Security is not a product, but a process.

learn more… | top users | synonyms (2)

2
votes
1answer
70 views

Least-Privilege BUILTIN\Administrator Failure Configuring Application Control Policies with AppLocker

I asked this question over at SuperUser to no avail a while ago, before realizing that serverfault may be a better option. I'm configuring execution control on a computer running Windows 7 SP1 ...
2
votes
1answer
106 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
2
votes
1answer
976 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
2
votes
1answer
711 views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
2
votes
1answer
102 views

wildcard ssl cert. giving error in IE

have a wildcard ssl cert issued to: *.domain.com The cert. is used on 4 virtual hosts in apache2: mail.domain.com gis.domain.com data.domain.com timecard.domain.com Firfox works great, no ...
2
votes
1answer
481 views

error in system log - Succeeded authorizing right

Just installed a fresh 10.8.2 server running contacts, DNS, Mail, Open Dir, Profile Manager and Websites. The machine is primerally used for mail which is all fine and as far as i can see there are no ...
2
votes
1answer
509 views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
2
votes
1answer
46 views

Is it possible to change User's Home Directorys permission in OSX?

Most of your staff uses OSX as main operation system. The problem is that recently we were attacked with some odd malware: users are getting zip-file via mail, and when they open this zip file, they ...
2
votes
1answer
611 views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
2
votes
1answer
306 views

SSH keys stopped working, other oddities - was I hacked?

I've been running a CentOS6 server with a local colocation company for several months. I had OpenSSL setup to allow only my keys when logging in and I had no issue until recently. I also have webmin ...
2
votes
1answer
522 views

Node.js with SSL/TLS protocol v1.2

I would like to use TLS 1.2 on my node.js server. I'm currently using openssl 1.0.0e. If I upgrade to openssl 1.0.1, do I need to rebuild node.js to upgrade to TLS 1.2? Are there configuration or ...
2
votes
1answer
313 views

Duplicate Administrator Accounts

Somehow, I have a Windows 2003 Server that has two local Administrator accounts that have the same SID (S-21-xxxxxxxxx-500). Therefore, normal utilities don't let me delete them. (Can't delete a ...
2
votes
1answer
105 views

Securing access to virtual directories with valid users determined by part of the URL

I'm not a very experienced Apache sysadmin (fell in to the role as I was the only person who knew anything at all about it!) and I'm really stuck with this problem. Thanks to an over-zealous salesman ...
2
votes
1answer
263 views

IPSec between OS X clients and Windows Server (native, no 3rd party)

I would like to connect Mac OS X (Lion) with Windows Server 2008 (R2) using IPSec natively. Simplest possible settings: No certificates, no tools, no specials. Just a Windows Server with IPSec ...
2
votes
1answer
103 views

Single IP address accessing private URLs in emails I'm sending

I'm the IT/programmer guy at a small translation company. I just sent out emails to our translators around the world with an unique URL for them to come into our site and update their password. eg: ...
2
votes
1answer
304 views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
2
votes
1answer
451 views

What are the security implications of using allow.sysvipc in a FreeBSD jail

The man page for jail says that allow.sysvipc enables "System V primitives [to] share a single namespace across the host and jail environments..." thus "... processes within a jail would be able to ...
2
votes
1answer
150 views

SQL Server Bulk Insert Issue on Windows7

I’ve got an application that uses SQL Server Express 2005 SP3. This application is distributed to several hundred users, each of whom is running XP. However, our company will be moving to Windows7 ...
2
votes
1answer
179 views

How Frequent is Centos C5 Testing Repo updated?

