Security is not a product, but a process.

learn more… | top users | synonyms (1)

15
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
15
votes
2answers
15k views

User per virtual host in Nginx

Is it possible in nginx configure different user per virtual host? Something like server { user myprojectuser myprojectgroup; ... }
14
votes
14answers
1k views

Sysadmin bad habits

I think it would be interesting to have a list of bad habits you observe related to system administration. For example: Always using root on servers Sharing account passwords Inserting passwords on ...
14
votes
4answers
2k views

Wipe is very slow. Too little entropy?

I have to hand off a Laptop including its hard disc. Since it was not encrypted I wanted to wipe it at least quickly. I know this is not optimal on SSD, but I thought better than just plain readable. ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
14
votes
3answers
2k views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
14
votes
14answers
24k views

Alternatives to RSA SecurID? [closed]

Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
14
votes
11answers
5k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
14
votes
5answers
6k views

Can an attacker sniff data in a URL over HTTPS?

Can data included in a URL be considered secure if the connection is made over HTTPS? For example, if a user clicks a link in an email that points to https://mysite.com?mysecretstring=1234 would it ...
14
votes
2answers
931 views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
14
votes
2answers
745 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
14
votes
7answers
5k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
14
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
14
votes
3answers
4k views

How can I set up VLANs in a way that won't put me at risk for VLAN hopping?

We're planning to migrate our production network from a VLAN-less configuration to a tagged VLAN (802.1q) configuration. This diagram summarizes the planned configuration: One significant detail is ...
14
votes
2answers
8k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
14
votes
3answers
10k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
14
votes
1answer
10k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file ...
14
votes
6answers
4k views

How difficult is it to setup a mailserver?

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data. How much of a PITA is it to setup my own mailserver? Should I go for an ...
14
votes
7answers
5k views

Good low power server/pc for firewall? [closed]

Does anyone know of a low power server/pc that have 2 NIC's, so it can be used for a (OpenBSD) firewall? Sandra
14
votes
1answer
8k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
14
votes
2answers
2k views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
14
votes
5answers
1k views

Which bots and spiders should I block in robots.txt?

In order to: Increase security of my website Reduce bandwidth requirements Prevent email address harvesting
14
votes
6answers
20k views

Securing a SuperMicro IPMI BMC

I've recently acquired a SuperMicro X8DTU-F motherboard, which has a built-in BMC, which basically runs the IPMI system. It turns out to be a small Linux system running on an ARM processor. ...
14
votes
3answers
1k views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
14
votes
1answer
10k views

WEP/WPA/WPA2 and wifi sniffing

I know that WEP traffic can be "sniffed" by any user of the WIFI. I know that WPA/WPA2 traffic is encrypted using a different link key for each user, so they can't sniff traffic... unless they ...
14
votes
2answers
3k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
13
votes
3answers
4k views

Enable SSH shell access but disable SFTP access

I've searched for a viable answer to this question, and most of the answers include advice on why to not do it. However, here's the scenario, and what makes it necessary: I have a console app, and in ...
13
votes
12answers
3k views

questionable timeservers in pool.ntp.org?

I've noticed that, after changing the reg settings outlined in Episode 52 of the Stack Overflow podcast to pool.ntp.org, my box keeps requesting time from gordo.foofus.net. The web site hosted on that ...
13
votes
6answers
9k views

How would you send syslog *securely* over the public Internet?

So I've got a few servers which I'd like to log centrally but obviously I don't want to pass the data insecurely over the internet. I've tried syslog-ng but can't make it work in a secure way, a ...
13
votes
4answers
3k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
13
votes
9answers
6k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
13
votes
5answers
2k views

Git commit auditing

I have a git server running over ssh and each user has a unix account on the system. Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
13
votes
4answers
413 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
13
votes
3answers
2k views

Does my Oracle DBA need root access?

My Oracle DBA Colleague is requesting root access on our production servers. He is arguing that he need it to perform some operations like rebooting the server and some other tasks. I do not not ...
13
votes
2answers
10k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
13
votes
7answers
8k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
13
votes
1answer
578 views

“Hostile” network in the company - please comment on a security setup

I have a little specific problem here that I want (need) to solve in a satisfactory way. My company has multiple (IPv4) networks that are controlled by our router sitting in the middle. Typical ...
13
votes
2answers
1k views

Has anyone got billed for malicious activities (DDoS) on a cloud server? [closed]

I would like to know if anyone got billed beyond expectation on a cloud service because of malicious activities (DDoS, etc)? How does EC2 and/or Rackspace Cloud handle these issues? Thank you!
13
votes
4answers
923 views

Reliable software keylogger detection?

I may be dreaming here, But is there a reliable method for keylogger software detection? I'm primarily a developer but I run a couple servers and the thing that worries me most is a software ...
13
votes
3answers
4k views

SELinux vs. AppArmor vs. grsecurity

I have to set up a server that should be as secure as possible. Which security enhancement would you use and why, SELinux, AppArmor or grsecurity? Can you give me some tips, hints, pros/cons for those ...
12
votes
17answers
1k views

What are the arguments for and against a network policy where the sys admin knows users passwords? [closed]

I'd like to know pros and cons.. reasons for and against the idea of sys admin’s maintaining user account lists with passwords.. and additionally not allowing those users to change their passwords. I ...
12
votes
23answers
2k views

Is being paranoid a required 'quality' for Sys/Net administrators?

Is being Paranoid considered an (unspoken) 'requirement' for a Sys/Net admin to have (obviously for security reasons)? Is there such a thing as being overly paranoid?, or should we be trustful of ...
12
votes
7answers
2k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
12
votes
12answers
7k views

what's a secure way to send passwords over the internet?

I'm looking for the best way to send passwords over the internet safely. Options I've looked at are PGP and encrypted RAR files. There are no real parameters other than getting from point a to point ...
12
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
12
votes
8answers
2k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
12
votes
13answers
3k views

Password expiration policies [closed]

Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
12
votes
4answers
4k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
12
votes
9answers
18k views

How to secure a public facing Remote Desktop Server?

I am looking at needing to expose my Remote Desktop Server (Terminal Services) to be accessed from outside our network. Right now, it can only be accessed from inside our network. I know it's easy ...