Security is not a product, but a process.

learn more… | top users | synonyms (1)

5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
3
votes
1answer
371 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
3
votes
1answer
855 views

IE8 HTTPs Download Issue

I have a problem with a system I develop related to IE8 downloading over SSL (ie on sites using https://...) and is described on this MS kb article. We use the HTTPCacheability.NoCache option as the ...
3
votes
1answer
502 views

Is Exchange protected from/allow back dated emails?

Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
3
votes
1answer
226 views

Grsecurity's RBAC policy for scripts

I have some problems with set right policy for my gentoo-based system. I have no idea how can I add permissions for everything which was started by /root/scripts/autosync. I am getting error like: ...
2
votes
1answer
41 views

Catch incoming email and then deliver to original recipient on sendmail

in the company I work for there are a user that is making bad use of the email, but to have evidence of what he is doing we need to intercept all the incoming email to him and all outgoing email from ...
2
votes
1answer
29 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
2
votes
1answer
44 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
2
votes
1answer
386 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
2
votes
1answer
918 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
2
votes
1answer
139 views

wildcard ssl cert. giving error in IE

have a wildcard ssl cert issued to: *.domain.com The cert. is used on 4 virtual hosts in apache2: mail.domain.com gis.domain.com data.domain.com timecard.domain.com Firfox works great, no ...
2
votes
1answer
543 views

error in system log - Succeeded authorizing right

Just installed a fresh 10.8.2 server running contacts, DNS, Mail, Open Dir, Profile Manager and Websites. The machine is primerally used for mail which is all fine and as far as i can see there are no ...
2
votes
1answer
758 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
2
votes
1answer
47 views

Is it possible to change User's Home Directorys permission in OSX?

Most of your staff uses OSX as main operation system. The problem is that recently we were attacked with some odd malware: users are getting zip-file via mail, and when they open this zip file, they ...
2
votes
1answer
748 views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
2
votes
1answer
323 views

SSH keys stopped working, other oddities - was I hacked?

I've been running a CentOS6 server with a local colocation company for several months. I had OpenSSL setup to allow only my keys when logging in and I had no issue until recently. I also have webmin ...
2
votes
1answer
631 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
2
votes
1answer
351 views

Duplicate Administrator Accounts

Somehow, I have a Windows 2003 Server that has two local Administrator accounts that have the same SID (S-21-xxxxxxxxx-500). Therefore, normal utilities don't let me delete them. (Can't delete a ...
0
votes
0answers
533 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
0
votes
0answers
53 views

RHEL 5 with PHP 5.1.6 VS RHEL 6 with PHP 5.3.3: Security implications

Using only the RHEL Repositories, RHEL 5 considers PHP 5.1.6 to be up to date, and RHEL 6 considers PHP 5.3.3 to be up to date. My question is: Are security updates/patches backported so that 5.1.6 ...
0
votes
0answers
53 views

Restrictions for remote Vmware View users

We have a Vmware View VDI infrastructure with several thousands of users that can log on from the internal network and from Internet thru a VMware View Security Server. We want to restrict ...
0
votes
0answers
224 views

Cloudfront - How to invalidate objects in a distribution that was transformed from secured to public?

The setting I have an Amazon Cloudfront distribution that was originally set as secured. Objects in this distribution required a URL signing. For example, a valid URL used to be of the following ...
0
votes
0answers
162 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
0
votes
0answers
178 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
0
votes
0answers
45 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
0
votes
0answers
216 views

How do you stop tomcat after changing the shutdown word in server.xml?

Running tomcat-7.0.33 on CentOS. I have a security requirement to change the tomcat shutdown word in server.xml to a random string of characters, so I need to go from this: <Server port="8005" ...
0
votes
0answers
2k views

you must have read permissions to view the properties of this object, administrators group

I think I'm having some difficulty understanding NTFS permissions. My understanding is that when possible you want to avoid assigning a specific user account to NTFS and instead use a group. So I set ...
0
votes
0answers
27 views

Wordpress wp-login permissions issue

I'm having this curious issue, wp-login change its permissions from time to time without any visible reason from 644 to 000. That produces a blank page error for user access, so I have to change file ...
0
votes
0answers
17 views

Samhain log monitoring rules

The Samhain system offers a log correlation facility, but I can't find any rule sets written for it, or any references to the correlation facility. Are there any Logmon rulesets I can use with my ...
0
votes
0answers
53 views

domain admin account unable to modify IE settings, other DOMadmin group accounts can

