Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
29 views

Windows CE lockdown

My company just began purchasing Windows CE 5 & 7 based devices. The only application that they need to run is Remote Desktop. I am looking for solutions to lock them down so our users cannot ...
0
votes
0answers
67 views

How to block zip files containing executable (exe, jar) using Squid?

Squid Proxy Server is blocking exe and jar files by file extensions and meme type (for http traffic). However, if exe or jar files/programs are within zip files, then it is not blocking. The ...
0
votes
0answers
19 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
0
votes
0answers
22 views

Modern Node.js support/security on CentOS 6

I'm inheriting a legacy Node application that's running on 0.10/CentOS 6. I'd like to upgrade it to 4.2, but am running into a few issues. Previously, my sysadmin had been installing/updating Node ...
0
votes
0answers
44 views

CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL

I saw this security announcement: https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/ But I could not figure out what is this "Fiddle" and whether ...
0
votes
0answers
33 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...
0
votes
0answers
30 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
0
votes
0answers
50 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
61 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
0answers
57 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They ...
0
votes
0answers
45 views

How to limit user permissions

I have 2 servers, one web server and one SQL Server. All Windows. Both servers have the same account created with the same password and IIS and SQL Server are configured to use those accounts. I also ...
0
votes
0answers
35 views

IIS to SQL Server IPSec configuration

I'm trying to configure 2 servers on a VPC on Amazon AWS to use IPSec. One server has Win2008 R2 with SQL Server 2008 and the other one is a Win 2012 R2 with IIS. I want to secure the connection ...
0
votes
0answers
136 views

Missing Secure Flag & HttpOnly Flag From Exchange 2013 OWA

I have got a request from one of my clients asking me to add the following flag to OWA's web.config file but I am unable to find the whole flag in the first place. I guess the flag exists in ...
0
votes
0answers
16 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run ...
0
votes
0answers
58 views

Prevent my website from being displayed under foreign domains

I'm not sure what's happening but i've just found, that someone has registered domain name *-auth.ga that displays my website. I'm not sure how can i block that kind of issue, i don't just want to ban ...
0
votes
0answers
23 views

If cron as www-data/apache user have security issue?

Last year I checkout a server where I found some exploit bash script in /tmp folder which download a binary file from 3rd party server. When I further checked it, I found apache user's cron entry for ...
0
votes
0answers
31 views

Securing ports on Linux with multi-factor authentication

I have dedicated Ubuntu server in the Internet so I want to: Connect to my server via HTTP(s) Input password and MFA token (i.e. Google Authenticator token) If both are correct, server executes ...
0
votes
0answers
39 views

Power User with Elevated Access on Domain Network

We have new IT Helpdesk staff joined our firm and we'd like to provide them with an account with power user privileges in such they can only elevate access on user computers to install, uninstall ...
0
votes
0answers
291 views

How to install a strong ephemeral Diffie-Hellman public key on windows server 2008 r2?

I have a server running windows server 2008 R2, which sits on my LAN. I'm a programmer rather than a server administrator, so I don't know how make the security on the server stronger. When I ...
0
votes
0answers
52 views

Secure settings for an upload directory

I have a website running on Ruby on Rails + Nginx and I let my users upload files. I don't want to limit the file format they can upload and instead I want to make sure that the directory/folder ...
0
votes
0answers
12 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
0
votes
0answers
25 views

Something like WSUS but for Cisco routers?

A Windows Update Server will automatically download Windows updates/patches to a central repository and then the admin can pick and choose which patches to push out to Windows servers. Is there a ...
0
votes
0answers
18 views

xguest with Biometric validation

I am looking for a solution to the following problem: A server is connected to 'dummy' terminals (all-in-one computers) in an isolated network. These terminals have xguest account that are directly ...
0
votes
0answers
17 views

Odd PUT requests in apache logs

I got a few domains hosted from an Apache server. I've had this setup for a while without much problems. However, since about a week I've began to receive strange PUT requests for one of the domains: ...
0
votes
0answers
22 views

What are the security risks when modifying nsswitch.conf?

