Security is not a product, but a process.

learn more… | top users | synonyms (1)

7
votes
1answer
175 views

Managing IAM security credentials for multiple docker containers

Within plain EC2 environment, managing access to other AWS resources is fairly straightforward with IAM roles and credentials (automatically fetched from instance metadata). Even easier with ...
6
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
3
votes
1answer
394 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
3
votes
1answer
867 views

IE8 HTTPs Download Issue

I have a problem with a system I develop related to IE8 downloading over SSL (ie on sites using https://...) and is described on this MS kb article. We use the HTTPCacheability.NoCache option as the ...
3
votes
1answer
514 views

Is Exchange protected from/allow back dated emails?

Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
3
votes
1answer
228 views

Grsecurity's RBAC policy for scripts

I have some problems with set right policy for my gentoo-based system. I have no idea how can I add permissions for everything which was started by /root/scripts/autosync. I am getting error like: ...
0
votes
0answers
76 views

Apache2 + Chroot + PHP global prepend

I have a Debian Wheezy server with PHP 5.4 and Apache 2.4 . I have following problem: User A has home dir /home/user_a with public directory /home/user_a/public_html User B has home dir ...
0
votes
0answers
116 views

Intermittent SSH problems with a specific server from a specific Wifi router

I've been ssh'ing into a specific server from my home office via Wifi and Time Warner Cable internet for years with no problem. In recent months, I started having problems, where I'd be unable to ...
0
votes
0answers
26 views

Mysterious http Lp requests found in log

I've noticed the following in my access log: Oct 28 20:01:55 vm1295 nginx: [] 89.109.42.242 400 "Lp" "-" Oct 28 20:58:41 vm1295 nginx: [] 82.208.124.184 400 "Lp" "-" Oct 28 21:14:05 vm1295 nginx: [] ...
0
votes
0answers
9 views

Create a persistent mapping for a apppool identity

Can I create a persistent mapping for a apppool identity? For instance the IIS website "www.example.net" should access "\10.10.10.222\shared$" through F: My Website is MVC(5) so I think the ...
0
votes
0answers
25 views

How do I block all requests by default in vhost configuration?

I am setting up a site using standard apache vhost but I have multiple domains pointed at the server. I know the first vhost catches all the other names even if they are not listed under the vhost. ...
0
votes
0answers
64 views

Apache HTTP server STIG rule

I am new to setting up Apache HTTP and have to STIG the Apache HTTP 2.2 I have running. (http://iase.disa.mil/stigs/app-security/web-servers/Pages/index.aspx). For one of the rules it says the ...
0
votes
0answers
74 views

do automatic updates (unattended-upgrades) still work with third party repository?

If I install nginx from the nginx repository by appending the following to the end of the /etc/apt/sources.list file: deb http://nginx.org/packages/mainline/debian/ trusty nginx deb-src ...
0
votes
0answers
72 views

how to run a web app: users/groups to use for each component?

How do you organize your users/groups to run the different components of your web app? Any best practices? The answer of this question (What permissions should my website files/folders have on a ...
0
votes
0answers
41 views

Check Unix Credentials on Apache Server Web App

I am building a number of web apps served by apache for internal use and I really want to have them use unix credentials for access. I know a few ways I could do this but all of them seems to expose ...
0
votes
0answers
85 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
0
votes
0answers
73 views

Failed logons not being audited Server 2008r2

We recently configured advanced auditing on our Windows Server 2008 R2 domain and now the domain controller is not displaying failed user login attempts. There are some 4625 login failures, but none ...
0
votes
0answers
108 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
0answers
59 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
0answers
573 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
0
votes
0answers
55 views

RHEL 5 with PHP 5.1.6 VS RHEL 6 with PHP 5.3.3: Security implications

Using only the RHEL Repositories, RHEL 5 considers PHP 5.1.6 to be up to date, and RHEL 6 considers PHP 5.3.3 to be up to date. My question is: Are security updates/patches backported so that 5.1.6 ...
0
votes
0answers
54 views

Restrictions for remote Vmware View users

We have a Vmware View VDI infrastructure with several thousands of users that can log on from the internal network and from Internet thru a VMware View Security Server. We want to restrict ...
0
votes
0answers
232 views

Cloudfront - How to invalidate objects in a distribution that was transformed from secured to public?

The setting I have an Amazon Cloudfront distribution that was originally set as secured. Objects in this distribution required a URL signing. For example, a valid URL used to be of the following ...
0
votes
0answers
174 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
0
votes
0answers
197 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
0
votes
0answers
48 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
0answers
241 views

How do you stop tomcat after changing the shutdown word in server.xml?

