Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
304 views

Metasploit: Module database cache not built yet, using slow search

A fresh metasploit on kalilinux 2016(latest stable) systemctl start postgresql OK On msfconsole msf > db_status [*] postgresql connected to msf When i launch search msf > search samba [!]...
0
votes
0answers
13 views

IIS with PHP reagrding UserRights and security Risks

I'm very new to PHP but famliar with the IIS. Now I Encountered a question which we discussed and I hope someone can point me to some ressources or answer my question. Looking at the current trojan ...
0
votes
0answers
28 views

Windows Server 2008R2 / IIS7.5 / Recommended User and Folder Permissions to host WordPress

I have a Windows Server 2008R2 server running IIS 7.5. I host a number of WordPress sites and they are constantly under attack from hackers / bots. Does anyone out there know the recommended user ...
0
votes
0answers
15 views

What happens using SASL plaintext on an openldap server on the server side?

I have an OpenLDAP server and I use SASL with the login authentication mechanism. My user passwords are securely hashed and stored within my LDAP database. I understand that the login credentials are ...
0
votes
0answers
10 views

Trigger Builds if OS Security Updates are available

In classic non-cloudy server environments, you have a fixed set of servers. If updates were available, you installed them and were done. In cloudy server-environments, you often auto-scale your ...
0
votes
0answers
80 views

Apache with mod_php fpm fastcgi, which is most secure?

I have a web server to install and I would like to have your minds about my choice of using mod_php instead of fastcgi of fpm. On the web server there is only one Drupal website and only one system ...
0
votes
0answers
47 views

ThinkServer x3550 M3: AES-NI disabled?

We are running a x3550 M3 with Ubuntu and we wanted to enable AES-NI functionality. First, we checked whether it was enabled already by executing: # grep aes /proc/cpuinfo However, no aes flags ...
0
votes
0answers
36 views

Which AWS entities may have security group associated?

I'm writing a security audit tool and I would like to see all the services which have particular SG associated. At this point I found out that SG may be associated with: ec2 instance rds instance ...
0
votes
0answers
21 views

Tomcat 7 auth constraint role name active directory

I integrated waffle into my tomcat 7. I need to define the users in the active directory group that can visit the site, web.xml looks like: <security-constraint> <display-name>not ...
0
votes
0answers
52 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
0
votes
0answers
31 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
0
votes
0answers
28 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go wrong?...
0
votes
0answers
38 views

Windows CE lockdown

My company just began purchasing Windows CE 5 & 7 based devices. The only application that they need to run is Remote Desktop. I am looking for solutions to lock them down so our users cannot ...
0
votes
0answers
101 views

How to block zip files containing executable (exe, jar) using Squid?

Squid Proxy Server is blocking exe and jar files by file extensions and meme type (for http traffic). However, if exe or jar files/programs are within zip files, then it is not blocking. The ...
0
votes
0answers
19 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
0
votes
0answers
22 views

Modern Node.js support/security on CentOS 6

I'm inheriting a legacy Node application that's running on 0.10/CentOS 6. I'd like to upgrade it to 4.2, but am running into a few issues. Previously, my sysadmin had been installing/updating Node ...
0
votes
0answers
44 views

CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL

I saw this security announcement: https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/ But I could not figure out what is this "Fiddle" and whether ...
0
votes
0answers
35 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...
0
votes
0answers
36 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
0
votes
0answers
59 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
64 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
0answers
67 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They wouldn'...
0
votes
0answers
46 views

How to limit user permissions

I have 2 servers, one web server and one SQL Server. All Windows. Both servers have the same account created with the same password and IIS and SQL Server are configured to use those accounts. I also ...
0
votes
0answers
40 views

IIS to SQL Server IPSec configuration

I'm trying to configure 2 servers on a VPC on Amazon AWS to use IPSec. One server has Win2008 R2 with SQL Server 2008 and the other one is a Win 2012 R2 with IIS. I want to secure the connection ...
0
votes
0answers
165 views

Missing Secure Flag & HttpOnly Flag From Exchange 2013 OWA

I have got a request from one of my clients asking me to add the following flag to OWA's web.config file but I am unable to find the whole flag in the first place. I guess the flag exists in ...
0
votes
0answers
17 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run as"...
0
votes
0answers
59 views

Prevent my website from being displayed under foreign domains

I'm not sure what's happening but i've just found, that someone has registered domain name *-auth.ga that displays my website. I'm not sure how can i block that kind of issue, i don't just want to ban ...
0
votes
0answers
24 views

If cron as www-data/apache user have security issue?

Last year I checkout a server where I found some exploit bash script in /tmp folder which download a binary file from 3rd party server. When I further checked it, I found apache user's cron entry for ...
0
votes
0answers
33 views

Securing ports on Linux with multi-factor authentication

I have dedicated Ubuntu server in the Internet so I want to: Connect to my server via HTTP(s) Input password and MFA token (i.e. Google Authenticator token) If both are correct, server executes ...
0
votes
0answers
41 views

Power User with Elevated Access on Domain Network

We have new IT Helpdesk staff joined our firm and we'd like to provide them with an account with power user privileges in such they can only elevate access on user computers to install, uninstall ...
0
votes
0answers
305 views

How to install a strong ephemeral Diffie-Hellman public key on windows server 2008 r2?

I have a server running windows server 2008 R2, which sits on my LAN. I'm a programmer rather than a server administrator, so I don't know how make the security on the server stronger. When I ...
0
votes
0answers
66 views

Secure settings for an upload directory

I have a website running on Ruby on Rails + Nginx and I let my users upload files. I don't want to limit the file format they can upload and instead I want to make sure that the directory/folder ...
0
votes
0answers
15 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
0
votes
0answers
26 views

Something like WSUS but for Cisco routers?

A Windows Update Server will automatically download Windows updates/patches to a central repository and then the admin can pick and choose which patches to push out to Windows servers. Is there a ...
0
votes
0answers
19 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
0
votes
0answers
18 views

Odd PUT requests in apache logs

I got a few domains hosted from an Apache server. I've had this setup for a while without much problems. However, since about a week I've began to receive strange PUT requests for one of the domains: ...
0
votes
0answers
25 views

What are the security risks when modifying nsswitch.conf?

I have to add a sss data source in /etc/nsswitch.conf for authentication of non-local users for certain databases (e.g. passwd, shadow). Basically, the nsswitch.conf will have lines such as: passwd: ...
0
votes
0answers
320 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
0
votes
0answers
144 views

olcRequires: difference between authz and bind (with olcDisallows: bind_anon)?

With OpenLDAP, what is the difference between: olcDisallows: bind_anon oldRequires: bind and: olcRequires: authc It seems to me that both configurations would require the client to authenticate ...
0
votes
0answers
76 views

Why do I always get 401 when trying to access main folder of web site?

I am trying to set up a web site on Windows Server 2008 using IIS 7.5. I have created a new application pool (TestAppPool) and a new web site at c:\inetpub\wwwroot\test. I have given the Read/Execute ...
0
votes
0answers
66 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
0
votes
0answers
182 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
0
votes
0answers
271 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
110 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
0
votes
0answers
88 views

SSHFS mount with sudo - how to restrict privileges?

I need to mount a remote server (server1) with an SSHFS mount on server2 via an automated script. I need to be able to access some files on server1 that require root access, but I don't want to enable ...
0
votes
0answers
161 views

Amazon EC2 Abuse Report - SQL Injection Attempts

I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses. Just ...
0
votes
0answers
21 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
0
votes
0answers
392 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
0
votes
0answers
857 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
0answers
272 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false configs....