Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
3answers
3k views

How to disable SSL/TLS compression in Apache 2.2.16?

I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt ...
11
votes
4answers
8k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
12
votes
5answers
25k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
0
votes
1answer
180 views

Powershell script for specifically OU

Need help with hte following, a script that can export all members of a specifically OU with in that multiple security groups. Location of the OU is; OU=Security Groups,OU=Public ...
1
vote
2answers
1k views

POODLE: SSLv3 vulnerability (CVE-2014-3566) with Apache24 on FreeBSD-9.2

I'm using FreeBSD 9.2-RELEASE-p5 with apache24-2.4.10_2 package. According to CVE-2014-3566 (POODLE), I went ahead and disabled SSLProtocol -SSLv3 following by restart of apache24 service, yet after ...
1
vote
1answer
115 views

Do Mac OS X servers have a security mechanism that blocks a user if they log in from two different IPs?

A trusted friend and I had ssh'ed into a Mac OS X Web Server (either 10.6.8 Snow Leopard or 10.7 Lion) from two different locations. Then my password stopped working when trying to log in. I can ...
0
votes
1answer
49 views

Google Authenticator - generate new set of emergency codes

I use Google Authenticator on my SSH servers with Andoid app for generating codes. After I run $ google-authenticator application create set of emergyncy keys: ...
11
votes
3answers
7k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate 2 processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent 2 ...
73
votes
8answers
31k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
11
votes
2answers
6k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
0
votes
0answers
18 views

Apache HTTP server STIG rule

I am new to setting up Apache HTTP and have to STIG the Apache HTTP 2.2 I have running. (http://iase.disa.mil/stigs/app-security/web-servers/Pages/index.aspx). For one of the rules it says the ...
-2
votes
1answer
87 views

How can I check if my server is using ssl 3? [duplicate]

How can I check if my server is using ssl 3? When I run openssl version command I get this. OpenSSL 1.0.1 14 Mar 2012 Thanks.
25
votes
5answers
18k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
0
votes
1answer
99 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
4
votes
4answers
1k views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
0
votes
0answers
41 views

do automatic updates (unattended-upgrades) still work with third party repository?

If I install nginx from the nginx repository by appending the following to the end of the /etc/apt/sources.list file: deb http://nginx.org/packages/mainline/debian/ trusty nginx deb-src ...
0
votes
1answer
138 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
0
votes
4answers
54 views

where should the site root directory be? [closed]

Where should I put my site root directory "my_site"? Any best practice? /var/www/my_site/ /var/local/sites/my_site/ /usr/share/wwww/my_site/ /usr/local/my_site/ /opt/my_site/ /srv/my_site/
17
votes
8answers
5k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
0
votes
0answers
28 views

how to run a web app: users/groups to use for each component?

How do you organize your users/groups to run the different components of your web app? Any best practices? The answer of this question (What permissions should my website files/folders have on a ...
10
votes
2answers
3k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
2
votes
5answers
10k views

Is IPSec the only way to encrypt Microsoft SMB (CIFS) traffic?

I'm looking for ways to encrypt Microsoft SMB data traffic between a client and Windows server or filer appliance. This is not about encrypting the authentication but the actual data transfer. Is ...
0
votes
1answer
74 views

OpenBSD chroot for nginx/Apache file permissions

I haven't been able to find a satisfying answer on Goole or the various Stack forums: I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions ...
-3
votes
1answer
27 views

Secure SSH access [duplicate]

I am making a website and I am using a droplet made in digital ocean as my dev server. (No stg or prd yet) The problem is that I am using Dynamic IP and if I blocked access on port 22 to my current ...
3
votes
1answer
160 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
5
votes
1answer
75 views

W2K8R2 - A way to convert effecitve Group Policy settings to import on stand-alone machines for local policy?

If I have a relatively robust domain environment (e.g. 20 Security related Group Policy Objects) applying to my servers as a baseline set of policy settings and I have a stand-alone server that I want ...
0
votes
0answers
24 views

Check Unix Credentials on Apache Server Web App

I am building a number of web apps served by apache for internal use and I really want to have them use unix credentials for access. I know a few ways I could do this but all of them seems to expose ...
1
vote
1answer
249 views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
1
vote
1answer
34 views

Ways to follow newly discovered vulnerabilities?

I happened to be in a situation where I am in charge for 100+ systems on top of my job as a programmer. Everything we run is Linux (Debian, Ubuntu, Centos) and gladly our sysadmin set everything with ...
7
votes
1answer
10k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS ...
0
votes
1answer
72 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
0
votes
1answer
78 views

Http 1.1 protocol detected

I have a CentOS server and we had a Retina security scan. I have no idea how to fix this vulnerability. Can you point me in the right direction? We are running nginx.
2
votes
1answer
64 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
62
votes
9answers
68k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
4
votes
5answers
2k views

How do you configure a MS SQL Server to prevent exposing all database names and logins to any authenticated user?

I'm new to MS SQL and asking this question as a web developer with limited sysadmin experience who desires his service providers to use best practices. We have one database on a remote MS SQL server ...
14
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
0
votes
3answers
424 views

How do I open private files using a browser through SSH

On my current project I have a few private php scripts and I also have phpMyAdmin in a private area of the server. Is there anyway of opening those files in a browser? I'm currently tunnelling using ...
3
votes
3answers
640 views

How is a private data center more secure than a public cloud?

I have customers in the financial services industry that insist that a SaaS hosted on public clouds like Amazon's are not as secure as colocation in a private data center. However, I can't find ...
1
vote
1answer
147 views

Security risks of using Google DNS to resolve names on a private net (192.168.x.x)?

Are there any known risks associated with using a public DNS versus a DNS which we or our partners control? Our solution involves a few embedded devices so using Google DNS would give us a degree of ...
1
vote
2answers
401 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
0
votes
2answers
2k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
-2
votes
1answer
119 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
5
votes
3answers
584 views

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own chrooted Environment. On ...
20
votes
3answers
2k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
-1
votes
1answer
67 views

IIS 8.5 Securing FTP [closed]

I have a IIS installation on Windows Server 2012 R2. I need to provide FTP access to a website. Its only one person. The easiest way to make it secure is to make an ip-restriction and only ...
2
votes
1answer
106 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
3
votes
4answers
156 views

Disable Windows Share Without Administrator Access

We have a folder on a windows server shared to provide access to an important application. When the application is being updated we (DBAs) change the permissions on the share to deny all access to it ...
32
votes
4answers
69k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
0
votes
0answers
35 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
319
votes
3answers
298k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...