Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
34 views

Comparing/Matching ACLs

Rather it be through PowerShell or another tool here is what I'm trying to accomplish and where it stems from. We have Junction points on one volume and the Target folders on another volume. ...
0
votes
0answers
17 views

Linux - How to find a process that outbound a lot of data? [duplicate]

It sounds like my EC2 instance has been hacked. A lot ouf outbound traffic is there suddenly, and I received an email from AWS saying there is a DOS attack from my server. Can I identify which ...
0
votes
2answers
56 views

How to securely send logs from your application?

I am currently setting up logging with graylog for my system and have a problem, that the logs can potentially contain sensitive information. The standard behaviour is to send the logs unencrypted via ...
0
votes
1answer
51 views

ACL inheritance in Linux: create subdirectory with 700 rights for multiple users

If I understand correctly this picture http://www.vanemery.com/Linux/ACL/img1.gif from this manual http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html, setting 700 via chmod will make user::...
0
votes
1answer
53 views

How secure Google Compute Engine is?

We're moving to GCE and we want to know how secure it is. Do we need to install our own intrussion detection/prevention software on our VM Instances? (Tripware, Ossec, Snort). or does GCE handle ...
0
votes
2answers
44 views

Making server accessible on local network without opening ports

I'm responsible for operating the server for a small startup game developer based at my university for my placement year - mostly because I'm the only one of us with any network knowledge to speak of. ...
2
votes
2answers
48 views

SSL Subject Alternative Name and Man in the Middle attacks

My company "ourcompany" owns a 2nd level DNS domain name: ourcompany.org. We currently use this domain, as well as www.ourcompany.org and feature1.ourcompany.org, and have an SSL certificate generated ...
0
votes
0answers
10 views

Trigger Builds if OS Security Updates are available

In classic non-cloudy server environments, you have a fixed set of servers. If updates were available, you installed them and were done. In cloudy server-environments, you often auto-scale your ...
0
votes
1answer
124 views

How to investigate which services and programs are using glibc?

I'm planning to upgrade glibc on several servers due to CVE-2015-7547. https://googleonlinesecurity.blogspot.jp/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html Before upgrading glibc, I would ...
1
vote
0answers
21 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
4
votes
3answers
1k views

Glibc bug mitigation for getaddrinfo()

Ran across an exploit for glibc today which involves the getaddrinfo() call for DNS resolution. I'm running Ubuntu 12.04 on two Bind9 boxes that face the internet. I'm not sure I totally understand ...
0
votes
0answers
80 views

Apache with mod_php fpm fastcgi, which is most secure?

I have a web server to install and I would like to have your minds about my choice of using mod_php instead of fastcgi of fpm. On the web server there is only one Drupal website and only one system ...
2
votes
1answer
46 views

Can I verify the integrity of an amazon instance?

If my Amazon EC2 credentials are stolen at time D, can I verify the integrity of the root volume by: Lookup the instance in EC2 API, check the time the primary network interface was attached, and ...
1
vote
2answers
34 views

Passphrase-less ssh keys on a puppet master?

Our puppet code lives on github, so we pull to the puppet master. But our github repository is private. Is standard (best) practice to give the puppet master ssh keys to github without passphrase (...
-2
votes
2answers
100 views

When should a port 9040 used for? [closed]

A firewall rule for my web app ( python) is created with allowed protocol tcp:9040. I added my domain and created DNS zones, however I still don't get to see my app when I type my domain in the ...
1
vote
1answer
76 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
1
vote
0answers
430 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
19
votes
6answers
5k views

Why would a university block incoming UDP traffic with destination port 53?

From my understanding DNS uses UDP and port 53. What undesirable things could happen if incoming UDP packets to port number 53 weren't blocked? UPDATE: Packets originate or are destined to the ...
1
vote
0answers
185 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
6
votes
1answer
62 views

controlling access while caching video content on-site on client's network

we have many hours of video training courses that we want to deliver on-site to clients with encryption or something to control access Currently , we offer via website (eg like udacity), but some ...
2
votes
2answers
241 views

How to keep access keys safe in the event of a compromised server?

What's the best strategy to keeping access tokens secure in the event of a compromised server? Let's say I have a Linux web server to which I regularly ssh into. There is a variety of critical access ...
0
votes
0answers
18 views

Web Attack: Mass Injection Website 19 [duplicate]

I got issue at Norton web safety (attached is the image) Can please any body tell me what cause this issue?
0
votes
1answer
166 views

Windows 2003(!) Server won't boot: stuck at “applying security policy”

We have a (partly) decommissioned Windows 2003 server (of year 2000 vintage) which has been running fine until I had to turn it off for the first time in months due to a planned power outage. The ...
0
votes
0answers
47 views

ThinkServer x3550 M3: AES-NI disabled?

