Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
58 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
-6
votes
1answer
69 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
0
votes
0answers
57 views

IIS App cannot write to network share on a 2012 server, fine on a 2008 server

I have a Windows 2008 R2 web server running IIS, and the app needs to write files to a folder. None of the machines are on a domain, just a local workgroup. The app pool is running as the user ...
0
votes
1answer
32 views

Modify the Windows failed logon message

Is there a way to modify the message that the user sees following the entry of an insecure password, whilst changing/resetting their password, on Windows 7 / 2008 Server machines? Basically, the ...
2
votes
1answer
325 views

Host Header Attack with reverse proxies

So I was tasked with researching a problem that was identified by an Acunetix web security scan. Here are the details about the scan: Host_header_attack Automated Detection of Host Header Attacks I ...
1
vote
2answers
39 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
1answer
51 views

Block file browsing on Windows Explorer

I have a Citrix application that open Windows Explorer from a menu. The command invoked to open Explorer is: Explorer "g:\app\folder" What happens when Explorer is opened is that it shows a window ...
-1
votes
1answer
40 views

Un-Noticed Vulnerability, I need to know if i should do anything

Possible Web-Site Vulnerability. I'm not sure if this is the right place to ask this, but I am running my own website, that is still currently being developed, but since it is 'Open as Beta' it is ...
1
vote
2answers
133 views

Copying data between AWS EC2 machines

There are times where, in order to do some debugging or perhaps a manual migration, I need to copy large chunks of data from one EC2 instance to another. When the size of the data is tiny, it's simple ...
0
votes
1answer
35 views

Safest way to allow a user to write in www directory?

I mean allowing a user to modify the web files in the server. Should I change the ownership of the www directory to a certain user, or put it in a new group and give write permission, or something ...
1
vote
0answers
26 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
1answer
47 views

How can a PC be protected from malware without locally installed software?

I'm looking to find a way to protect PCs, without requiring locally installed software. I thought about a device such as a Watchguard that has UTM facilities and make it a transparent proxy, in ...
1
vote
1answer
82 views

HP ProCurve Vlan Isolation

Okay, so we have an HP ProCurve Switch 2824, a Zyxel router and a bunch of 2012 R2 servers. We currently have 3 VLANs in our network: 10(Public),20(Private) and 30(Management), but we'd like to have ...
2
votes
0answers
82 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
-4
votes
1answer
45 views

Is 10 character (letters and numbers mixed) password strong enough for Internet Servers? [closed]

Assuming ssh brute force attacks. Assuming the following IPTABLES configuration: DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 120 ...
0
votes
1answer
81 views

Linux glibc versions 2.18 and older - vulnerability

Server: Red Hat Enterprise Linux Server release 5.9 (Tikanga) I came to know that Linux GNU C Library (glibc) versions prior to 2.18 are vulnerable to remote code execution via a vulnerability in the ...
2
votes
1answer
36 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
2
votes
8answers
3k views

No success when trying to upgrade glibc on RHEL4 due to GHOST

Due to the recent GHOST vulnerability I was trying to upgrade the glibc version on our RHEL4. The command I tried using was: rpm -Uvh glibc-2.3.4-2.57.x86_64.rpm Result was: [root@rhel4-test ~]# ...
0
votes
1answer
49 views

Configure account event auditing with Secedit

I'm currently putting together a number of PS scripts which can be run against a new webserver in order to harden it prior to it being placed in production. One of these scripts will launch secedit ...
-1
votes
2answers
75 views

Open port to only one external IP address

I am having trouble with unwanted traffic on a certain open port and want to lock the open port so it only allows incoming traffic from One single external IP address. I have had a Google and cant ...
2
votes
2answers
77 views

Windows UAC disabled but I'm still getting the elevation pop-up

I have UAC disabled on my Windows 2008R2. Why am I still getting UAC "Windows needs your permission to continue" window before trying to change Owner of a folder? My user is a member of the ...
1
vote
1answer
274 views

Allowing Internet traffic into DMZ using Azure Network Security Group

I am trying to create a simple DMZ using Azure Network Security Groups, using a Barracuda WAF as the public entrypoint into the DMZ, however I am having some trouble allowing internet traffic to ...
0
votes
0answers
32 views

Debian server hacked - root login on /dev/tty1 - therebel exploit [duplicate]

I have a test server running Debian Wheezy (Kernel 3.2.0-4-amd64) and OwnCloud 7. It is a virtual machine hosted on a Debian Wheezy kvm Server. It uses an own IP address configured via br0. I made ...
0
votes
1answer
46 views

How to lower security level of IE on Win 2008R2 to allow product register?

There is IE 11 installed on Win2008R2 server. After installing a Visual studio express, we are asked to register the software. A user account was created on outlook.com. However after entering login ...
1
vote
1answer
77 views

How can I avoid passwords

I'm the default IT guy at a small family business. We have 5-10 employees that only work at the office for about half the year. Because of this, it's a pain to have unique passwords - so people seem ...
3
votes
4answers
1k views

Am I at risk by leaving a test FTP account available on the server?

