Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
47 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
57 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
0answers
54 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They ...
0
votes
0answers
44 views

How to limit user permissions

I have 2 servers, one web server and one SQL Server. All Windows. Both servers have the same account created with the same password and IIS and SQL Server are configured to use those accounts. I also ...
0
votes
0answers
31 views

IIS to SQL Server IPSec configuration

I'm trying to configure 2 servers on a VPC on Amazon AWS to use IPSec. One server has Win2008 R2 with SQL Server 2008 and the other one is a Win 2012 R2 with IIS. I want to secure the connection ...
0
votes
0answers
129 views

Missing Secure Flag & HttpOnly Flag From Exchange 2013 OWA

I have got a request from one of my clients asking me to add the following flag to OWA's web.config file but I am unable to find the whole flag in the first place. I guess the flag exists in ...
0
votes
0answers
16 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run ...
0
votes
0answers
53 views

Prevent my website from being displayed under foreign domains

I'm not sure what's happening but i've just found, that someone has registered domain name *-auth.ga that displays my website. I'm not sure how can i block that kind of issue, i don't just want to ban ...
0
votes
0answers
23 views

If cron as www-data/apache user have security issue?

Last year I checkout a server where I found some exploit bash script in /tmp folder which download a binary file from 3rd party server. When I further checked it, I found apache user's cron entry for ...
0
votes
0answers
30 views

Securing ports on Linux with multi-factor authentication

I have dedicated Ubuntu server in the Internet so I want to: Connect to my server via HTTP(s) Input password and MFA token (i.e. Google Authenticator token) If both are correct, server executes ...
0
votes
0answers
39 views

Power User with Elevated Access on Domain Network

We have new IT Helpdesk staff joined our firm and we'd like to provide them with an account with power user privileges in such they can only elevate access on user computers to install, uninstall ...
0
votes
0answers
285 views

How to install a strong ephemeral Diffie-Hellman public key on windows server 2008 r2?

I have a server running windows server 2008 R2, which sits on my LAN. I'm a programmer rather than a server administrator, so I don't know how make the security on the server stronger. When I ...
0
votes
0answers
52 views

Secure settings for an upload directory

I have a website running on Ruby on Rails + Nginx and I let my users upload files. I don't want to limit the file format they can upload and instead I want to make sure that the directory/folder ...
0
votes
0answers
11 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
0
votes
0answers
25 views

Something like WSUS but for Cisco routers?

A Windows Update Server will automatically download Windows updates/patches to a central repository and then the admin can pick and choose which patches to push out to Windows servers. Is there a ...
0
votes
0answers
18 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
0
votes
0answers
17 views

Odd PUT requests in apache logs

I got a few domains hosted from an Apache server. I've had this setup for a while without much problems. However, since about a week I've began to receive strange PUT requests for one of the domains: ...
0
votes
0answers
21 views

What are the security risks when modifying nsswitch.conf?

I have to add a sss data source in /etc/nsswitch.conf for authentication of non-local users for certain databases (e.g. passwd, shadow). Basically, the nsswitch.conf will have lines such as: passwd: ...
0
votes
0answers
270 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
0
votes
0answers
100 views

olcRequires: difference between authz and bind (with olcDisallows: bind_anon)?

With OpenLDAP, what is the difference between: olcDisallows: bind_anon oldRequires: bind and: olcRequires: authc It seems to me that both configurations would require the client to authenticate ...
0
votes
0answers
53 views

Why do I always get 401 when trying to access main folder of web site?

I am trying to set up a web site on Windows Server 2008 using IIS 7.5. I have created a new application pool (TestAppPool) and a new web site at c:\inetpub\wwwroot\test. I have given the Read/Execute ...
0
votes
0answers
54 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
0
votes
0answers
150 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
0
votes
0answers
221 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
96 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
0
votes
0answers
1k views

sysctl: cannot stat /proc/sys/kernel/exec-shield: No such file or directory

Enable ExecShield protection - ExecShield is security Linux kernel patch to avoid worms and other problems. After Adding to /etc/sysctl kernel.exec-shield = 1 Getting this error sysctl: cannot ...
0
votes
0answers
99 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
0
votes
0answers
67 views

SSHFS mount with sudo - how to restrict privileges?

