Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
0answers
23 views

Using Custom or Official Cookbook [closed]

I'm evaluating whether to use the official, Chef/OpsCode cookbooks to install java, maven, etc. Here's my list of pros and cons for using a custom/hand-rolled one v. Chef cookbook. Custom Cookbook ...
54
votes
6answers
11k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
171
votes
9answers
26k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
0
votes
1answer
46 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
72
votes
7answers
27k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
0
votes
1answer
47 views

Need help overriding a strict httpd.conf directory setting

Per requirements of a project I am working on, the apache httpd.conf must have the following restrictive setting as a security measure. <Directory /> Order Deny,Allow Deny from all ...
0
votes
2answers
59 views

Can a man in the middle intercept an SSL package and duplicate it?

AFAIK, SSL will encrypt the message under secure. But I still have the concern whether or not a man in the middle can catch the package and duplicate it e.g. 1000 times
2
votes
1answer
125 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
1
vote
1answer
314 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
0
votes
0answers
35 views

AD LDS changing password events

We've implemented AD LDS and we want to monitor password changes on it. However, the events I see doesn't provide much information. The only thing I see is this 4793 event (Security logs) The ...
1
vote
1answer
29 views

Temporary file security threat? [duplicate]

We use CentOS. We've been hacked and trying to figure out why. Looking at the /tmp folder I'm wondering if these are security threats: -rw-rw---- 1 mysql mysql 11665408 Apr 3 18:59 ...
0
votes
3answers
123 views

Have I just been under attack?

I have set up my Debian server on HP ProLiant 360 G4 yesterday. I started off with minimum services, running only SSH and Apache, all on standard ports with default configurations. About an hour ago, ...
0
votes
0answers
82 views

Tracert of a spoofed IP results in Infinite Loop

Our firewall picked up a spoofed IP address that caught my attention. When I did a tracert to the spoofed IP address I get what I think is an odd response. Tracing route to 192.168.1.7 1 1 ms ...
2
votes
2answers
52 views

Downsides of keeping host configuration files public?

I want to keep configuration for several of my hosts in mercurial and back it up, let's say, to bitbucket. Let's say, I have taken some precautions - tuned SSH to accept only keys, tuned pam to hash ...
0
votes
2answers
75 views

S/MIME certificate to minimize email bounce

I have a website hosted in a vps that sends informative emails to my clientes, maybe 20-40 emails per day. Since few weeks ago some sent emails are bouncing with the following error: This message ...
0
votes
0answers
34 views

Where does the biometrics domain settings change when the windows client interface is used?

To enable biometrics one would change the group policy for an OU to allow for domain login. This can be accomplished by changing settings in Group Policy on the server: Adminitrative Templates ...
-1
votes
1answer
28 views

Only allow a specific client to talk to a server

I have the following situation: have a server (ubuntu) running an application. I have a client (only the one client) requesting stuff from that server. To execute the requests, the client has to ...
1
vote
1answer
26 views

Hierarchy of Scanning Outgoing Mails on a Secure Email Gateway

Good day. Can anyone help me determine what could be the standard hierarchy of scanning outgoing mails on a secure email gateway (regardless 9f the vendor)? Should mails be scanned by policies before ...
-1
votes
3answers
349 views

Is blocking SMTP ports prevent server from sending emails?

I have a Centos server with cPanel on it. Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it. What I want to do is blocking every ports except ...
2
votes
1answer
79 views

fail2ban with PermitRootLogin without-password?

I tried to choose a title that cover the topic: Why should I use fail2ban (or similar programs) if I've my PermitRootLogin set to without-password? A very trusted and experienced sysadmin that I ...
0
votes
0answers
27 views

What particularly tools are useful for IDS for a beginner-junior server admin?

I am trying to make sure that I have some intrusion detection tools in place but I'm only a beginner admin and also standing in pending the time a proper admin comes in. I was reading up on IDS and ...
9
votes
1answer
79 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
0
votes
1answer
96 views

What are the benefits of having a data center located geographically far away from your customer's office? [closed]

Was just reading through an article on data centers as linked: http://www.theage.com.au/it-pro/business-it/what-to-look-for-in-a-data-centre-20131122-hv3qj.html Appropriate quote from article below: ...
1
vote
1answer
83 views

How do I interpret aide.log change summary

In the Changed files section of /var/log/aide/aide.log there are prefixes on each line starting with f or d. These signify what aspects of the file has changed, but I can't seem to track down what ...
2
votes
1answer
240 views

Outbound DDOS Attacks Being Run from Our Server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
0
votes
1answer
41 views

Upgrading sudo rights

One my server, I've given the main user for the web server, access to /usr/bin and /tmp. I did this so that ceartain scripts could could call exim without this user needing to have full sudo rights. ...
9
votes
2answers
950 views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
3
votes
1answer
101 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
1
vote
0answers
27 views