When I log into one of the servers on our domain as DOMAIN\administrator, IE settings are locked, and indicate that I'll have to check with the system administrator. If I log into the same server ...
0
votes
0answers
16 views

IIS Security - prevent web script to navigate upper level

I would like to know how to prevent the web script to be able to navigate his upper level ? For instance, the web script is located at C:\Websites\Website-A and it shouldn't able to navigate to upper ...
0
votes
0answers
104 views

UNC shared path not accessible though necessary permissions are set

I have 2 environments A and B. A is an original environment whereas B is a clone of A, exactly except AD servers. AD server of B has been assigned a trust relationship with A, so that all the service ...
0
votes
0answers
192 views

Red Hat 6.5 - Login Errors After Security Hardening

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server: To configure the system to lock out accounts after a ...
0
votes
0answers
70 views

Which modules can be disabled in apache2.4 on windows

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely ...
0
votes
0answers
98 views

Wordpress + nginx (post compromise), best way to block POST request for random php script?

Due to an outdated plugin, one of the domains that I host on my VPS was compromised and there were bots POSTing to //listTT9.php in order to send mail. The plugin was updated, I've gone through all ...
0
votes
0answers
920 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
0
votes
0answers
246 views

Tracert of a spoofed IP results in Infinite Loop

Our firewall picked up a spoofed IP address that caught my attention. When I did a tracert to the spoofed IP address I get what I think is an odd response. Tracing route to 192.168.1.7 1 1 ms ...
0
votes
0answers
514 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
0
votes
0answers
360 views

mysqldump over ssh and mysql restore - security issue?

I've just found a one liner to mirror a local mysql database on a remote server, over ssh: mysqldump -uroot -proot zedatabase | ssh -p4551 geek@12.34.56.78 "mysql -udoom -pmySqlPassword zedatabase" ...
0
votes
0answers
58 views

Malicious Resources on Linux Server?

When creating a website, I often include custom fonts (which I upload via FTP and reference via CSS). I get these font files from various locations on the web. I was wondering: is it possible for a ...
0
votes
0answers
166 views

Apache2 mod_dav_svn SVNListParentPath dependent on cilent IP / subnet?

Hopefully a simple question. Given the following Apache 2.2 VirtualHost configuration on a local network server with access from the local network and the internet: <VirtualHost *:80> ...
0
votes
0answers
56 views

visudo passes syntax check but the file fails when put into place

I've been trying to create a modified sudoers file in /etc/sudoers.d/ but am having trouble. visudo -cf /file/path shows no syntax issues, but when i mv /tmp/sudoers/ /etc/sudoers.d/sudoers sudo ...
0
votes
0answers
215 views

nginx hidden file deny configuration?

I am using the below standard config to block download of hidden files from nginx : #Prevent (deny) Access to Hidden Files with Nginx location ~ /\. { access_log off; ...
0
votes
0answers
267 views

Remove information revealed in packet inspection

I did a security scan of my server and got the following message: This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive and HTTP pipelining are ...
0
votes
0answers
36 views

Securing files on IIS 7 and Windows Server 2008 Server

What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server? I have the following requirements and ideas: Requirements: A authenticated user to my web app ...
0
votes
0answers
47 views

Cannot Connect to Windows Server Using a Particular IP

We have a Windows server 2008 running as web server. The Server has two IP's (A and B) added to it. We were able to use both the IP's for remote desktop connections and FTP connections. Strangely we ...
0
votes
0answers
85 views

Some basic protection for a stream in Adobe Media Server

(I have no prior knowledge of media servers, streams or things related, so sorry if my question is silly.) I'm trying to set up an Adobe Media Server, just for testing purposes. I'm trying to add ...
0
votes
0answers
289 views

User security settings for scheduled task on Windows Server 2008 R2

I have a simple executable to run as a scheduled task on some Windows Server 2008 R2. The executable downloads a file from a couple of locations, then writes the time to download the files to a SQL ...
0
votes
0answers
150 views

Filter rsyslog message by message id?

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work: if $programname == 'Security-Alert' and $msgid == '4624' then ...
0
votes
0answers
52 views

wifi network connection selection restriction

I'm dealing with the following scenario. C1 - computer 1 used for work. Windows 7 with limited user account for worker. R1 -- is wifi router 1. This router is allowed to be accessed by C1. It is ...