May I know how frequent does Centos Dev Repo (C5 Testing Repo) update the patches? or Where can I find this information? Thanks.
1
vote
1answer
35 views

Lockdown Mozilla Thunderbird on Windows Remote Desktop Services

I've installed Mozilla Thunderbird 31.3.0 on a Windows Server 2012 R2 which has the Remote Desktop Services role. I want to configure the Thunderbird program and set each user's email account etc and ...
1
vote
1answer
56 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
1
vote
1answer
65 views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
1
vote
1answer
433 views

Apache 2.4/PHP-FPM ProxyPassMatch and access restriction

I've got Apache/PHP setup exactly like this: https://wiki.apache.org/httpd/PHP-FPM It includes the ProxyPassMatch rule as mentioned: ProxyPassMatch ^/(.*\.php)$ ...
1
vote
1answer
250 views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
1
vote
1answer
38 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
1
vote
1answer
629 views

JAVA blocks File Manager in Webmin

There's a file manager tool in webmin that is based on java platform. After I set up my VPS, I get the security warning, the connection to this website is untrusted and when I hit continues, I see ...
1
vote
1answer
21 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
1
vote
1answer
198 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
1
vote
1answer
113 views

Secure installation of KVM VPS?

I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain ...
1
vote
1answer
657 views

AWS: network ACL blocks outbound traffic

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using ...
1
vote
1answer
240 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
1
vote
1answer
740 views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
1
vote
1answer
523 views

Can a windows service running with network service or local system account, updated active directory container?

I have two windows services (one running as network service and the other as local system) - because of some architecture reasons these cannot run under domain user account. And there will be a store ...
1
vote
1answer
69 views

Outbound ports for a firewall for webserver and db server

I have an environment where there is one firewall, and there is a secure segment and a DMZ segment behind it. There is a bunch of servers in the secure segment - DB server, the QA server, etc and ...
1
vote
1answer
694 views

Limit simultaneous call per user in Asterisk

I want to limit simultaneous calls per extensions in Asterisk for security reasons. For example when a user is on the call no body else would be able to make a call by that extension. How can I ...
1
vote
1answer
90 views

Which way is more secure: apache:admin or folder group owner:apache?

I have been learning in recent days how to set up var/www/ permissions. I understand the common solution is set a group owner of all new folders to apache via sticky bit. How about giving the Apache ...
1
vote
1answer
222 views

I want to find a way to visualise security groups and their members

I hope someone can help... I want to find a way to visualise security groups and their members, and be able to show that to users in a simple format for discussion. I have a simple matrix in Excel ...
1
vote
1answer
87 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
1answer
238 views

Windows 7: Allow installation of software by non-admins?

I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief ...
1
vote
1answer
439 views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
1
vote
1answer
72 views

Forwarding access to a subset of ssh-agent identitites

I work for two companies (let's call them RedCorp and BlueCorp). They both trust me but they don't trust each other, and I don't want to expose either's secrets to the other. My laptop's ssh-agent ...
1
vote
1answer
543 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
1
vote
1answer
382 views

NIS: which mechanism hides shadow.byname for unpriviledged users?

On some Linux box (SLES 11.1) which is a NIS client I can do as root: ypcat shadow.byname and get output, i.e. some lines with the encrypted passwords, amongst other information. On the same Linux ...
1
vote
1answer
110 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...
1
vote
1answer
182 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN ...
1
vote
1answer
47 views

Exchange 2007: Which permissions required to change folder permissions for all mailboxes?

Which permission(s) are required to modify permissions on folders in all mailboxes in Exchange 2007? I'm looking a least-privilege setup. I've seen hints pointing towards that the role Organizational ...
1
vote
1answer
338 views

AWS EC2 security group source

I'm currently trying to configure a security group and allow MS SQL connections from my other instance. I want to be able to specify the security group's name as the source. But the connection is not ...
1
vote
1answer
169 views

TCP forwarding over SSH with socat or any other tcp forwarder, on sshd with tcp forwarding disabled

What I am trying to do is have a user that can port forward, but only to a certain host and port. I've disabled TCP forwarding over ssh for that user, and according to the manpage for sshd_config I ...
1
vote
1answer
446 views

Mysterious login attempts to windows server

I have a Windows 2008R2 server that is reporting failed login attempts from a number of workstations on our network. Some event log details: Event ID 4625, Status: 0xc000006d, Sub Status: 0xc0000064 ...
1
vote
1answer
355 views

Security issues/risks connecting from IIS7.5 to SQL Server 2008+ using Machine Account (DOMAIN\MACHINENAME$)

I'm working with a group of engineers doing .NET 4 / MVC 3 development, using Windows 7 Enterprise and IIS 7.5 locally, and connecting to MSSQL 2008+ dev/testing databases. The databases are remote ...