

How to stop small DDOS attacks (443 port)?

On the server goes DDoS attack. ~# netstat -n -p | awk '{print $5}'|awk -F: '{print $1}' | sort -n | uniq -c | sort -nr | head -n10 48 109.229.9.53 47 31.207.244.130 45 87.252.227.83 ...
1
vote
1answer
33 views

SSH via Any IP for Specific Username?

I often SSH into a server from home or from work—but when I'm other places, I get this error: ssh_exchange_identification: read: Connection reset by peer After reading around a bit, I've come to ...
2
votes
3answers
15k views

How to “jail” a ftp user inside its home directory (proftpd)?

I have a user named "ftp3" that belong to group "ftpusers-temp". The home of that user is home/FTP-shared/temp In proftpd.conf I have the following 2 directives: DefaultRoot /home/FTP-shared ...
1
vote
1answer
271 views

OpenVAS 7 failing to SSH into a test server

My local machine is hosting a Kali VM. I am trying to run local security tests using the VM's OpenVAS 7 on a server running Ubuntu 12.04.5. When I run SSH Authorization Test I get the following ...
3
votes
2answers
966 views

Is it worth running nessus as well as OpenVAS?

Apparently OpenVAS originated as a fork of Nessus. It is very easy to install and use OpenVAS because it's, well, open. However, am I kidding myself if I just use that instead of Nessus? Should I ...
0
votes
1answer
46 views

Shorewall: Block repeatedly failling ips on port 22

I am on Fedora 21, and port 22 is open for ssh connections. I am using key-based authentication with password and root logins disabled. My logs are flooded with messages like the ones appended at ...
5
votes
7answers
11k views

Should I use a login banner and if so, what should it say?

Are interactive login banners worth having? The general consensus is that they are, but what should the banner say? Some things that are being considered (no particular order): ownership of the ...
2
votes
2answers
137 views

IIS only serve requests with hostnames

What is the optimal way to configure IIS to block direct IP access to the server? Direct IP access is only used by malicious scanners that will troll the entire internet by ip looking for vulnerable ...
21
votes
6answers
60k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
0
votes
1answer
102 views

How does TeamViewer get through my firewall even though I set it to “No incoming connections”? [closed]

Here is my firewall settings: Clearly, firewall is on for both private and public networks and it is set to "Block all connections including programs on the list of allowed programs". I did not ...
0
votes
2answers
465 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
-1
votes
2answers
71 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
0
votes
1answer
40 views

Blocking requests matching HTTP_X_FORWARDED_SERVER header

Someone has setup a CDN server which is directing traffic to my server and setting the HOST header to match one of my real domains. Because of this, Apache uses the virtual host for my real domain ...
2
votes
2answers
114 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
10
votes
3answers
27k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...