Security is not a product, but a process.

learn more… | top users | synonyms (1)

19
votes
6answers
3k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
15
votes
2answers
30k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
14
votes
11answers
915 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
10
votes
4answers
593 views

Common PHP setup insecurity?

I work with the systems administration at a university and just stumbled across something which is probably common, but was quite a shock to me. All public_html directories and web areas are stored ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
6
votes
3answers
2k views

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own chrooted Environment. On ...
5
votes
2answers
4k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
5
votes
2answers
3k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
1
vote
1answer
1k views

How to monitor file/directory changes

I have a Server running Debian Lenny. Recently I've encountered a few security issues. I am specifically seeing a file get created within /etc/php5/conf.d named 'php-dev.ini'. At first glance the ...
13
votes
2answers
1k views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
13
votes
2answers
3k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
10
votes
5answers
3k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
10
votes
3answers
7k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
9
votes
1answer
2k views

Only allow password authentication to SSH server from internal network

I have an OpenSSH 5.9p1 server running on Ubuntu Precise 12.04 which accepts connections from both the internal network and the Internet. I'd like to require public key authentication for connections ...
8
votes
7answers
5k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
7
votes
5answers
9k views

Security: Unable to display current owner

I have a user with local administrative rights on their Windows 7 64-bit box. They extracted a file from a zip file they downloaded with the Zip shell extension to their desktop on a non-encrypted or ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
6
votes
2answers
2k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
5
votes
3answers
488 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
4answers
9k views

What is the best way to harden Windows Server 2008 R2?

I need to harden my windows 2008 r2 server for PCI. What is the best way to do this? The server are behind a CISCO ASA and in the DB servers are in separate vlans. Now i need to know if there are any ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
3
votes
1answer
8k views

What firewall ports need to be open for Active Directory?

I want to run DFS replication between a couple of servers. It's my understanding that the servers need to be part of a domain for this. Being able to give people a username and password that works on ...
3
votes
6answers
941 views

How do we secure our source code?

Our source code is our most prized asset. I would like to have it: secured from proliferation by in-house developers but they also need unrestricted access to the code to do their job right. So I'm ...
3
votes
1answer
2k views

Allow traffic from single IP address, block all other addresses

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP ...
2
votes
1answer
9k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
2
votes
2answers
4k views

Tracking local user accounts for security audit

I would like to compile a list of local users accounts from all servers on the network. This would include domain and non domain W2K3 machines. A script to run net user and pipe the results to a file? ...
2
votes
3answers
729 views

What should I do to secure a freshly installed Windows Server 2008?

A couple of times now my server has become none responsive, after checking the logs I was getting 10 requests a second to access IIS-FTP. After looking into that I noticed that the default settings ...
11
votes
10answers
1k views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
10
votes
5answers
628 views

Tips to gracefully take over a (UNIX) production server

After months of neglect, e-mail flames and management battles our current sysadmin was fired and handed over "the server credentials" to me. Such credentials consist in a root password and nothing ...
10
votes
11answers
5k views

Server room door security

I wanted to know if anybody had any recommendations as to how to keep the server room secure from employees. There is a lock on the door, however, anybody with a building master (maintenance, owners, ...
9
votes
1answer
149 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
9
votes
3answers
5k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
6
votes
4answers
2k views

Is Selling Old Cisco Routers a Security Issue?

I'm a system admin but I'm not Cisco certified and I'm not a network engineer. Basically I only use switches/routers/modems with a GUI. I've inherited a pile of old Cisco routers that are not in use ...
5
votes
5answers
2k views

Email notification about each SSH connection to Linux server

I would like to be notified about each SSH connection to the Linux (Debian) server. Already saw some methods, which proposed to add mail command into own .bashrc, but this approach seems not to cover ...
5
votes
2answers
1k views

How can I setup OpenSSH per-user authentication methods?

I'd like to be able to have one set of users authenticating using public key auth and other users to use password authentication. Is this possible in OpenSSH on Linux? If so how do I go about it? ...
5
votes
1answer
882 views

How can I prevent Virtualmin from storing passwords in cleartext? [closed]

I am really surprised at this behavior. In Virtualmin, I can see the password for any SSH user by clicking the "(Show..)" link next to the "Password ( ) Leave unchanged" option in a variety of ...
5
votes
4answers
2k views

How do you test a new email filtering system?

What method do you use to test or evaluate potential new email filtering systems before you set it up on your production network? I am particularly interested in methods that are appropriate for ...
5
votes
7answers
11k views

Should I use a login banner and if so, what should it say?

Are interactive login banners worth having? The general consensus is that they are, but what should the banner say? Some things that are being considered (no particular order): ownership of the ...
5
votes
4answers
315 views

How to prevent a security breach from taking your online backups with it?

What techniques do you recommend for securing a online backups (to a third party service like Mozy) a backup that has the advantages of online backup but cannot be tampered with just by compromising ...
4
votes
2answers
1k views

What is the secure way to isolate ftp server users on unix?

I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the ...
4
votes
2answers
7k views

How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks. There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
4
votes
3answers
7k views

Prevent brute force attacks in Microsoft FTP Server (IIS6/7)

Looking over my ftp-server logfiles, I find a lot of brute force attacks, where the same IP-address tries 100s of username/password combinations. Is there something I can do to make life harder on ...
3
votes
4answers
6k views

How Ubuntu cloud version enforces the “no root login” over ssh?

I'm looking to tweak ubuntu cloud version default setup where is denies root login. Attempting to connect to such machine yields: maxim@maxim-desktop:~/workspace/integration/deployengine$ ssh ...
3
votes
10answers
479 views

Steps to take to protect against the “unthinkable”

We have two sysadmins who know the passwords to all our systems. If the "unthinkable" happened (AKA "they both went under a bus") there is currently no way for the remaining team members to obtain ...
3
votes
5answers
1k views

Securely Deleting Files on Linux Journaled Filesystem

I am new to real system administration but have been running Linux servers at my home for years. I haven't cared too much about security because the few servers I maintained at work have always been ...
2
votes
1answer
783 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
2
votes
2answers
1k views

New to Ubuntu Server, which logs to monitor and what to do [closed]

I have been running Ubuntu Server for about four months and I learn something new everyday. Today I learned that there are many logs that i didnt know existed. When I examined these logs I was blown ...