Security is not a product, but a process.

learn more… | top users | synonyms (2)

18
votes
3answers
1k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
-1
votes
1answer
119 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
1answer
18 views

How are the security groups injected in an image in OpenStack?

I have been using OpenStack for some time and was just wondering how the security groups are injected in an image file. I browsed on the internet but I could not find a solution.
-3
votes
1answer
52 views

Keeping your server safe [closed]

I have a typical vps server with some custom sites on it running on port 80, a mail server, I don't have a DNS server and it is a default ubuntu 12.04. I don't have any admin panel, I am doing all the ...
2
votes
1answer
28 views

Preventing SecAst access from across the network

I have SecAst up and running great, and I realize that any workstation on the network can access the SecAst telnet interface. Is there a way to limit this to only my laptop? I don't want one of the ...
1
vote
1answer
26 views

Obtain an offline image of an Xserve disk

We have an Intel Xserve with Mac OS X 10.4. It seems to have been infected by a virus. We want to obtain the disk image without booting into the OS. Preferably, we would want to boot via a USB disk ...
2
votes
1answer
46 views

Robocopy Ext USB HD to Server 2008

I tried copying data from an external usb drive to my W2008 server, g:\parent_directory d:\server_shared\parent_directory. Unfortunately, I picked the "copyall" paramenter which copies over D=Data, ...
1
vote
0answers
61 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
4
votes
3answers
248 views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
0
votes
2answers
51 views

How to restrict access to root to daemon user?

I have Apache 2.4 with PHP 5.5.14 installed on latest Debian. According to Apache security tips&tricks I've set my httpd.conf to this: <Directory /> AllowOverride none Require all ...
1
vote
0answers
80 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
3
votes
1answer
144 views

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
136 views

Failed PCI DSS Compliance

I got this from my compliance check results. To me it looks like my router is responding to their test but I'm not sure where to go . ( might be off track completely though) Description: PCI DSS ...
-1
votes
1answer
500 views

How to block incoming login attempts to postfix, pop3, imap?

We are running CentOS 6.5 with Plesk and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or ...
20
votes
2answers
1k views

Why should I start to replace Windows Server 2003?

Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis. I have heard that I should replace it by something "newer" and more "modern". Why should ...
2
votes
3answers
64 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
1
vote
1answer
35 views

How does one achieve in Windows 7 a level of security comparable to setting a file's permissions to 0600 in Unix?

I want to store securely the file .pgpass, which contains the authentication credentials (including passwords) for client programs to be able to log in to PostgreSQL servers. The Pg documentation ...
0
votes
1answer
23 views

secast init file already exists

I'm installing SecAst on a new computer and I'm on step 2.1.7 (copying init files). I copied the first initd file, but when I copy the second one it says file already exists (and I'm overwriting the ...
0
votes
1answer
41 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
0
votes
2answers
33 views

SecAst: Potential documentation issue, Ubutunu 12.04.4 LTS and the command: cp -v

To Generation D: I am writing you about what might just be a documentation issue which hopefully doesn't have significant repercussions. This is something I encountered immediately at the start on ...
1
vote
2answers
230 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
1
vote
1answer
35 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
2answers
124 views

Installing SecAst on AsteriskNOW with CentOS

Having some issues installing SecAst for IPS, Followed the directions up to 2.1.6 and found a way (on this forum) to install qt5-qtbase (thanks) but when I run ldd /usr/local/secast/secast the return ...
0
votes
2answers
75 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
1answer
29 views

SecAst: Premature Exit in Daemon Mode

To Generation D: This is a new problem with build secast-1.0.4.0-x86_64-ub12 that didn't happen with the previous build, secast-1.0.1.0-x86_64-ub12. When secast is run as a service (service secast ...
1
vote
1answer
35 views

SecAst: Configuring Email Alerts for Google Apps Account

Requesting assistance with configuring SecAst email alerts to work with Google Apps hosted account (posting here as per request by Generation D)... We have SecAst installed on a system with a new ...
0
votes
1answer
44 views

Fixing Apache Struts XSS vulnerability

A recent network scan revealed the following vulnerability: Apache Struts s:a / s:url Tag href Element XSS. Here is a link with more info about this vulnerability: http://osvdb.org/show/osvdb/54122 I ...
-5
votes
1answer
59 views

How much harm can a non-root user cause? [closed]

Let's say you add a user to your Linux server, and allow the user to connect over SSH with full command-line access, but do not add him to the list of sudoers. What sort of security vulnerabilities ...
-1
votes
1answer
135 views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
2
votes
1answer
36 views

Hardened compiler flags VS automatic security patches?

I noticed that a few select pieces of software in the Long Term Support repository for my Operating System, have not been compiled with PIE, or Immediate binding (for example). In the opinion of ...
0
votes
1answer
357 views

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account?

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account? I tried to run script under local system account on the client which ...
28
votes
3answers
2k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
3
votes
3answers
293 views

How can I prevent the compromise of a Domain Controller on ESX stored in a unsecured location?

A client of ours has a DC that will be located in an insecure location. RODCs and separate domains/forests are not permitted by management. All the servers will be located on a VMWare ESX server. ...
-1
votes
1answer
61 views

Alerting on threshold crossing?

We are using logstash + elasticsearch + Kibana to parse, store and view our logs respectively. Now, we want a notification/alert when a threshold for a particular log or threshold for a particular ...
4
votes
3answers
63 views

Server 2008 permissions issues

We have a selection of top level folders: E:\Data1 E:\Data2 E:\Data3 The permissions are simple - the default CREATOR OWNER, SYSTEM Full Control, some security groups allowing Modify and the LOCAL ...
2
votes
1answer
41 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
0
votes
2answers
111 views

nginx as reverse proxy on front of Apache - protection and security

I'm just concerned whether to install Nginx WS alone or nginx as reverse proxy on front of Apache based on security and protection. If I had to choose nginx as reverse proxy on front of Apache, would ...
2
votes
2answers
66 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
2
votes
1answer
396 views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
2
votes
2answers
98 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
29 views

Private, secure network between web nodes

I need to create small network of vps (linux) servers. Their main puropse is to server some data over http to clients. Each server is going to be located elsewhere in the world. I want those servers ...
2
votes
1answer
42 views

How can I avoid logging file not founds commonly caused by vulnerability scanners?

My apache logs are pretty much full of 'admin.php' not found or unable to stat and similar statements for wp-login.php, default.php, and so on that are often sought after by vulnerability scanners. ...
1
vote
1answer
96 views

iptables connection limit does not work on debian

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
-2
votes
1answer
34 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
1
vote
1answer
25 views

OpeVPN log connecting client IPs

I looking for the best solution to log all connecting client's ip to either a text file or a database who logs into my VPN server. Under the IP I mean the public WAN IP on the internet where they are ...
5
votes
1answer
224 views

Recursive reset file permissions on Windows

There is a big, complex directory structure on a relative big NTFS partition. Somebody managed to put very bad security privileges onto it - there are directories with randomly given/denied ...
0
votes
2answers
46 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
264 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
4answers
76 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
0
votes
0answers
29 views

Security concerns regarding php://stdin

I'm using xinet.d and php://stdin to host a raw tcp-connnection, (following the excellent guide at http://gonzalo123.com/2010/05/23/building-network-services-with-php-and-xinetd/) I'm concerned with ...