Security is not a product, but a process.

learn more… | top users | synonyms (2)

7
votes
7answers
4k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
5
votes
3answers
575 views

Restricting the network access of Docker container

I'm in the process of creating an SFTP only Docker container, one that will be used by multiple people for the sole purpose of uploading and managing files in their own chrooted Environment. On ...
5
votes
2answers
2k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
5
votes
3answers
467 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
5
votes
4answers
7k views

What is the best way to harden Windows Server 2008 R2?

I need to harden my windows 2008 r2 server for PCI. What is the best way to do this? The server are behind a CISCO ASA and in the DB servers are in separate vlans. Now i need to know if there are any ...
5
votes
5answers
8k views

Security: Unable to display current owner

I have a user with local administrative rights on their Windows 7 64-bit box. They extracted a file from a zip file they downloaded with the Zip shell extension to their desktop on a non-encrypted or ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
3
votes
2answers
7k views

What firewall ports need to be open for Active Directory?

I want to run DFS replication between a couple of servers. It's my understanding that the servers need to be part of a domain for this. Being able to give people a username and password that works on ...
3
votes
6answers
883 views

How do we secure our source code?

Our source code is our most prized asset. I would like to have it: secured from proliferation by in-house developers but they also need unrestricted access to the code to do their job right. So I'm ...
3
votes
1answer
2k views

Allow traffic from single IP address, block all other addresses

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP ...
2
votes
2answers
3k views

Tracking local user accounts for security audit

I would like to compile a list of local users accounts from all servers on the network. This would include domain and non domain W2K3 machines. A script to run net user and pipe the results to a file? ...
2
votes
3answers
713 views

What should I do to secure a freshly installed Windows Server 2008?

A couple of times now my server has become none responsive, after checking the logs I was getting 10 requests a second to access IIS-FTP. After looking into that I noticed that the default settings ...
14
votes
2answers
25k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
10
votes
5answers
592 views

Tips to gracefully take over a (UNIX) production server

After months of neglect, e-mail flames and management battles our current sysadmin was fired and handed over "the server credentials" to me. Such credentials consist in a root password and nothing ...
10
votes
10answers
1k views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
10
votes
3answers
6k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
10
votes
11answers
5k views

Server room door security

I wanted to know if anybody had any recommendations as to how to keep the server room secure from employees. There is a lock on the door, however, anybody with a building master (maintenance, owners, ...
9
votes
1answer
109 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
6
votes
4answers
1k views

Is Selling Old Cisco Routers a Security Issue?

I'm a system admin but I'm not Cisco certified and I'm not a network engineer. Basically I only use switches/routers/modems with a GUI. I've inherited a pile of old Cisco routers that are not in use ...
5
votes
5answers
1k views

Email notification about each SSH connection to Linux server

I would like to be notified about each SSH connection to the Linux (Debian) server. Already saw some methods, which proposed to add mail command into own .bashrc, but this approach seems not to cover ...
5
votes
2answers
1k views

How can I setup OpenSSH per-user authentication methods?

I'd like to be able to have one set of users authenticating using public key auth and other users to use password authentication. Is this possible in OpenSSH on Linux? If so how do I go about it? ...
5
votes
1answer
808 views

How can I prevent Virtualmin from storing passwords in cleartext?

I am really surprised at this behavior. In Virtualmin, I can see the password for any SSH user by clicking the "(Show..)" link next to the "Password ( ) Leave unchanged" option in a variety of ...
5
votes
4answers
2k views

How do you test a new email filtering system?

What method do you use to test or evaluate potential new email filtering systems before you set it up on your production network? I am particularly interested in methods that are appropriate for ...
5
votes
7answers
8k views

Should I use a login banner and if so, what should it say?

Are interactive login banners worth having? The general consensus is that they are, but what should the banner say? Some things that are being considered (no particular order): ownership of the ...
5
votes
4answers
302 views

How to prevent a security breach from taking your online backups with it?

What techniques do you recommend for securing a online backups (to a third party service like Mozy) a backup that has the advantages of online backup but cannot be tampered with just by compromising ...
4
votes
2answers
1k views

What is the secure way to isolate ftp server users on unix?

