Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
47 views

Replacing a super user by many finer grained users (security)

I find myself in the situation where I have a super user account that can basically do everything in the domain and is set to run scheduled tasks, windows services and websites. I have inherited this ...
0
votes
0answers
52 views

Wordpress + nginx (post compromise), best way to block POST request for random php script?

Due to an outdated plugin, one of the domains that I host on my VPS was compromised and there were bots POSTing to //listTT9.php in order to send mail. The plugin was updated, I've gone through all ...
9
votes
1answer
128 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
2
votes
2answers
180 views

Designing a computer network of > 100 devices, dividing server responsibilities

I am designing a computer network for a public high school and came up with the following division of responsibilities between the servers: In the LAN: Active Directory Domain Controller. The DC ...
-5
votes
1answer
64 views

Is Google App Engine secure enough for financial applications? [closed]

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...
-1
votes
1answer
52 views

Security Recommendation [closed]

We have bunch of linux servers dedicated to do some tasks. Periodically we need to run certain commands which requires root access. So we have developed a web panel from which these administration ...
0
votes
2answers
37 views

If a web root directory has a simlink that points to a folder one-level up, does that pose a security risk?

Assuming a Linux/Unix system. Not asking about any particular server software, just wondering in general. I want to use this to include javascript libraries or things like that in multiple sites or ...
1
vote
1answer
270 views

Windows Server 2012 R2: closing smtp/pop3/imap ports (or deactivating the related services)

I am running a Windows Server 2012 R2. At the moment, I want to improve the security of my server, so I am looking for services (and open ports), that are not needed. I disabled nearly every server ...
0
votes
0answers
155 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
21
votes
8answers
4k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
0
votes
1answer
87 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
1
vote
2answers
54 views

FTP Multi User Environment doesn't allow multiple logins

I think ths is a general question but I'm not sure if it needs to be migrated because of the technical and security related nature of the beast in question. For my current client we have an SFTP key ...
3
votes
1answer
438 views

802.1x certificates, EAP-TLS, RADIUS and Windows machines

When using 802.1x certificate-based authentication on Windows machines, should I use different certificate for each machine? There is RADIUS server running in the network, the machines use EAP-TLS to ...
4
votes
4answers
757 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
0
votes
1answer
23 views

How to setup a platform with TPM? [closed]

I am trying to learn about TPMs. I would like a machine with a TPM. I understand that this is a chip on the motherboard? Is a TPM something that you can install or is it something that comes soldered ...
1
vote
0answers
131 views

permissions for VBScript/ADSI remote local account password change

I am using the IISADMPWD pages on IIS8/Windows 2012 and have found that administrative rights on a remote server for password changes is not required. I am hoping somebody can shed some light as to ...
0
votes
1answer
128 views

Unable to install Network Deployment Enrollment Services (NDES)

I'm trying to install NDES on a Win2k8 R2 server, but I can't see the option. I've already added a user to IIS_IUSRS, and that user as sufficient priveleges since it is a part of the Administrator ...
0
votes
2answers
75 views

Should munin be password-protected?

We use Munin at work. There is a Munin install - which right now is open to the world. An admin doesn't think he needs to password-protect it. What's the worst that can happen? How can I convince ...
-1
votes
2answers
56 views

Security in users having sudo access

How to protect my passwords list (in different databases for example) in a UNIX environment where most of the users have sudo access to other user IDs? I have a script (main.sh) with the following ...
1
vote
0answers
46 views

What are the mathematical implications of an overly-restrictive password policy? [closed]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
0
votes
1answer
58 views

How to autoban IPs that request URLs with a .php extension?

I've noticed in my linux/apache server logs that bot computers running muieblackcat are periodically trying to access all forms of phpmyadmin.php on my server. It's interesting, because I have a ...
-1
votes
1answer
249 views

RKHunter reported processes that are using deleted files or are listening on the network

I ran Rootkit Hunter 1.4.0 on a Debian Wheezy server and I am confused by the output. I enabled every tests using the following piece of configuration: ENABLE_TESTS="all" DISABLE_TESTS="none" The ...
0
votes
1answer
31 views

Protection of a dns server

I recently started to host my own domains on my servers. I can already see a fair bit of bogus queries arriving to my servers. Some dns amplification attacks, etc. What can I do in order to further ...
0
votes
1answer
29 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
2
votes
2answers
114 views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
1
vote
1answer
89 views

Correct Permissions VPS /var/www

This is a repost of an "off-topic" question on stackoverflow. My scenario is: I created a user and added that user to sudoers: visudo user ALL=(ALL) ALL Then sudo adduser user www-data and ...
-2
votes
2answers
55 views

Monitor Server Logins / SSH Access? [closed]

I seem to have some suspicious activity happening on my server from time to time. Aside from changing passwords regularly, I would like to be emailed ( or logged ) each time a user accesses my ...
-5
votes
1answer
75 views

Does a tool like ansible make it possibly to get a secure server, without knowing a lot about security? [closed]

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure? sovereign: A set ...
-1
votes
2answers
81 views

Windows 2003 Server Blocking .exe files [closed]

I have built 2 x windows 2003 r2 servers, during the teaming of two nics, the nics would not team correctly due to an issue with the switch I was connected to, only one nic would work, the second was ...
4
votes
7answers
1k views

will hosting provider have access to my dedicated server?

I am looking to buy a dedicated server for my web application.But I am concerned about security to my application code and who can access to my server even dedicated server.As hosting provider ...
1
vote
3answers
145 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
1
vote
1answer
118 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
2
votes
1answer
58 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
1
vote
1answer
126 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
1
vote
0answers
170 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
77 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
-1
votes
1answer
56 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
0answers
114 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
0
votes
1answer
30 views

How to enable auditing for a folder only (and not anything within that folder)

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains. I tried going to Properties > ...
1
vote
2answers
282 views

Why can nginx access /etc/passwd? [closed]

I'm trying to setup my new VPS with my couple sites. nginx, php-fpm and other needed services installed. I setup a nginx server block(virtual hosts) for my site, and then try to create a php file ...
1
vote
1answer
67 views

Another domain points to my webserver

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD. My domain foo.bar -> my ip address 1.2.3.4 Somebody defined: suspiciousdomain.ma -> my ip address 1.2.3.4 So ...
6
votes
1answer
116 views

RHEL6 Keeping 1 old kernel and security

I have my RHEL 5&6 servers set to keep 1 old kernel after updates, I do this in case I need to recover the system for any number of reasons. My question is related to security of the system when ...
1
vote
1answer
74 views

Someone tried to access a list of hundreds of standard website urls in a go, is it a cause of concern [duplicate]

I was just checking my website logs today and found that someone accessed my website for a list of hundreds of standard urls that almost every 3rd or 4th website developed on a standard platform ...
0
votes
1answer
27 views

Linux package management and security flaws

Is there a mechanism built into rpm or apt that will warn (or prevent) a user from installing a package contains a known security threat? I'm thinking of an RPM like ...
0
votes
0answers
57 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
2
votes
2answers
658 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
669 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
11
votes
1answer
303 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
0
votes
1answer
115 views

How to check if an apt mirror has the version of package I required?

Let say I want to query if openssl, 1.0.1-4ubuntu5.12 is available in the mirror, e.g. deb http://security.ubuntu.com/ubuntu precise-security main restricted Any easy command I can check?