Running tomcat-7.0.33 on CentOS. I have a security requirement to change the tomcat shutdown word in server.xml to a random string of characters, so I need to go from this: <Server port="8005" ...
0
votes
0answers
2k views

you must have read permissions to view the properties of this object, administrators group

I think I'm having some difficulty understanding NTFS permissions. My understanding is that when possible you want to avoid assigning a specific user account to NTFS and instead use a group. So I set ...
0
votes
0answers
56 views

domain admin account unable to modify IE settings, other DOMadmin group accounts can

When I log into one of the servers on our domain as DOMAIN\administrator, IE settings are locked, and indicate that I'll have to check with the system administrator. If I log into the same server ...
0
votes
0answers
107 views

UNC shared path not accessible though necessary permissions are set

I have 2 environments A and B. A is an original environment whereas B is a clone of A, exactly except AD servers. AD server of B has been assigned a trust relationship with A, so that all the service ...
0
votes
0answers
208 views

Red Hat 6.5 - Login Errors After Security Hardening

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server: To configure the system to lock out accounts after a ...
0
votes
0answers
71 views

Which modules can be disabled in apache2.4 on windows

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely ...
0
votes
0answers
102 views

Wordpress + nginx (post compromise), best way to block POST request for random php script?

Due to an outdated plugin, one of the domains that I host on my VPS was compromised and there were bots POSTing to //listTT9.php in order to send mail. The plugin was updated, I've gone through all ...
0
votes
0answers
951 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
0
votes
0answers
260 views

Tracert of a spoofed IP results in Infinite Loop

Our firewall picked up a spoofed IP address that caught my attention. When I did a tracert to the spoofed IP address I get what I think is an odd response. Tracing route to 192.168.1.7 1 1 ms ...
0
votes
0answers
534 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
0
votes
0answers
366 views

mysqldump over ssh and mysql restore - security issue?

I've just found a one liner to mirror a local mysql database on a remote server, over ssh: mysqldump -uroot -proot zedatabase | ssh -p4551 geek@12.34.56.78 "mysql -udoom -pmySqlPassword zedatabase" ...
0
votes
0answers
58 views

Malicious Resources on Linux Server?

When creating a website, I often include custom fonts (which I upload via FTP and reference via CSS). I get these font files from various locations on the web. I was wondering: is it possible for a ...
0
votes
0answers
168 views

Apache2 mod_dav_svn SVNListParentPath dependent on cilent IP / subnet?

Hopefully a simple question. Given the following Apache 2.2 VirtualHost configuration on a local network server with access from the local network and the internet: <VirtualHost *:80> ...
0
votes
0answers
60 views

visudo passes syntax check but the file fails when put into place

I've been trying to create a modified sudoers file in /etc/sudoers.d/ but am having trouble. visudo -cf /file/path shows no syntax issues, but when i mv /tmp/sudoers/ /etc/sudoers.d/sudoers sudo ...
0
votes
0answers
243 views

nginx hidden file deny configuration?

I am using the below standard config to block download of hidden files from nginx : #Prevent (deny) Access to Hidden Files with Nginx location ~ /\. { access_log off; ...
0
votes
0answers
285 views

Remove information revealed in packet inspection

I did a security scan of my server and got the following message: This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are ...
0
votes
0answers
38 views

Securing files on IIS 7 and Windows Server 2008 Server

What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server? I have the following requirements and ideas: Requirements: A authenticated user to my web app ...
0
votes
0answers
47 views

Cannot Connect to Windows Server Using a Particular IP

We have a Windows server 2008 running as web server. The Server has two IP's (A and B) added to it. We were able to use both the IP's for remote desktop connections and FTP connections. Strangely we ...
0
votes
0answers
87 views

Some basic protection for a stream in Adobe Media Server

(I have no prior knowledge of media servers, streams or things related, so sorry if my question is silly.) I'm trying to set up an Adobe Media Server, just for testing purposes. I'm trying to add ...
0
votes
0answers
300 views

User security settings for scheduled task on Windows Server 2008 R2

I have a simple executable to run as a scheduled task on some Windows Server 2008 R2. The executable downloads a file from a couple of locations, then writes the time to download the files to a SQL ...
0
votes
0answers
158 views

Filter rsyslog message by message id?

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work: if $programname == 'Security-Alert' and $msgid == '4624' then ...
0
votes
0answers
52 views

wifi network connection selection restriction

I'm dealing with the following scenario. C1 - computer 1 used for work. Windows 7 with limited user account for worker. R1 -- is wifi router 1. This router is allowed to be accessed by C1. It is ...
-1
votes
0answers
17 views

Can LAN Manager Authentication Level in Group Policy be set differently for a wireless connection?

I seem to be seeing the following behavior and wondering how it is possible: A client machine (external) generally has no trouble connecting to hosts in our RDS-based environment. When the same ...
-2
votes
0answers
11 views

Secure dcom in AWS

We have 2 servers calling each other's services using dcom. These servers are in a single VPC in AWS and pass sensitive data to each other via dcom. We are told all server communications need to be ...