I have two Filezilla server instances on different WAN connections, both mapping to the same /test directory on the file server. To validate that clients have connectivity I have a read/list only ...
0
votes
1answer
26 views

VBulletin 3.6, disable “Invalid SQL” errors

VBulletin likes to dump SQL query and database metadata in case of query-error. I do not find it entertaining from security point of view. Is there a way to disable this and just show "something went ...
1
vote
1answer
34 views

How often does an SSAE 16 audit have to be performed in order to be good enough for HIPPA compliance

I need to find a dedicated hosting service that has (among other things) passed SSAE 16 audit. I found one that had the audit performed between 1/1/2013 and 6/1/2013. Should that be considered current ...
0
votes
1answer
19 views

vSphere-created node complaining about ECDSA fingerprint?

I just cloned an Ubuntu template in vSphere Client, just like I've done hundreds of times before. It didn't give me any errors, however when I went to SSH into this server to test it, I get the ...
4
votes
2answers
209 views

Should I need to provide a root certificate when setting SSL cert on nginx

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed. However, from Comodo website, their guide on installing cert on nginx is NGINX Needed for ...
1
vote
1answer
27 views

Does it make sense to remove NFS from a simple web server?

Does it make sense security- and performance-wise to remove NFS on a simple server which has ~10 Wordpress websites? Or is simply stopping the services enough?
1
vote
1answer
73 views

ACS - Where to find Audit Logs

I think i got the Audit Collection service working. Where do I see the Audit Logs from my Managed Agents? I looked in my Operations Manger Console: Monitoring - Microsoft Audit Collection Services - ...
0
votes
0answers
65 views

Docker non-root secure?

If I set up a Docker container on an Ubuntu server, and then let it run arbitrary/untrusted code like uploaded PHP, Python etc. as a NON-ROOT user. Is this totally contained and secure by ...
0
votes
1answer
84 views

Strange TCP Flood / Flood from Port 445

Good Evening. Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump: 23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length ...
0
votes
1answer
16 views

Viewing older entries for lastb on linux

I have a server (Amazon Linux) that has been up for 261 days: [server]$ uptime 16:29:46 up 261 days, 4:47, 1 user, load average: 0.05, 0.16, 0.18 I am trying to find out if there have been any ...
0
votes
0answers
22 views

SQL 2012 IPSec or SSL

I have a requirement to secure connections to SQL server. (at transit that is) - TDE will be used for encryption at rest. SQL provides two options which are either certificate based SSL or Windows ...
2
votes
1answer
156 views

Is default Apache version in Ubuntu 14.04 secure?

I have installed apache on ubuntu server 14.04 using apt-get. I set up a simple site, uploaded a few pictures etc, the website is working. I've decided to take a look at security of the thing using ...
0
votes
1answer
1k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
-1
votes
2answers
60 views

Can one domain have 2 or more SSL certificates?

I have googled and found this post: http://security.stackexchange.com/questions/46988/is-it-technically-possible-to-configure-two-different-ssl-certificates-for-the-s If it actually is possible, then ...
4
votes
1answer
223 views

Sendmail - Is it secure, and really essential?

I have a web application server running Ubuntu. The Application is built in Python/Django, but does not have any specific use cases to send email. We have log management software that allows us to ...
0
votes
2answers
51 views

is there a way from iptables/iproute to forward all traffic to my IDS and also keep the regular flow

The reason of this, is that to catch all packages into my IDS keeping my existing enviroment, so the IDS does not become a single point of failure. If route all my traffic into my IDS and from my IDS ...
4
votes
2answers
1k views

Which CentOS Version Should I Use?

I have some used rackmount servers (Dell R610, HP DL180 G6, HP DL360 G5) that I intend to use for on demand video streaming in a colocation environment. I would like to have them all on the same OS to ...
1
vote
1answer
210 views

security group rules between EC2-classic and VPC server

We are currently using a set of Amazon EC2-classic servers for hosting our live and staging environments. We've got a couple of web servers and a background worker server in each environment. We've ...
3
votes
2answers
53 views

Docker remote access security

Assuming I am running several docker containers on a local server. When I give third parties ssh access to my server, any third party will have control over the docker manager. How can I make sure ...
0
votes
1answer
73 views

Information regarding netstat output

On netstat, I see my port 22 in connection with 122.225.97.99. Does this mean someone is accessing ssh .. OR is it just something related to ubuntu user@ubuntu:~$ netstat -ntu Active Internet ...
2
votes
2answers
883 views

Encrypting SMB traffic with Samba

We use Samba on Ubuntu 14.04 LTS as a PDC (primary domain controller) with roaming profiles. Everything works fine, except for if we try to enforce encryption via setting: server signing = ...
0
votes
1answer
44 views

Secure Database Password Contained Inside a File

I've got a Linux based application (Java) that connects to an external database (PostgreSQL) in the same LAN. However, due the sensitiveness of the database contents I would like to avoid the admins ...
-1
votes
1answer
50 views

How to load sites from your own server as localhost (ssh tunnel trickery)

I want to load a site from my server as if I'm on the server as localhost. Because some areas are restricted to localhost on a purpose. Now normal ssh tunnel like ssh -L 8080:localhost:80 ...
0
votes
1answer
317 views

Getting lots of traffic from russia to an unpublished site

I am currently building a website. Currently nobody knows about it but it is already reachable for testing purposes. Now I saw, that I get a lot of traffic from russia (Its a german website hosted on ...
12
votes
1answer
417 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...