Security is not a product, but a process.

learn more… | top users | synonyms (1)

2
votes
0answers
38 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
3
votes
2answers
209 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
1answer
398 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
0
votes
0answers
270 views

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy and CVE-2014-0224

According to Debian security tracker CVE-2014-0224 vulnerability is fixed in OpenSSL 1.0.1e-2+deb7u10. https://security-tracker.debian.org/tracker/CVE-2014-0224 I have: #apt-cache policy openssl ...
1
vote
1answer
137 views

Lockdown Mozilla Thunderbird on Windows Remote Desktop Services

I've installed Mozilla Thunderbird 31.3.0 on a Windows Server 2012 R2 which has the Remote Desktop Services role. I want to configure the Thunderbird program and set each user's email account etc and ...
1
vote
1answer
476 views

nginx - deny all *.php requests except index.php for security reasons

os: CentOS 7 nginx: 1.6.2 httpd: apache 2.4.6 cms: Drupal 7 After my server was compromised I removed all from server, reinstalled OS and soft, and restored data from backup. Now I configure all ...
-1
votes
2answers
68 views

HowTo Track an E-Mail on it's voyage [closed]

Is there any way to track an E-Mail during it's "journey"? A friend of mine believes, that People the sports club he is involved with and where he has an E-Mail address, is reading the E-Mails of all ...
-4
votes
4answers
83 views

Blocking another Win 2008 R2 admin from accesing some important folders [closed]

I have sold half my dedicated server to somebody but I dont want them accessing my web hosted Plesk files for my Wordpress website. As some of them are custom and confidential. I gave them local ...
0
votes
1answer
34 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
2
votes
2answers
204 views

Restrict access to active directory attributes from a particular computer?

I know that some attributes in AD are classified as personal information and some are classified as public information (see the "property set" column here - ...
0
votes
0answers
165 views

Enabling the Internet Connection on an EC2 Windows Server 2012 Machine

I've disabled the firewall: netsh firewall set opmode disable I've made sure to accept all inbound and all outbound connections: Is there anything that I should be installing or adding on to the ...
-2
votes
2answers
608 views

Removing the Security Alert Outlook pops up for internal network domain clients - Remove security?

I have several Outlook clients on the internal network pointing to the internal DNS name of the Exchange 2010 SP1 R2 server. The name we're using is exchange2.example.local. Since new guidelines ...
1
vote
2answers
77 views

Should I sudo as root or use a public key [duplicate]

I have read a few times to disable root login and sudo as root using another user. But is using a public key as good if not better security?
0
votes
1answer
38 views

Solaris 11 / OpenSolaris - stop processes from listening?

I would like to write a script to secure Solaris 11 servers in preparation for internet access. In addition to enabling ipfilter, I would like to disable network-accessible services that are not ...
-3
votes
1answer
42 views

Data Backup from aws to other cloud storage for backups if aws account get hacked [duplicate]

We are thinking to make a backup of all our AWS data (RDS and S3) to some other cloud sources, because there is a possibility that a developer of company AWS account get hacked. The hacker could then ...
0
votes
0answers
83 views

Remove mapping drives from RDP to user from exteral network

I would like to know if you guys have a solution to my problem. I have a terminal server 2012 that can be accessed remotely after a VPN connection and from the LAN. My question is how can I create a ...
0
votes
1answer
26 views

How to stop username enumeration in Samba on Ubuntu?

I'm using Ubuntu 12.04 LTS to serve a web application to a local Windows network. A recent pen test highlighted that it was possible to enumerate local user accounts on the Samba service. I have been ...
0
votes
0answers
86 views

Server 2012 LDAP signing - “Number of simple binds performed without SSL/TLS..”

Here is our log on event 8227: Number of simple binds performed without SSL/TLS: 88 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0 I have set LDAP Interace Events ...
0
votes
0answers
43 views

setting up DANE fails, error with “could not get cert chain from ssl”

I successfully setup DNSSEC and enabled it on my domain. I'd love to make use of my DANE. I created a standard self signed certificate openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem ...
0
votes
1answer
59 views

Disable Apache server signature [closed]

I've just set expose_php to off via WHM's Configure PHP and suExec. For security purposes I want to additionally hide: Apache ServerSignature/ServerTokens/PHP X-Powered-By I can't find a relevant ...
3
votes
1answer
276 views

Determine if possible successful probe is successful exploit?

