Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
1answer
149 views

Alternative to Firewalld on memory critical servers?

I've bought a 512MB VPS @ DigitalOcean. Currently, I use Firewalld to allow/deny access to certain ports (probably 22, 80, 443 are open). It uses around 25-30MB of memory. EDIT: Not to forget that ...
0
votes
2answers
357 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
0
votes
1answer
39 views

Will Apache2 performance be reduced by huge IP blocklist

My web application is getting more and more hits from unknown sources trying to access secure pages, such as admin panel, etc. So, I want to block IP address from certain countries using this source. ...
1
vote
2answers
123 views

How risky is storing credentials on disk in a Powershell SecureString?

Basically, I want to cache the credentials needed for New-PSSession and make them available to scripts so they don't have to nag a human. If I use export-clixml or similar to store a PSCredential on ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
0
votes
1answer
33 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
6
votes
1answer
865 views

Is it a bad idea to stop unnecessary services running

I have a debian dedicated server. I'm trying to secure it and one way I thought would be good is to shut down services I dont need, like FTP for example. I am suggesting to run something like this on ...
2
votes
1answer
139 views

Need recommendations on Firewalled DMZ design for PHP web server on Linux

The 3 options we are considering are listed below. Which one is best or is there a better solution we didn't consider. All servers are linux with nginx. Do you see anything particularly wrong with ...
1
vote
1answer
174 views

Is setting a Content Security Policy incompatible with Joomla's admin page?

I'd like to set a content security policy header for a Joomla website running on Apache 2.4. Using this configuration from h5bp and setting Header set Content-Security-Policy "script-src 'self'; ...
1
vote
1answer
36 views

Single row user security in MS SQL 2008 R2

I have a SQL Server 2008R2 question regarding making a single row in an odd way. situation: I have a student records database in which ~ 100 students might in-process in a given day. They enter a ...
3
votes
2answers
73 views

Can't seem to disable root login [duplicate]

I am trying to disable root password login and only allow root login with a ssh key on debian 7. cat << EOF >> /etc/ssh/sshd_config PasswordAuthentication yes UsePAM no PermitRootLogin ...
1
vote
0answers
56 views

Configurable ftp-proxy with LDAP authentication

I am looking for solution for following situation. I have bunch of ftp account (many servers) and many users. They need access to that servers. I don't want to give every user passwords to every ...
0
votes
1answer
45 views

Https transparent proxy and SSL certificate validation

If I setup a transparent proxy for https connections using a SSL certificate signed by my local CA and distributed to all my active directory clients by GPO, may the client (browsers) reject or advise ...
0
votes
0answers
18 views

How do I edit a signed or encrypted SMIME message to include a footer?

Is there any way to edit a signed/encrypted SMIME message so that there is a legal disclaimer on the message? I'm thinking about the MIME multipart email directive may allow for this.
0
votes
1answer
34 views

Move a Sftp User in a Subdirectory of his Jail

I've a question concerning the Jail explained later: User to be jailed: foo Jail Directory: /mnt/foo-jail Home directory of foo: /mnt/foo-jail/foo-home Everything is ok. Jail is up and the user is ...
1
vote
2answers
69 views

How to store admin passwords in a way that can be accessed by multiple admins? [closed]

How to store all the admin passwords for routers, servers, desktop computers in the network if they need to be accessible by multiple admins? There are so many that they can't be memorised and they ...
-2
votes
1answer
35 views

DNS ATTACK \/ or some kind of an error, i don't know

I am getting those errors in my CSF firewall, I would like to know how can I stop it. is it type of an attack? also if it is, how can I stop it? Mar 11 22:48:57 root named[7598]: client ...
2
votes
1answer
43 views

Catch incoming email and then deliver to original recipient on sendmail

in the company I work for there are a user that is making bad use of the email, but to have evidence of what he is doing we need to intercept all the incoming email to him and all outgoing email from ...
1
vote
0answers
59 views

How to copy locked swap files in ESXi?

Based on this question : How to disable swap files in ESXi?. The main answer states that it is possible to extract data from the swap files (for exemple using strings) so I tried to make a simple ...
1
vote
1answer
38 views

How to implement table security without SUPER privilege?

A MAJOR provider of cloud-based MySQL does not grant the SUPER privilege to the master user. The provider is Amazon RDS, but my question isn't about Amazon RDS specifically, it's for the general case ...
13
votes
1answer
302 views

What is the Rowhammer DRAM bug and how should I treat it?

DRAM chips are very tightly packed. Research has shown that neighboring bits can be flipped at random. What is the probability of the bug triggering at random in a server-grade DRAM chip with ECC ...
0
votes
0answers
99 views

Restrict hostapd wireless client from talking to eachother

How can I keep a wireless client of hostapd from talking to a wired client on the same network or another wireless client on the same network? Here's my network topology: [wired client] --> ...
3
votes
3answers
75 views

Why is Android / IE using 3DES when AES is available?

