Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
140 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
19
votes
6answers
5k views

Why would a university block incoming UDP traffic with destination port 53?

From my understanding DNS uses UDP and port 53. What undesirable things could happen if incoming UDP packets to port number 53 weren't blocked? UPDATE: Packets originate or are destined to the ...
48
votes
6answers
32k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
2
votes
5answers
13k views

Error when restoring database (Windows 7 test environment)

I have a windows 7 operating system as a test environment. I have SQL Server EE installed with two instances, named as test and production. I took a full backup from AdventureWorks database from test ...
0
votes
0answers
38 views

ThinkServer x3550 M3: AES-NI disabled?

We are running a x3550 M3 with Ubuntu and we wanted to enable AES-NI functionality. First, we checked whether it was enabled already by executing: # grep aes /proc/cpuinfo However, no aes flags ...
1
vote
0answers
49 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
2
votes
2answers
237 views

How to keep access keys safe in the event of a compromised server?

What's the best strategy to keeping access tokens secure in the event of a compromised server? Let's say I have a Linux web server to which I regularly ssh into. There is a variety of critical access ...
2
votes
1answer
450 views

ejabberd: set Diffie-Hellman (DH) ciphers bitsize to >= 2048

In the modern version of ejabberd there is a possibility to use custom Diffie-Helman parameters by providing a self-generated pem-file to the dhfile and s2s_dhfile options in ejabberd.yml. I had ...
0
votes
0answers
33 views

Which AWS entities may have security group associated?

I'm writing a security audit tool and I would like to see all the services which have particular SG associated. At this point I found out that SG may be associated with: ec2 instance rds instance ...
0
votes
1answer
88 views

Windows 2003(!) Server won't boot: stuck at “applying security policy”

We have a (partly) decommissioned Windows 2003 server (of year 2000 vintage) which has been running fine until I had to turn it off for the first time in months due to a planned power outage. The ...
0
votes
0answers
18 views

Web Attack: Mass Injection Website 19 [duplicate]

I got issue at Norton web safety (attached is the image) Can please any body tell me what cause this issue?
4
votes
1answer
79 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my ...
-1
votes
1answer
23 views

Is it possible to authencticating/login for WPA2-Enterprise using web portal?

I just wondering is it possible using WPA2-Enterprise with authentication using web just like captive portal? If possible I think it would be really cool though the setup will take time.
1
vote
1answer
38 views

Nginx serving .PHP as a download only when .php is added with arguments

Here is my current nginx config: server { server_name mydomain.example; access_log /srv/www/mydomain.example/logs/access.log; error_log /srv/www/mydomain.example/logs/error.log; root ...
3
votes
1answer
1k views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
51
votes
13answers
7k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
5
votes
5answers
117k views

Windows Security (In windows 7) keeps asking for my credentials, and won't “Remember my credentials”

I'm not the network admin, but my network admin is having trouble solving this as well. My issue is exactly as the title says... Windows Security (In windows 7) keeps asking for my credentials, and ...
3
votes
1answer
91 views

How convince Security auditors to change frequent password change policy?

I am a new Junior IT Manager in a small company of around 500 employees and the current policy regarding passwords has enforced password expiration within 30 days, with a password history of 5. As ...
2
votes
1answer
271 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
3
votes
1answer
86 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
43 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
5
votes
6answers
2k views

Email notification about each SSH connection to Linux server

I would like to be notified about each SSH connection to the Linux (Debian) server. Already saw some methods, which proposed to add mail command into own .bashrc, but this approach seems not to cover ...
0
votes
1answer
166 views

Is this an SQL injection attack? If so, what's it trying to do?