We are running a x3550 M3 with Ubuntu and we wanted to enable AES-NI functionality. First, we checked whether it was enabled already by executing: # grep aes /proc/cpuinfo However, no aes flags ...
-1
votes
1answer
23 views

Is it possible to authencticating/login for WPA2-Enterprise using web portal?

I just wondering is it possible using WPA2-Enterprise with authentication using web just like captive portal? If possible I think it would be really cool though the setup will take time.
5
votes
1answer
148 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my syslog....
0
votes
0answers
36 views

Which AWS entities may have security group associated?

I'm writing a security audit tool and I would like to see all the services which have particular SG associated. At this point I found out that SG may be associated with: ec2 instance rds instance ...
1
vote
1answer
41 views

Nginx serving .PHP as a download only when .php is added with arguments

Here is my current nginx config: server { server_name mydomain.example; access_log /srv/www/mydomain.example/logs/access.log; error_log /srv/www/mydomain.example/logs/error.log; root /srv/www/...
3
votes
1answer
199 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
102 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0
votes
1answer
120 views

Apache access log full of unauthorized and suspicious requests, how to take action

I have setup a small tiny VPS for my own website. Since it was live, I see many suspicious activity in the access.log file. When I was on a shared hosting I did not have access to this file and ...
0
votes
0answers
21 views

Tomcat 7 auth constraint role name active directory

I integrated waffle into my tomcat 7. I need to define the users in the active directory group that can visit the site, web.xml looks like: <security-constraint> <display-name>not ...
2
votes
2answers
34 views

Apache 2 no authentication from ips

I have a deployment with apache 2.2.22 server behind varnish. What I would like to accomplish is that password protect a directory with htpasswd but make this accessible for certain users coming from ...
0
votes
1answer
173 views

Asterisk hacking defence: “Call setup” in tcpdump from denied IP number

I am running Asterisk 11.7 on Ubuntu for my small business. These last days someone could access the server and make all phone extensions ring in regular intervals. I would like to understand how that ...
53
votes
13answers
7k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
0
votes
2answers
44 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
1
vote
2answers
51 views

Central control for SSH access to AWS instances

What are some approaches or best practices for managing SSH access by many devops to many AWS instances? I'd like to have the ability to e.g. add or remove access for a user to multiple instances ...
0
votes
1answer
67 views

how to restrict access to wp-login.php by IP address on nginx

I have the following configuration for my wp site which is running on nginx 1.8.1 location ^~ /wp-login.php { allow 10.0.0.0/24; deny all; } location ~ \.php$ { try_files ...
0
votes
0answers
52 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
2
votes
1answer
43 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to 'no'...
0
votes
0answers
31 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
1
vote
1answer
30 views

Nginx config subdomain exhibiting strange behaviour

I've got two identical droplets running on digital ocean. Both running Ubuntu 14.04 with nginx, gunicorn and Django. I am trying to park a subdomain of mine onto the IP of one of the droplets. On the ...
0
votes
0answers
28 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go wrong?...
-1
votes
2answers
32 views

Do I need mutlipe certificates for mutliple services running

I did a lot of research on this but still I am confused about how many certificates I need to self-sign for each of my services running on my private server. Here is the deal: I am creating my own ...
0
votes
1answer
47 views

What type of SID ends with -0?

I have been parsing through the logs and found a random sid doing authentications against AD. It is as follows "s-1-5-21-xxxxx-xxxxx-xxxxx-0"; It cant be found in domain or forest. I want to know if ...
0
votes
1answer
123 views

How to restrict network access by user on a Windows multitenant machine?

I have a multitenant windows 2012 machine running several IIS WebSites, each running it's own application pool with its own windows user identity, and I need to restrict the all outbound network ...
0
votes
2answers
134 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 23:03:...
1
vote
0answers
116 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
2
votes
2answers
38 views

Is it safe to change the owner of the document root?

Does it pose a security risk if I change the owner of the document root on Apache? I've been spoiled by generic website hosting providers. I'm used to SFTPing my files over to the host and hitting ...
0
votes
1answer
41 views

Can VPN authentication be used for SSH?

Can VPN authentication details be re-used for SSH access? Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without ...