Security is not a product, but a process.

learn more… | top users | synonyms (1)

133
votes
4answers
11k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
1
vote
1answer
36 views

Clone identical cipher suite from Apache2 on linux to IIS 8.5 in Windows Server 2012r2

Intended result: To have identical cipher support in IIS 8.5 (new server), as I have support for in Apache 2.4 (the server I want to copy the supported ciphers from). ssllabs.com info : Apache 2.4 ...
29
votes
6answers
78k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
1
vote
1answer
30 views

Monit sshd binary Checksum Check and Restart

I'm going over a monit config file and something doesn't seem right. I'm using monit to monitor the checksum of the sshd binary, if its different from whats expected it should reload a known binary. ...
0
votes
0answers
27 views

Windows Server 2008R2 / IIS7.5 / Recommended User and Folder Permissions to host WordPress

I have a Windows Server 2008R2 server running IIS 7.5. I host a number of WordPress sites and they are constantly under attack from hackers / bots. Does anyone out there know the recommended user ...
0
votes
0answers
11 views

What happens using SASL plaintext on an openldap server on the server side?

I have an OpenLDAP server and I use SASL with the login authentication mechanism. My user passwords are securely hashed and stored within my LDAP database. I understand that the login credentials are ...
1
vote
0answers
22 views

How to protect nginx proxy from being spoofed by other reverse proxies?

I've recently noticed that one of my sites that's running behind nginx proxy became accessible via bunch of random domains. Some of them are proxies generated by sites like http://unblocksit.es and ...
28
votes
8answers
7k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
9
votes
10answers
13k views

Relatively easy way to block all traffic from a specific country?

I have a web app that has no users in the Philippines, but is constantly bombarded by spammers, carders testing cards, and other undesirable activity from there. I can see in the logs that they have ...
0
votes
1answer
20 views

Let OS X ScreenSharing accept incoming connections only from a list of trusted IPs [closed]

As a security measure, is it possible to set up screen sharing on a remote Mac to accept connections only from a given list of IP addresses? (Of course I could set up a firewall to allow traffic on ...
0
votes
1answer
31 views

Comparing/Matching ACLs

Rather it be through PowerShell or another tool here is what I'm trying to accomplish and where it stems from. We have Junction points on one volume and the Target folders on another volume. ...
2
votes
2answers
40 views

SSL Subject Alternative Name and Man in the Middle attacks

My company "ourcompany" owns a 2nd level DNS domain name: ourcompany.org. We currently use this domain, as well as www.ourcompany.org and feature1.ourcompany.org, and have an SSL certificate generated ...
0
votes
0answers
17 views

Linux - How to find a process that outbound a lot of data? [duplicate]

It sounds like my EC2 instance has been hacked. A lot ouf outbound traffic is there suddenly, and I received an email from AWS saying there is a DOS attack from my server. Can I identify which ...
1
vote
2answers
27 views

Passphrase-less ssh keys on a puppet master?

Our puppet code lives on github, so we pull to the puppet master. But our github repository is private. Is standard (best) practice to give the puppet master ssh keys to github without passphrase ...
0
votes
2answers
46 views

How to securely send logs from your application?

I am currently setting up logging with graylog for my system and have a problem, that the logs can potentially contain sensitive information. The standard behaviour is to send the logs unencrypted via ...
32
votes
9answers
15k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
0
votes
1answer
43 views

ACL inheritance in Linux: create subdirectory with 700 rights for multiple users

If I understand correctly this picture http://www.vanemery.com/Linux/ACL/img1.gif from this manual http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html, setting 700 via chmod will make ...
4
votes
2answers
4k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
0
votes
1answer
53 views

How secure Google Compute Engine is?

We're moving to GCE and we want to know how secure it is. Do we need to install our own intrussion detection/prevention software on our VM Instances? (Tripware, Ossec, Snort). or does GCE handle ...
0
votes
2answers
42 views

Making server accessible on local network without opening ports

I'm responsible for operating the server for a small startup game developer based at my university for my placement year - mostly because I'm the only one of us with any network knowledge to speak of. ...
2
votes
2answers
32 views

Apache 2 no authentication from ips

I have a deployment with apache 2.2.22 server behind varnish. What I would like to accomplish is that password protect a directory with htpasswd but make this accessible for certain users coming from ...
0
votes
0answers
10 views

Trigger Builds if OS Security Updates are available

In classic non-cloudy server environments, you have a fixed set of servers. If updates were available, you installed them and were done. In cloudy server-environments, you often auto-scale your ...
6
votes
4answers
13k views

How to make a secure MongoDB server?