I've read documentation for various ftp daemons and various long threads about the security implications of using a chroot environment for an ftp server when giving users write access. If you read the ...
4
votes
2answers
7k views

How Can I Harden the TCP/IP Stack in Windows Server 2008? [duplicate]

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks. There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. ...
4
votes
3answers
7k views

Prevent brute force attacks in Microsoft FTP Server (IIS6/7)

Looking over my ftp-server logfiles, I find a lot of brute force attacks, where the same IP-address tries 100s of username/password combinations. Is there something I can do to make life harder on ...
3
votes
3answers
6k views

How Ubuntu cloud version enforces the “no root login” over ssh?

I'm looking to tweak ubuntu cloud version default setup where is denies root login. Attempting to connect to such machine yields: maxim@maxim-desktop:~/workspace/integration/deployengine$ ssh ...
3
votes
10answers
471 views

Steps to take to protect against the “unthinkable”

We have two sysadmins who know the passwords to all our systems. If the "unthinkable" happened (AKA "they both went under a bus") there is currently no way for the remaining team members to obtain ...
3
votes
5answers
1k views

Securely Deleting Files on Linux Journaled Filesystem

I am new to real system administration but have been running Linux servers at my home for years. I haven't cared too much about security because the few servers I maintained at work have always been ...
2
votes
1answer
263 views

Security concerns in Ubuntu and CentOS

In my company we are dealing with an interesting decision: which Operating System should we choose as the default one? This does not mean that every installation will be based on the chosen Operating ...
2
votes
1answer
667 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
2
votes
2answers
1k views

New to Ubuntu Server, which logs to monitor and what to do [closed]

I have been running Ubuntu Server for about four months and I learn something new everyday. Today I learned that there are many logs that i didnt know existed. When I examined these logs I was blown ...
1
vote
2answers
214 views

How to let users administer their own e-mail accounts?

I work for a small ISP that hosts e-mail for some 6,000 users, and we're in the process of upgrading to a new Debian mail server. One of the many requests we get from our users is to be able to change ...
1
vote
2answers
229 views

Reputable Biometric Fingerprint Scanner & Access/Attendance Solutions?

I have a client, a school, looking to implement a fingerprint or hand scanner to track both employee time and student attendance. As per earlier conversations on here, this is not for high security ...
0
votes
3answers
1k views

Centos Dedicated Server Security [closed]

We have clean CentOS 5.6 setup and virtualmin on it, that's all. What type of security steps would you suggest are appropriate? http://www.wiredtree.com/supportservices/servershield.php this page ...
12
votes
2answers
896 views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
11
votes
10answers
5k views

Are there any good reasons for disabling hardware-assisted virtualization?

We've had a number of servers from Dell recently, all of which have had hardware-assisted virtualization disabled in the BIOS. As far as I know hardware-assisted virtualization is a good thing - so ...
10
votes
1answer
587 views

How do I audit user's mailbox actions performed via IMAP in Exchange 2010?

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access. I perform the following cmdlet to enable auditing of the owner: > Set-Mailbox -Identity ...
10
votes
4answers
4k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
10
votes
3answers
1k views

Security considerations of WPA versus WPA2?

As we replacing our existing WEP infrastructure across multiple offices, we are weighing the value of upgrading to WPA versus WPA2 (both PSK). We have several different types of devices that do not ...
10
votes
8answers
4k views

Best file system for external (USB) hard drives/USB memory media

Almost all external USB hard drive and USB memory media/sticks come today preformatted with FAT32. As far as I know the only advantage of the file system is the compatibility among OSes and devices. ...
7
votes
6answers
4k views

Monitor the shell activity of a user on your Unix system?

Trust, but verify. Let's say I want to hire someone a sysadmin, and give them root access to my Unix system. I want to disable X windows for them, only allow shell usage (through SSH, maybe), so that ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
6
votes
9answers
2k views

Should Windows webservers have a hardware firewall?

Are there any compelling reasons to protect a dedicated server (Windows 2008 R2 in my case) with a hardware firewall? What security concerns would a hardware firewall cover better than the built-in ...
6
votes
1answer
519 views

Set windows permissions to allow modify, but not execute

Is it possible to set permissions on a folder in Windows (Server 2003 64bit) so that an account can write and modify, but not execute? If I set modify permissions, windows seems to insist I also set ...
6
votes
4answers
874 views

Is account lockout a denial of service attack waiting to happen?

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three).. This means that with the following net use \\targetmachine\c$ ...