Security is not a product, but a process.

learn more… | top users | synonyms (1)

15
votes
5answers
2k views

What is meant when IT Infrastructure people refer to the “Stack”

Can someone please define what exactly is the "Stack". I know its an industry term but its very vague. I am referring to Infrastructure terminology not "Stack" in terms of memory allocation.
15
votes
14answers
25k views

Alternatives to RSA SecurID? [closed]

Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
15
votes
2answers
14k views

Is a central location for authorized_keys a good idea?

I'm in the process of configuring a cloud server to run the following stack: Ruby, Passenger, Apache; under Ubuntu 10.04 (Lucid Lynx). In the process of wanting to make the server easier to manage I ...
15
votes
3answers
380 views

My site seems to be hijacked… but only when visited from another site… how?

My website is altoonadesign.com if you type it directly in your browser it takes you to the correct site. However if you do a search for "altoona design" and click on the link to my site you get ...
15
votes
2answers
11k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
15
votes
8answers
3k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
15
votes
3answers
9k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
15
votes
9answers
7k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
15
votes
5answers
2k views

Encrypted offsite backups - where to store the encryption key?

In addition to regular onsite backups (kept in a fire resistant safe), we also send tapes offsite once a month, encrypted with AES. So if our site is one day vaporised by an alien heat ray, we should ...
15
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
14
votes
14answers
1k views

Sysadmin bad habits

I think it would be interesting to have a list of bad habits you observe related to system administration. For example: Always using root on servers Sharing account passwords Inserting passwords on ...
14
votes
4answers
2k views

Wipe is very slow. Too little entropy?

I have to hand off a Laptop including its hard disc. Since it was not encrypted I wanted to wipe it at least quickly. I know this is not optimal on SSD, but I thought better than just plain readable. ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
14
votes
3answers
2k views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
14
votes
11answers
6k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
14
votes
5answers
7k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
2answers
966 views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
14
votes
2answers
769 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
14
votes
7answers
5k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
14
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
14
votes
3answers
4k views

How can I set up VLANs in a way that won't put me at risk for VLAN hopping?

We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration: One significant detail is ...
14
votes
1answer
10k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
14
votes
6answers
4k views

How difficult is it to setup a mailserver?

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data. How much of a PITA is it to setup my own mailserver? Should I go for an ...
14
votes
7answers
5k views

Good low power server/pc for firewall? [closed]

Does anyone know of a low power server/pc that have 2 NIC's, so it can be used for a (OpenBSD) firewall? Sandra
14
votes
2answers
2k views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
14
votes
7answers
3k views

Storing rarely used single-purpose passwords

How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as: Administrator/root password when everyone logs on using their own ...
14
votes
5answers
1k views

Which bots and spiders should I block in robots.txt?

In order to: Increase security of my website Reduce bandwidth requirements Prevent email address harvesting
14
votes
2answers
10k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
14
votes
6answers
21k views

Securing a SuperMicro IPMI BMC

I've recently acquired a SuperMicro X8DTU-F motherboard, which has a built-in BMC, which basically runs the IPMI system. It turns out to be a small Linux system running on an ARM processor. ...
14
votes
3answers
1k views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
14
votes
4answers
6k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
14
votes
1answer
10k views

WEP/WPA/WPA2 and wifi sniffing

I know that WEP traffic can be "sniffed" by any user of the WIFI. I know that WPA/WPA2 traffic is encrypted using a different link key for each user, so they can't sniff traffic... unless they ...
14
votes
2answers
3k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
13
votes
3answers
4k views

Enable SSH shell access but disable SFTP access

I've searched for a viable answer to this question, and most of the answers include advice on why to not do it. However, here's the scenario, and what makes it necessary: I have a console app, and in ...
13
votes
7answers
10k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
13
votes
1answer
2k views

How can SSL be on port 110?

I patched up a Postfix + Dovecot server against a DROWN attack (I disabled sslv2 and sslv3). https://test.drownattack.com Shows :25 vulnerable to CVE-2016-0703 :110 vulnerable to CVE-2016-0703 ... ...
13
votes
12answers
3k views

questionable timeservers in pool.ntp.org?

I've noticed that, after changing the reg settings outlined in Episode 52 of the Stack Overflow podcast to pool.ntp.org, my box keeps requesting time from gordo.foofus.net. The web site hosted on that ...
13
votes
4answers
3k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
13
votes
9answers
6k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
13
votes
5answers
2k views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
13
votes
4answers
421 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
13
votes
3answers
2k views

Does my Oracle DBA need root access?

My Oracle DBA Colleague is requesting root access on our production servers. He is arguing that he need it to perform some operations like rebooting the server and some other tasks. I do not not ...
13
votes
4answers
8k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
13
votes
1answer
601 views

“Hostile” network in the company - please comment on a security setup

I have a little specific problem here that I want (need) to solve in a satisfactory way. My company has multiple (IPv4) networks that are controlled by our router sitting in the middle. Typical ...
13
votes
2answers
13k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
13
votes
1answer
7k views

What's the use of X-Powered-By, Server and other similar HTTP headers?

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server? [closed]

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
13
votes
4answers
927 views

Reliable software keylogger detection?

I may be dreaming here, But is there a reliable method for keylogger software detection? I'm primarily a developer but I run a couple servers and the thing that worries me most is a software ...
13
votes
3answers
4k views

SELinux vs. AppArmor vs. grsecurity

I have to set up a server that should be as secure as possible. Which security enhancement would you use and why, SELinux, AppArmor or grsecurity? Can you give me some tips, hints, pros/cons for those ...