Do I need a firewall if the service doesn't listen on all interfaces? [duplicate]

Short version: I have a CentOS 6.5 with two NICs, one connected to the internet and one connected to the internal network. The services that shouldn't be accessible to the internet don't listen on ...
0
votes
3answers
68 views

benefits of iptables on VPS? [duplicate]

Say I have a well updated Linux VPS serving HTTP content on port 80 using apache. What would I gain by enabling IPtables? I can see no obscurity gains since the machine has a port open. Also, since ...
1
vote
0answers
84 views

Restrict windows server 2008 R2 remote mmc

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort. Server is in domain and there is big amount of other ...
1
vote
2answers
48 views

Using chown: Any substantial difference between assigning ownership of the entire directory vs just the files in it? [closed]

An example: Say Apache needs to have ownership of all the files in /var/www/html to serve the pages of a website. Is there any danger in making Apache the owner of this directory (and files and ...
3
votes
1answer
240 views

How to protect an appliance from unauthorized copy?

At the company I work for, we plan to build an appliance to simplify the deployment of our products. We will probably run a VM with docker containers underneath (containing the products) and a web ...
0
votes
2answers
78 views

McAfee anti-virus for linux server? [duplicate]

We have a CentOS server for our web startup hosted on softlayer.com. Knowing how secure Linux is even without anti-virus programs: Do I still need to install McAfee as advertised in softlayer's site ...
0
votes
1answer
52 views

A botnet may be attacking our site right now, how should we respond? [duplicate]

Not sure if SO is the right forum, but we're in need of help and perhaps programmatic elements may comprise the final solution. Instead of downvoting, please recommend where to post this question, and ...
1
vote
1answer
31 views

is this normal behavior for pam_tty_audit

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, ...
-2
votes
1answer
41 views

Random port in Filtered state for brief amount of time found using nmap , possible trojan?

Nmap results show me port 3527 open for brief period of time and then it disappears. I have a feeling this could be trojan communicating with mothership. Or something normal, but I cannot find much ...
1
vote
1answer
57 views

TCP echo server security [closed]

I am setting up a Linux server similar to a TCP echo server and am wondering about security issues I should be concerned about. This will be a bare bones Centos/KDE server with no additional files ...
1
vote
1answer
361 views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
0
votes
1answer
95 views

Lean but effective linux IDS / IPS / WAF? [closed]

I'm looking for a lean but effective IDS/IDP/WAF solution for my tiny VPS webserver. Currently I already use iptables and psad but a lot of the web server scanning attempts slip through. I use ngingx ...
0
votes
1answer
29 views

In sysctl.conf settings, what is the difference between 'all' & 'default'?

In context of sysctl.conf settings, what is the difference between (all vs. default) like net.ipv4.conf.all.accept_source_route & net.ipv4.conf.default.accept_source_route in sysctl settings ? ...
1
vote
1answer
29 views

How to configure fail2ban for constant refreshes

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want ...
2
votes
1answer
132 views

What should I do if an necessary client application has to run on an older (vulnerable) framework?

A client needs to have .NET Framework 4 installed and not patched so their software running on their Windows 2008 R2 Server functions properly. This sparks the questions: When is it okay to ...
0
votes
1answer
153 views

Modifications to sysctl.conf in openVZ container, do they even take effect?

I'm following a security guide(http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics) to strengthen my OpenVZ based VPS webserver running Ubuntu 12.04 , a part of that ...
2
votes
1answer
61 views

Serving multiple web-service instances [closed]

We're building an API-based web solution on Python which is going to be delivered to individual customers. Each customer is going to have a separate dataset. Currently, it's not a problem to deploy ...
1
vote
1answer
70 views

what are the security implication of intentionally leaking a ssl certificate?

I have a website (http://example.com) which makes some requests to http://localhost:12345 in its javascript. I want to open this website over https but due to mixed content some browsers throw ...
-1
votes
1answer
53 views

Block All Ips from editing files on server [duplicate]

We have been under recent attacks from a hacker and we need to be able to stop all IP addresses from editing files except for the ones at our office. I know how to do this via an .htaccess file ...
0
votes
2answers
36 views

Security Help? Is this a safe way of doing things?

I am running Apache with Debian. At the moment to share my site I am just setting up my router to foward my local ip on port 80. So anyone who wanted to look at my site can just type in my router's ...
-1
votes
1answer
31 views

How to access a file or directory from another server without copying it over? [closed]

Sorry if this is a dumb question. I have my reasons for wanting to do this. I am looking for a way to possibly access directories that are dependencies without actually having to copy them to my ...
40
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...