Security is not a product, but a process.

learn more… | top users | synonyms (1)

12
votes
3answers
12k views

How to perform a secure rsync between servers across an unsecured network

Basically what I'm asking is, has anyone come across a means by which to wrap rsync inside ssh. With OpenSSH v4.9+ sftp has some nice options that allow you to chroot the incoming connection and such ...
11
votes
4answers
4k views

Securing file system for secure SFTP server

This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
11
votes
11answers
2k views

Penetration Testing [closed]

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?
10
votes
6answers
1k views

How to choose a cloud service for backups

I am thinking of using a cloud service to backup one of my client's website. My (clients) main concerns are (in decreasing order of importance) Protection of IP (trade secrets, source code), user ...
6
votes
2answers
5k views

How To limit Nginx Auth_Basic re-tries?

I have protected a web folder with Nginx's Auth_Basic module. The problem is, we can try several passwords until it works (brute force attacks). Is there a way to limit the number of failed re-tries?
2
votes
2answers
410 views

How to find an unauthorized person's entry point to a server

We're running an in house dedicated server with 100's of sites on it. Some of these sites were very insecure and the box was not managed very well. Some one got in, messed up a bunch of stuff and is ...
26
votes
4answers
767 views

Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?

I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
17
votes
6answers
84k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
17
votes
9answers
2k views

Steps to take when technical staff leave

How do you handle the departure process when privileged or technical staff resign / get fired? Do you have a checklist of things to do to ensure the continuing operation / security of the company's ...
14
votes
2answers
1k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
8
votes
1answer
16k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS ...
6
votes
1answer
1k views

Adding port forwardings programmatically on a ControlMaster SSH session

I just found out about the ControlMaster/ControlPath feature of OpenSSH, which allows you to use a single SSH connection to run multiple terminals. As I often use SSH to use port forwarding to get ...
6
votes
7answers
15k views

How to disable CD-ROM and USB for normal users in Linux?

How can access to CD-ROM and USB be disabled for normal users in Linux? As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. ...
6
votes
3answers
1k views

SELinux in the Real World

Through my (short) job experience to date, I have gained quite a bit of knowledge of how SELinux works, from an implementation point of view and how to administer it. I personally have several ...
4
votes
3answers
4k views

How to Open help (.chm) files over unc path

When I try and open a help file (.chm) that resides on a unc path I get the following error: "Navigation to the webpage was canceled". If I copy the file locally I am able to open it. I imagine there ...
24
votes
3answers
13k views

How are cached Windows credentials stored on the local machine?

How are cached Active Directory domain credentials stored on a Windows client? Are they stored in the local SAM database, thus making them susceptible to the same rainbow table attacks that local user ...
22
votes
15answers
4k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
19
votes
3answers
3k views

Securely wipe an entire Linux server with itself

I have remote ssh access and root access. I do not have physical access. I'm not looking for solutions involving booting into anything, I want to do this from what is currently running. OS is SL6. ...
19
votes
6answers
3k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
17
votes
2answers
36k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
15
votes
11answers
988 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
12
votes
1answer
3k views

Only allow password authentication to SSH server from internal network

I have an OpenSSH 5.9p1 server running on Ubuntu Precise 12.04 which accepts connections from both the internal network and the Internet. I'd like to require public key authentication for connections ...
10
votes
4answers
608 views

Common PHP setup insecurity?

I work with the systems administration at a university and just stumbled across something which is probably common, but was quite a shock to me. All public_html directories and web areas are stored ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
8
votes
3answers
4k views

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own chrooted Environment. On ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
5
votes
2answers
3k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
4
votes
3answers
5k views

Multiple openvpn clients on one openvpn server

Can I have multiple openvpn clients connecting to a single openvpn server? The following setting works well for a single user This is the server configuration (openvpn.conf) port 1194 proto udp dev ...
2
votes
1answer
12k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
1
vote
1answer
1k views

How to monitor file/directory changes

I have a Server running Debian Lenny. Recently I've encountered a few security issues. I am specifically seeing a file get created within /etc/php5/conf.d named 'php-dev.ini'. At first glance the ...
19
votes
9answers
11k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
14
votes
2answers
2k views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
14
votes
2answers
3k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
11
votes
5answers
4k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
11
votes
3answers
8k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
10
votes
2answers
6k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
10
votes
2answers
5k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
9
votes
1answer
200 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
9
votes
2answers
29k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
8
votes
7answers
6k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
8
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
7
votes
5answers
12k views

Security: Unable to display current owner

I have a user with local administrative rights on their Windows 7 64-bit box. They extracted a file from a zip file they downloaded with the Zip shell extension to their desktop on a non-encrypted or ...
5
votes
3answers
501 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
4answers
11k views

What is the best way to harden Windows Server 2008 R2?

I need to harden my windows 2008 r2 server for PCI. What is the best way to do this? The server are behind a CISCO ASA and in the DB servers are in separate vlans. Now i need to know if there are any ...
4
votes
4answers
7k views

How Ubuntu cloud version enforces the “no root login” over ssh?

I'm looking to tweak ubuntu cloud version default setup where is denies root login. Attempting to connect to such machine yields: maxim@maxim-desktop:~/workspace/integration/deployengine$ ssh ...
4
votes
2answers
3k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
3
votes
1answer
9k views

What firewall ports need to be open for Active Directory?

I want to run DFS replication between a couple of servers. It's my understanding that the servers need to be part of a domain for this. Being able to give people a username and password that works on ...
3
votes
6answers
1k views

How do we secure our source code?

Our source code is our most prized asset. I would like to have it: secured from proliferation by in-house developers but they also need unrestricted access to the code to do their job right. So I'm ...