I'm seeing a number of entries in my access log where 'A=0 is added to a query parameter, eg: http://www.server.org/foo/?bar=1'A=0&type=xml The parameter that 'A=0 is attached to varies, but ...
4
votes
5answers
35k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
0
votes
1answer
41 views

Asterisk hacking defence: “Call setup” in tcpdump from denied IP number

I am running Asterisk 11.7 on Ubuntu for my small business. These last days someone could access the server and make all phone extensions ring in regular intervals. I would like to understand how that ...
0
votes
3answers
6k views

How to disable anonymous access on LDAP

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd). I notice that if I run: ldapsearch -x -W -b ...
0
votes
1answer
90 views

Apache access log full of unauthorized and suspicious requests, how to take action

I have setup a small tiny VPS for my own website. Since it was live, I see many suspicious activity in the access.log file. When I was on a shared hosting I did not have access to this file and ...
0
votes
1answer
515 views

vsftpd on ubuntu saucy - “OOPS: Child died”

I have installed vsftpd with apt-get install vsftpd on my freshly deployed ubuntu saucy amd64 linode. vsftpd starts but when I connect to it from an ftp client, even from localhost, I get this error: ...
0
votes
0answers
17 views

Tomcat 7 auth constraint role name active directory

I integrated waffle into my tomcat 7. I need to define the users in the active directory group that can visit the site, web.xml looks like: <security-constraint> <display-name>not ...
1
vote
2answers
49 views

Central control for SSH access to AWS instances

What are some approaches or best practices for managing SSH access by many devops to many AWS instances? I'd like to have the ability to e.g. add or remove access for a user to multiple instances ...
0
votes
2answers
41 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
1answer
57 views

how to restrict access to wp-login.php by IP address on nginx

I have the following configuration for my wp site which is running on nginx 1.8.1 location ^~ /wp-login.php { allow 10.0.0.0/24; deny all; } location ~ \.php$ { try_files ...
0
votes
1answer
72 views

Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?

I have a interface where traffic is flowing from internet to NGINX server to application server. I want to monitor (IDS) the traffic flowing between Internet and NGINX at L3,4 and IPS the traffic ...
30
votes
7answers
13k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
-1
votes
2answers
148 views

Hyper-secure small business/game dev setup [closed]

I Want to setup a secure small business for game development, and was thinking of best way to secure content but still allow for people to develop. Of course, since development will take a few years, ...
56
votes
3answers
11k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
1
vote
2answers
188 views

FTP SITE CHMOD Error

When trying to edit file/folder permissions via FTP I am getting the error: 505 Security server forbids SITE commands. Contact admin. I am currently using VSFTPD with the config value ...
20
votes
3answers
2k views

how to secure an open PostgreSQL port

So, this is the situation. It seems we need to have an open TCP port 5432 to the world, where a customer has access to his PostgreSQL database. For obvious reasons, we can't say just "no", only as a ...
0
votes
2answers
720 views

EC2 Load balancer and wildcard/multi-domain SSL certificates

I am running three sites through one load balancer (and 2 child-application servers) One of the site's has an SSL certificate, but I'd like to add a certificate for the other two sites What is my ...
4
votes
4answers
3k views

can localhost be spoofed?

Is it possible for a remote machine to access another machine's localhost data by spoofing the loopback ip? Say if I wanted a setup where if I'm connecting from somewhere outside my own network, I ...
0
votes
0answers
49 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
0
votes
0answers
28 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
1
vote
1answer
25 views

Nginx config subdomain exhibiting strange behaviour

I've got two identical droplets running on digital ocean. Both running Ubuntu 14.04 with nginx, gunicorn and Django. I am trying to park a subdomain of mine onto the IP of one of the droplets. On the ...
2
votes
1answer
40 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
0answers
27 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go ...
-1
votes
2answers
31 views

Do I need mutlipe certificates for mutliple services running

I did a lot of research on this but still I am confused about how many certificates I need to self-sign for each of my services running on my private server. Here is the deal: I am creating my own ...
0
votes
2answers
76 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
17
votes
6answers
6k views

Updating production Ubuntu boxes the dos and don'ts

Every so often I login to production web/db/tools boxes and see the typical message: 30 packages can be updated. 16 updates are security updates. My question is, how do all of you handle updates on ...
1
vote
1answer
115 views

Q: Strange web traffic - Is this an attack?

I recently noticed some strange traffic in my nginx access logs. I'm not sure if these indicate an attack, a mistake, or something else. I've started sending these to HTTP 444, so these logs will ...
0
votes
2answers
88 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...