Security is not a product, but a process.

learn more… | top users | synonyms (2)

34
votes
12answers
8k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
21
votes
5answers
12k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
32
votes
5answers
25k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
28
votes
4answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
25
votes
5answers
5k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
20
votes
8answers
2k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
8
votes
3answers
11k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
19
votes
5answers
5k views

Minimum permissions for a user to perform a mysqldump?

I want to start scheduling remote mysqldump crons, and I'd prefer to use a special account for that purposes. I want to grant that user the minimum permissions for getting a full dump, but I'm not ...
12
votes
8answers
1k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
12
votes
13answers
3k views

Password expiration policies [closed]

Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
9
votes
1answer
13k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
7
votes
7answers
588 views

Securing WordPress Blog Installation

Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?
25
votes
4answers
3k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
22
votes
5answers
2k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
11
votes
11answers
1k views

Penetration Testing

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?
10
votes
6answers
926 views

How to choose a cloud service for backups

I am thinking of using a cloud service to backup one of my client's website. My (clients) main concerns are (in decreasing order of importance) Protection of IP (trade secrets, source code), user ...
9
votes
4answers
3k views

Securing file system for secure SFTP server

This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
8
votes
3answers
512 views

What are some best practices when taking over IT at a new company?

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
2
votes
2answers
345 views

How to find an unauthorized person's entry point to a server

We're running an in house dedicated server with 100's of sites on it. Some of these sites were very insecure and the box was not managed very well. Some one got in, messed up a bunch of stuff and is ...
24
votes
4answers
697 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
17
votes
9answers
1k views

Steps to take when technical staff leave

How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
8
votes
4answers
662 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
9answers
416 views

What tools do you use for vulnerability scanning?

What are your favorite tools for checking for vulnerabilities in websites?
6
votes
1answer
681 views

Adding port forwardings programmatically on a ControlMaster SSH session

I just found out about the ControlMaster/ControlPath feature of OpenSSH, which allows you to use a single SSH connection to run multiple terminals. As I often use SSH to use port forwarding to get ...
6
votes
3answers
847 views

SELinux in the Real World

Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it. I personally have several ...
6
votes
1answer
9k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS ...
6
votes
13answers
5k views

Relatively easy way to block all traffic from a specific country?

I know this sounds terrible, but I have a web app that has no users in the Philippines, but is constantly bombarded by spammers, carders testing cards, and other BS from there. I can see in the logs ...
4
votes
3answers
3k views

How to Open help (.chm) files over unc path

When I try and open a help file (.chm) that resides on a unc path I get the following error: "Navigation to the webpage was canceled". If I copy the file locally I am able to open it. I imagine there ...
33
votes
6answers
18k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
18
votes
6answers
2k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
14
votes
11answers
826 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
10
votes
4answers
575 views

Common PHP setup insecurity?

I work with the systems administration at a university and just stumbled across something which is probably common, but was quite a shock to me. All public_html directories and web areas are stored ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
5
votes
2answers
2k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
4
votes
7answers
9k views

How to disable CD-ROM and USB for normal users in Linux?

How can access to CD-ROM and USB be disabled for normal users in Linux? As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. ...
1
vote
1answer
1k views

How to monitor file/directory changes

I have a Server running Debian Lenny. Recently I've encountered a few security issues. I am specifically seeing a file get created within /etc/php5/conf.d named 'php-dev.ini'. At first glance the ...
17
votes
3answers
1k views

Securely wipe an entire Linux server with itself

I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running. OS is SL6. ...
12
votes
13answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
9
votes
2answers
9k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
9
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
8
votes
2answers
890 views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
7
votes
7answers
4k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
5
votes
2answers
1k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
5
votes
3answers
460 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
5answers
7k views

Security: Unable to display current owner

I have a user with local administrative rights on their Windows 7 64-bit box. They extracted a file from a zip file they downloaded with the Zip shell extension to their desktop on a non-encrypted or ...
4
votes
4answers
6k views

What is the best way to harden Windows Server 2008 R2?

I need to harden my windows 2008 r2 server for PCI. What is the best way to do this? The server are behind a CISCO ASA and in the DB servers are in separate vlans. Now i need to know if there are any ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...