I'm wanting my website to use MongoDB as it's datastore. I've used MongoDB in my development environment with no worries, but I'm worried about security with a public server. My server is a VPS ...
5
votes
4answers
3k views

Bitlocker equivalent for Linux

Bitlocker is a harddrive encryption data protection tool which comes with Windows vista ultimate and 7. Does anyone know i an equivalent is used in Linux distros like fedora and ubuntu 10.10 ? If they ...
0
votes
1answer
116 views

How to investigate which services and programs are using glibc?

I'm planning to upgrade glibc on several servers due to CVE-2015-7547. https://googleonlinesecurity.blogspot.jp/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html Before upgrading glibc, I would ...
6
votes
1answer
59 views

controlling access while caching video content on-site on client's network

we have many hours of video training courses that we want to deliver on-site to clients with encryption or something to control access Currently , we offer via website (eg like udacity), but some ...
2
votes
3answers
19k views

How to “jail” a ftp user inside its home directory (proftpd)?

I have a user named "ftp3" that belong to group "ftpusers-temp". The home of that user is home/FTP-shared/temp In proftpd.conf I have the following 2 directives: DefaultRoot /home/FTP-shared ...
1
vote
0answers
17 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
0
votes
0answers
63 views

Apache with mod_php fpm fastcgi, which is most secure?

I have a web server to install and I would like to have your minds about my choice of using mod_php instead of fastcgi of fpm. On the web server there is only one Drupal website and only one system ...
4
votes
4answers
2k views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
4
votes
1answer
5k views

How should I configure SELinux when running nginx inside Docker

There's a good article in Docker's documentation about security with Docker: https://docs.docker.com/articles/security/ However, it's not very clear to me how root-privileged processes in the ...
-2
votes
2answers
80 views

When should a port 9040 used for? [closed]

A firewall rule for my web app ( python) is created with allowed protocol tcp:9040. I added my domain and created DNS zones, however I still don't get to see my app when I type my domain in the ...
1
vote
1answer
65 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
9
votes
5answers
33k views

SSH / SSHD - How do I set max login attempts?

What is the easiest way to setup max login attempts in a LAMP environment (sshd installed via yum)? Is there a package or simple firewall rule?
0
votes
0answers
206 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
19
votes
6answers
5k views

Why would a university block incoming UDP traffic with destination port 53?

From my understanding DNS uses UDP and port 53. What undesirable things could happen if incoming UDP packets to port number 53 weren't blocked? UPDATE: Packets originate or are destined to the ...
48
votes
6answers
32k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
2
votes
5answers
14k views

Error when restoring database (Windows 7 test environment)

I have a windows 7 operating system as a test environment. I have SQL Server EE installed with two instances, named as test and production. I took a full backup from AdventureWorks database from test ...
0
votes
0answers
46 views

ThinkServer x3550 M3: AES-NI disabled?

We are running a x3550 M3 with Ubuntu and we wanted to enable AES-NI functionality. First, we checked whether it was enabled already by executing: # grep aes /proc/cpuinfo However, no aes flags ...
1
vote
0answers
84 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
2
votes
2answers
238 views

How to keep access keys safe in the event of a compromised server?

What's the best strategy to keeping access tokens secure in the event of a compromised server? Let's say I have a Linux web server to which I regularly ssh into. There is a variety of critical access ...
2
votes
1answer
485 views

ejabberd: set Diffie-Hellman (DH) ciphers bitsize to >= 2048

In the modern version of ejabberd there is a possibility to use custom Diffie-Helman parameters by providing a self-generated pem-file to the dhfile and s2s_dhfile options in ejabberd.yml. I had ...
0
votes
0answers
33 views

Which AWS entities may have security group associated?

I'm writing a security audit tool and I would like to see all the services which have particular SG associated. At this point I found out that SG may be associated with: ec2 instance rds instance ...
0
votes
1answer
105 views

Windows 2003(!) Server won't boot: stuck at “applying security policy”

We have a (partly) decommissioned Windows 2003 server (of year 2000 vintage) which has been running fine until I had to turn it off for the first time in months due to a planned power outage. The ...
0
votes
0answers
18 views

Web Attack: Mass Injection Website 19 [duplicate]

I got issue at Norton web safety (attached is the image) Can please any body tell me what cause this issue?
4
votes
1answer
90 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my ...
-1
votes
1answer
23 views

Is it possible to authencticating/login for WPA2-Enterprise using web portal?

I just wondering is it possible using WPA2-Enterprise with authentication using web just like captive portal? If possible I think it would be really cool though the setup will take time.
1
vote
1answer
39 views

Nginx serving .PHP as a download only when .php is added with arguments

Here is my current nginx config: server { server_name mydomain.example; access_log /srv/www/mydomain.example/logs/access.log; error_log /srv/www/mydomain.example/logs/error.log; root ...
3
votes
1answer
1k views

Problems with disabled ssl version 2 in ubuntu server. Can I also disable ssl version 3 to solve problems?

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine. Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons. If i run curl against ...
51
votes
13answers
7k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...