I have to add a sss data source in /etc/nsswitch.conf for authentication of non-local users for certain databases (e.g. passwd, shadow). Basically, the nsswitch.conf will have lines such as: passwd: ...
0
votes
0answers
285 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
0
votes
0answers
115 views

olcRequires: difference between authz and bind (with olcDisallows: bind_anon)?

With OpenLDAP, what is the difference between: olcDisallows: bind_anon oldRequires: bind and: olcRequires: authc It seems to me that both configurations would require the client to authenticate ...
0
votes
0answers
58 views

Why do I always get 401 when trying to access main folder of web site?

I am trying to set up a web site on Windows Server 2008 using IIS 7.5. I have created a new application pool (TestAppPool) and a new web site at c:\inetpub\wwwroot\test. I have given the Read/Execute ...
0
votes
0answers
55 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
0
votes
0answers
158 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
0
votes
0answers
231 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
104 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
0
votes
0answers
1k views

sysctl: cannot stat /proc/sys/kernel/exec-shield: No such file or directory

Enable ExecShield protection - ExecShield is security Linux kernel patch to avoid worms and other problems. After Adding to /etc/sysctl kernel.exec-shield = 1 Getting this error sysctl: cannot ...
0
votes
0answers
74 views

SSHFS mount with sudo - how to restrict privileges?

I need to mount a remote server (server1) with an SSHFS mount on server2 via an automated script. I need to be able to access some files on server1 that require root access, but I don't want to enable ...
0
votes
0answers
32 views

libvirt: can it provision network interfaces where the network backend is running in a domU rather than dom0?

Thanks to a great blog post, only slightly out of date [1] I've managed to configure a dom0 which has no networking at all: physical network interfaces are passed through to dedicated domU guests ...
0
votes
0answers
50 views

PHP allow_url_fopen seciurity risks

There is theory (among some admins) that allow_url_fopen will put your server at risk because you can include external scripts (prior to PHP 5.2.0). Since PHP 5.2 there is different option ...
0
votes
0answers
45 views

How to prevent Apache from serving files owned by root?

I run multiple websites on a server using vhosts. I want to configure Apache to just serve files owned by the apache user. Also, only those files should be interpreted by PHP. How can set this ...
0
votes
0answers
73 views

Website randomly not load some files

I have a single page web application who has recent HTML, JavaScript and CSS that interact with very old Classic ASP pages called using AJAX. In localhost all is working good, on the other hand in the ...
0
votes
0answers
158 views

Amazon EC2 Abuse Report - SQL Injection Attempts

I have an EC2 server (Win2008) which has about 10 sites on it, it's completely locked down apart from ports 80 and 443. I can only access port 3389 and 21 from my home and work IP addresses. Just ...
0
votes
0answers
19 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
0
votes
0answers
17 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
343 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
0
votes
0answers
732 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
0answers
229 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
0
votes
0answers
44 views

Security implications of wide WAN subnet

I have a server at OVH and say my public IP adress is xx.xx.xx.81 and the gateway is at xx.xx.xx.254. To reach the gateway, I need pfSense to be configured static WAN IP with xx.xx.xx.81/24, i.e. the ...
0
votes
0answers
72 views

Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy

I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
0
votes
0answers
103 views

How to set relaxed security for Terminal Services on 2008 R2

I installed Remote Desktop Services on Windows 2008 Server R2. I am trying to set it up with 'Relaxed Security' similar to Windows 2003 would have. Windows 2003 Server, I would set up: Permission ...
0
votes
0answers
41 views

Is it possible to break out of a “trap 1 2 3” secured terminal session by using SIGSEGV?

The title says it mostly. I'm auditing the security of a terminal-based application on AIX, and the way you use it is to connect to it remotely through telnet, where the ".profile" of the telnet user ...
0
votes
0answers
15 views

Securing web application used for core business process

I am writing an application which will be used for our core business workflows (client registration and management etc). I have partners and employees who are spread across the globe, so I want to ...
0
votes
0answers
125 views

Docker non-root secure?

If I set up a Docker container on an Ubuntu server, and then let it run arbitrary/untrusted code like uploaded PHP, Python etc. as a NON-ROOT user. Is this totally contained and secure by ...