Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
135 views

How to avoid PHP Filesman Backdoor

We have a server and use it as a shared-server for our clients. Most of the clients use Wordpress and we have a classic LAMP environment set for it. We give SFTP access to each client (with chrooted ...
3
votes
1answer
131 views

vsftp: why is allow_writeable_chroot=YES a bad idea?

There are several thousand blog posts about vsftp and allow_writeable_chroot=YES The common error message: Fixing 500 OOPS: vsftpd: refusing to run with writable root inside chroot () I solved ...
0
votes
1answer
214 views

Is this an SQL injection attack? If so, what's it trying to do?

I'm seeing a number of entries in my access log where 'A=0 is added to a query parameter, eg: http://www.server.org/foo/?bar=1'A=0&type=xml The parameter that 'A=0 is attached to varies, but ...
-1
votes
2answers
74 views

set up secure connection over SSH [closed]

I'm setting up a server application which requires to establish a secure connection over SSH2, e.g. a client must open SSH2 connection to the server to reach specific application: % ssh -s -p5000 ...
2
votes
1answer
93 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
1
vote
1answer
37 views

How to deny requests that contains a certain header and not coming from whitelisted IPs in nginx?

I would like to double protect an application that uses a custom header to authorize some critical views. Since those calls should only originate from some well-known IPs, I would like to block ...
0
votes
1answer
110 views

Server 2012 and RDP Properties

I am looking to change RDP-Tcp-Properties security layer to: 'RDP security layer' in Windows Server 2012. Looked up: Windows 2012 R2 - RDP properties? However this server has no RD features/roles ...
0
votes
0answers
33 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...
2
votes
1answer
41 views

ssl certificates from SSL Resellers - what are they reselling?

I've seen SSL resellers everywhere (such as namecheap for several of their options). How are they reselling? What are they reselling? Are there any security issues with them?
0
votes
1answer
18 views

// , Can I change the MASTERAUTH value on a running Redis instance in a Redis Cluster?

// , According to http://redis.io/topics/security, I can set a requirepass value, for example, requirepass foobared, in the Redis configuration files. However, I don't want this in my configuration ...
3
votes
0answers
30 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
0
votes
1answer
34 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
0
votes
1answer
201 views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go ...
0
votes
0answers
30 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
1
vote
1answer
147 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
0answers
50 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
2answers
23 views

What's the best practice: HTTPS at the webservice level or at the proxy level?

These days I had to deploy several web apps, like Jenkins or jupyter. These apps must be served through HTTPS. I was wondering if it's better to configure HTTPS on each app (listening port, ssl ...
0
votes
1answer
63 views

Hide Original URL using mod_proxy

I have been successfully able to use ProxyPass and ProxyPassReverse to reverse-proxy an application running under a Tomcat Server. However, the challenge is that I want to use a fake URL, to ...
0
votes
1answer
70 views

Should I use amazon VPC or EC2 in this scenario?

My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word ...
0
votes
1answer
37 views

Should a Load balancer be bypassed via server specific URLs?

We have a web farm with an F5 load balancer on Windows 2012 R2. Previously it was configured so that a single url redirected users to a specific machine in the load balanced farm. For example: ...
0
votes
0answers
59 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
2answers
100 views

Fail2ban not banning after update to latest version

I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93. When I start it up, I get two error messages. WARNING ...
0
votes
1answer
31 views

Does TSIG and DNSSEC provide encryption of entire DNS packet?

it says TSIG and DNSSEC provide authentication. Does it mean whole DNS traffic would be encrypted so if I do packet capturing I would not be able to parse anything ? Or DNS data is still plain text ...
0
votes
0answers
57 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They ...
0
votes
2answers
69 views

Locking down Azure Portal

My company does not want any staff to have access to our corporate Azure account from outside of our offices. So, is it possible to lock down the Azure Portal? Preferably by IP whitelist. I can find ...
1
vote
1answer
59 views

Creating custom AMI in AWS that can be used with a key pair to get the Windows password after launch

I wanted to create a custom AMI for use with Elastic Beanstalk. Up until now I have been logging on to my instance by using the key pair to retrieve the Windows Password. I launched a new instance ...
0
votes
1answer
99 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
2
votes
1answer
258 views

Is there something like a virtual VPN?

I am a small business owner, an ecommerce company, faced with following problem. Current situation. We have an office with a physical location. The office has a Cisco ASA Firewall / Router to connect ...
0
votes
0answers
45 views

How to limit user permissions

I have 2 servers, one web server and one SQL Server. All Windows. Both servers have the same account created with the same password and IIS and SQL Server are configured to use those accounts. I also ...
1
vote
1answer
118 views

Q: Strange web traffic - Is this an attack?