I have a Zimbra installation and want to harden the cipher suites. I disabled some and am quite OK with what is left. The problem now is that the Qualys SSL test shows a lot of clients will use 3DES, ...
1
vote
1answer
50 views

Is using su to drop root in shell scripts a security risk?

When searching for how to drop root permissions in shell scripts, I often see answers using su. However, when you're done using su you can just type logout and be back at the shell of the original ...
1
vote
2answers
88 views

Giving access to multiple users for remote desktop

I have 50+ users whom I want to give remote desktop access to multiple VM machines. Instead of adding each individual user to "Remote desktop users" I created a AD security group & added all the ...
0
votes
1answer
121 views

Blocking SSH Brute force from a HAProxy LB

We're trying to grant access to an internal SSH server using a HAProxy setup on a public DMZ. This works as expected however connections into the server are originated from the HAProxy (tproxy won't ...
0
votes
1answer
44 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
0
votes
1answer
73 views

New User Accounts have “Too Much” privileges Windows 7 Ultimate Edition SP1 x64

I am running Windows 7 Ultimate Edition SP1 x64 (Build 7601) in WORKGROUP mode (Non-NT_Domain, Non ADDS environment). I am the Administrator of these machines and Network. My setup is only a few ...
3
votes
1answer
30 views

Please clarify for me how tcpwrappers works

We've recently gone through a security audit and among several valid and other, quite pointless findings is one that states that tcpwrappers is not disabled. I've never used tcpwrappers so I don't ...
2
votes
2answers
87 views

Windows Server Administration - which services are safe to run internet facing?

Coming from a Linux background and now having to manage some Windows servers (2008R2 & 2012R2) I'm wondering which services are safe to run directly over the internet. The servers are all internet ...
0
votes
1answer
64 views

Recomendations for this mail server setup?

EMAIL SERVER SETUP Hey, its my first time using serverfault but I hope the community can help. I am trying to build a secure email system using Linux, Postfix, Dovecot and MySQL. I have read on ...
-1
votes
1answer
30 views

web application audit task require my remote IP to be allowed on application network firewall [closed]

I want to audit a web application which is hosted on a web server sitting behind a cyberoam firewall. My task is to run a scan from my remote machine which has ISP MTNL broadband. My machine gets a ...
0
votes
1answer
117 views

How do I open specific ports on Linux (an AWS instance of RHEL v. 7)?

I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
0
votes
0answers
49 views

Tracking user activity in openvz container?

I have been trying to figure out a way to track user activity in an openvz container for a long time now (auditd like in KVM's). This is a PCI-DSS requirement. I can't seem to find any good ...
-1
votes
1answer
22 views

Run two mysql process on one data directory

I would like to launch two mysql process on one data directory (/var/lib/mysql) I have two servers, web-01 and web-02 but web-01 locked mysql data directory, and i would like to break this security. ...
2
votes
3answers
177 views

WinRM Publicly Available

I am looking for specific feedback on WinRM. There are ::still:: debates out there about whether or not making RDP publicly available without a VPN is a good idea--There are no debates on whether or ...
0
votes
1answer
26 views

WRT160NL Linksys Cisco Wifi router

There is a WRT160NL Cisco Wifi router, and has to decrease the wifi range, so it cannot go outside of the office. I tried to find this settings on the admin page, but I have not found yet. Does ...
3
votes
1answer
55 views

Need advices on iptables

Helly guys ! :-) . I need a (several?) advice(s) from you about my iptables setup. I'm pretty new to iptables, and this is the first time I configure a server with iptables ONLY as a firewall (we ...
2
votes
1answer
1k views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
0
votes
2answers
65 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
90 views

how do I set restrict anonymous to 2

I want to change the registry setting for restrictanonymous to "2" (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous). I created a script to do this but noticed the setting kept on going ...
0
votes
0answers
58 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
0
votes
4answers
602 views

Permissions set to 555. How can another user modify the files? [duplicate]

I run an Ubuntu 12.04 x64 VPS with Vesta, and a site in PHP. It has been hacked several times with injected code that looks like this: <?php ...
5
votes
3answers
578 views

Fixing the IIS tilde vulnerability

One of our IIS servers (IIS 7.5, Server 2008 R2) is apparently "vulnerable" to the tilde Short Filename disclosure issue. However, I'm having a hard time actually fixing the issue. So far, I've ...
1
vote
1answer
303 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
0
votes
1answer
237 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
0
votes
1answer
30 views

How to I assign OWNER RIGHTS permissions to a file in Windows 7?

When I run ICACLS on a file, it returned: foobar.LDF OWNER RIGHTS:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) What securityid do I pass to icacls to assign to the generic user ...
0
votes
1answer
123 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
0
votes
0answers
18 views

give serverprincipalname read write permissions to security group members

What are the settings for the group to make the following change? I need to create a group that can be used to grant: serviceprincipalname SELF Read serviceprincipalname SELF Write to its members. ...
2
votes
1answer
53 views

Use VPS provider's kernel or maintain my own?

I've got a Debian Wheezy VM on Linode and they run it with their own kernel. As a reputable company, I'm sure they're quick to apply security patches, and all I need to do is reboot to get the new ...