I need to mount a remote server (server1) with an SSHFS mount on server2 via an automated script. I need to be able to access some files on server1 that require root access, but I don't want to enable ...
0
votes
0answers
31 views

libvirt: can it provision network interfaces where the network backend is running in a domU rather than dom0?

Thanks to a great blog post, only slightly out of date [1] I've managed to configure a dom0 which has no networking at all: physical network interfaces are passed through to dedicated domU guests ...
0
votes
0answers
48 views

PHP allow_url_fopen seciurity risks

There is theory (among some admins) that allow_url_fopen will put your server at risk because you can include external scripts (prior to PHP 5.2.0). Since PHP 5.2 there is different option ...
0
votes
0answers
45 views

How to prevent Apache from serving files owned by root?

I run multiple websites on a server using vhosts. I want to configure Apache to just serve files owned by the apache user. Also, only those files should be interpreted by PHP. How can set this ...
0
votes
0answers
73 views

Website randomly not load some files

I have a single page web application who has recent HTML, JavaScript and CSS that interact with very old Classic ASP pages called using AJAX. In localhost all is working good, on the other hand in the ...
0
votes
0answers
158 views

Amazon EC2 Abuse Report - SQL Injection Attempts

I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses. Just ...
0
votes
0answers
19 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
0
votes
0answers
17 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
316 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
0
votes
0answers
678 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
0answers
58 views

Tracing namespace mining culprit

I have a Centos 6x box with these installed: CXS + CSF + LFD. I'm trying to figure out how to effectively trace what MS is claiming namespace mining on my IP. From Microsoft: We have completed ...
0
votes
0answers
61 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...
0
votes
0answers
221 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
0
votes
0answers
43 views

Security implications of wide WAN subnet

I have a server at OVH and say my public IP adress is xx.xx.xx.81 and the gateway is at xx.xx.xx.254. To reach the gateway, I need pfSense to be configured static WAN IP with xx.xx.xx.81/24, i.e. the ...
0
votes
0answers
72 views

Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy

I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
0
votes
0answers
100 views

How to set relaxed security for Terminal Services on 2008 R2

I installed Remote Desktop Services on Windows 2008 Server R2. I am trying to set it up with 'Relaxed Security' similar to Windows 2003 would have. Windows 2003 Server, I would set up: Permission ...
0
votes
0answers
41 views

Is it possible to break out of a “trap 1 2 3” secured terminal session by using SIGSEGV?

The title says it mostly. I'm auditing the security of a terminal-based application on AIX, and the way you use it is to connect to it remotely through telnet, where the ".profile" of the telnet user ...
0
votes
0answers
15 views

Securing web application used for core business process

I am writing an application which will be used for our core business workflows (client registration and management etc). I have partners and employees who are spread across the globe, so I want to ...
0
votes
0answers
124 views

Docker non-root secure?

If I set up a Docker container on an Ubuntu server, and then let it run arbitrary/untrusted code like uploaded PHP, Python etc. as a NON-ROOT user. Is this totally contained and secure by ...
0
votes
0answers
439 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...
0
votes
0answers
813 views

Enabling the Internet Connection on an EC2 Windows Server 2012 Machine

I've disabled the firewall: netsh firewall set opmode disable I've made sure to accept all inbound and all outbound connections: Is there anything that I should be installing or adding on to the ...
0
votes
0answers
152 views

Remove mapping drives from RDP to user from exteral network

I would like to know if you guys have a solution to my problem. I have a terminal server 2012 that can be accessed remotely after a VPN connection and from the LAN. My question is how can I create a ...
0
votes
0answers
148 views

Lock Down Users on Cygwin SFTP Server

How do I lock down sftp users in Cygwin so that they can't read from random directories such as /etc. i set up local windows accounts for each sftp user on the machine. I've used /etc/fstab file to ...