I recently noticed some strange traffic in my nginx access logs. I'm not sure if these indicate an attack, a mistake, or something else. I've started sending these to HTTP 444, so these logs will ...
1
vote
1answer
86 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
0
votes
1answer
81 views

Why are some big corporations still worried about cloud security? [closed]

My company sells an app subscription, which is hosted as SAAS on Amazon Cloud. I have had a few clients who weren't very keen on uploading their documents to my product because my product is hosted ...
0
votes
1answer
52 views

Apache2 HPKP without HSTS

Is there a way to use public key pinning without HTTP Strict Transport Security? Both protocols (http and https) are configured via a respective vhost I need the HTTP connection for an old program, ...
0
votes
0answers
35 views

IIS to SQL Server IPSec configuration

I'm trying to configure 2 servers on a VPC on Amazon AWS to use IPSec. One server has Win2008 R2 with SQL Server 2008 and the other one is a Win 2012 R2 with IIS. I want to secure the connection ...
0
votes
1answer
31 views

IIS Request Filtering per Site

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting ...
-1
votes
2answers
73 views

Vmware Got Hit By Brute Force More Than 60K Attempt

I have a vmware with 2012 server in it. Recently int he vsphere seens alot of attempt. Smells like a brute force. I understand that Security.AccountUnlockTime exists in the ESXi 6.0 that has a lockout ...
-5
votes
2answers
74 views

Does UDP includes of source address?

Both UDP and TCP does not include source address, but how does it say UDP IP spoofing is easier than TCP? For example, the following webpage also says about UDP vulnerability. "Unlike TCP, UDP does ...
0
votes
2answers
52 views

Change apache ssl configuration to nginx config

I want to ask your help to change my apache ssl config to nginx style. Actually i have tried it a googled but SSLEngine on SSLCertificateKeyFile /etc/apache2/ssl/key/netlime_tk.key ...
0
votes
1answer
778 views

MikroTik Configuration - Add a Public Wireless Router (internet only) to Office LAN

Goal Provide internet access for employees' personal devices without providing access to the internal network. Equipment Netgear WNDR4500v2: Wireless router intended for the guest network (has ...
4
votes
0answers
32 views

ransom email, followed by DDos attack [duplicate]

2 days ago, we received an ransom email from Armada Collective, followed by 1 hour of DDos attack. This group has been in the news recently ...
2
votes
1answer
56 views

fail2ban rules not coming into effect

I have installed the Apache web server on a stock installation of Ubuntu 14.04, and I am trying to use fail2ban to block requests that check for vulnerabilities. I have put the following in ...
0
votes
0answers
24 views

Our server is launching brute force attacks on other websites, please advise [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
-2
votes
1answer
81 views

Lock Down Linux SSH Users

I am wondering if there is a simple way to restrict ssh users accesses so they can only cd to only three directories. /tmp /home/UserID /opt/apps It would also be useful if we could remove ...
0
votes
0answers
136 views

Missing Secure Flag & HttpOnly Flag From Exchange 2013 OWA

I have got a request from one of my clients asking me to add the following flag to OWA's web.config file but I am unable to find the whole flag in the first place. I guess the flag exists in ...
1
vote
1answer
121 views

AWS, NodeJS - Connecting app to Mongodb on another EC2 instance

I am trying to connect my app, running on one EC2 instance, to MongoDB, running on another EC2 instance. I'm pretty sure the problem is in the security settings, but I'm not quite sure how to handle ...
0
votes
1answer
33 views

AV CLI Scanner for Linux [closed]

I need an Anti Virus CLI Scanner for a standalone server (without internet access). OS is RHEL 7, but it must be able to scan windows file systems (for a windows viruses). I'm using a ClamAV, but I ...
1
vote
0answers
66 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
1answer
546 views

SSH everywhere without password, as administrator, is this a good idea?

I have worked in places where it is a common practice to be able to move between all servers, with SSH, as administrator without passwords. There are usually a couple of servers, which by their nature ...
-1
votes
1answer
28 views

Practical effects of setting dev.example.com to 127.0.0.1

The idea is to point a DNS entry to 127.0.0.1, so that it's possible to test "inline installation" of browser extensions. Here's an example service that does this: http://readme.localtest.me/ I'm ...
-2
votes
2answers
47 views

Risks of not updating an Ubuntu server on a local network?

Through work I recently came across a server that is used by 10-20 users daily as a sort of web server. It is running Ubuntu 12 and it has not been updated for a very long time it seems. Currently ...