A logwatch report outputted the following message. A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that ...
-6
votes
1answer
43 views

Verify HASH value of certificate [closed]

How can I verify Hash value of a certificate I get from a website using openssl? Say for example or facebook.com.
-2
votes
1answer
27 views

EV Certificate on browser [closed]

How does the browser recognise that the presented certificate actually is an EV certi cate? I went through this article but I couldn't figure out any thing for sure.
0
votes
1answer
79 views

Debian Secure Network [closed]

I have an industrial PC with 3 Ethernet ports (RJ45, 100 MB/s). I would like to designate one as an incoming internet connection (from the company), and the other two on a private network. The private ...
0
votes
0answers
29 views

Cups Does not ask for authentication for remote access at all, it will either not ask and work or not ask and not work

I can find an infinite amount of questions asking how to remove authentication but I cant seem to find any that want to be asked for a prompt before being able to access the web service GUI. I have ...
0
votes
0answers
80 views

Lock Down Users on Cygwin SFTP Server

How do I lock down sftp users in Cygwin so that they can't read from random directories such as /etc. i set up local windows accounts for each sftp user on the machine. I've used /etc/fstab file to ...
1
vote
1answer
129 views

Kerberos SSH Man-in-the-Middle for Data Sniffing

Kerberos clearly keeps an attacker from getting a user's credentials in an SSH man-in-the-middle scenario (one where the attacker has gotten the user to trust their server's public key and redirects ...
0
votes
1answer
120 views

Apache - Drop connection for anything but HTTP 200 status

Is there a way to configure Apache to drop connection for any request resulting in an HTTP status other than 200 (or possibly a list of status codes)? The idea is that, rather than returning any ...
0
votes
1answer
26 views

FIM2010 R2 SP1 service account requirements on database after installation

We're in the process of updating our Forefront Identity Manager to 2010 R2 SP1. The SQL Server instance for the old installation has the FIM service account in the sysadmin role, as is required for ...
0
votes
1answer
40 views

Why should I remove firewall rule after application exit?

I have a server which listens on port 80 for incoming requests - using HttpListener. I've found that to be able to do that, I need to open up the port (add a firewall rule which enables me to listen ...
2
votes
2answers
586 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
1answer
89 views

Does Active Directory alone is not enough to secure hadoop?

I am trying to secure Hadoop environment installed in windows. So basically I started to analyse how to secure a Unix-based hadoop cluster. Have gone through various links related to Kerberos and ...
1
vote
1answer
269 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
0
votes
0answers
28 views

What if Security ID and Account Name differ on Windows Security Event Log

the latest MS Kerberos Vulnerability let us search our Security Event Logs for potential attackers. According to a technet article, to identify an attacker you have to search for non matching security ...
7
votes
1answer
251 views

PCI-DSS: Virtualization segmentation in ESXi environment

I have already asked this question over on Information Security but so far it has not garnered any comments. I am thinking perhaps it is more of a server infrastructure and configuration question, ...
-1
votes
1answer
40 views

2008R2 Server to Server Encryption [closed]

What is the best way to encrypt data between internal servers? We have a few homegrown apps that run on 2008R2 servers that transmit sensitive data. Would an IPSec connection between the two servers ...
1
vote
2answers
105 views

How to limit dynamic DNS updates

First off, I'm sorry if this is vague, but I'm not very familiar with DNS or DNS terminology. What I'm trying to do: I want to limit what hostnames are allowed to dynamically update DNS. I don't ...
1
vote
1answer
1k views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
0
votes
1answer
89 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
1
vote
1answer
2k views

How do I set permissions for uploading media in WordPress? (Ubuntu 14.04.1, nginx 1.4.6)

I'm having trouble finding the correct permissions for running a WordPress site on my droplet. I followed this guide to configure the site: How To Configure Secure Updates and Installations in ...
0
votes
1answer
57 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
0answers
18 views

PHP Change log Centos 7 [duplicate]

Might be a silly question but Im looking at the change log for PHP by running this command - rpm -q --changelog php | grep CVE See all the CVE's listed does that mean they have been patched in the ...
0
votes
2answers
675 views

Can't update to latest PHP version. Centos 7 [closed]

I'm unable to update to the latest PHP package. I ran yum update php and it updated to PHP 5.4.16. Reran the update command to see if there was any newer versions and stated there was no packages ...
0
votes
0answers
30 views

LANCOM 1781VAW disconnects any VPN connection after 1 hour. Why?

I have a small infrastructure here and we are wondering why our lancom-router (1781VAW) disconnects any vpn connection after 60 minutes. how could i troubleshoot this? is this maybe a security ...
1
vote
2answers
56 views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php ...
0
votes
1answer
114 views

Network Security: Lan Manager Authentication Level

I'm a little bit confused by the explanation provided for the setting "Network Security: LAN Manager AUthentication Level" in group policies. The provided explanation only talks about clients and ...
-1
votes
1answer
450 views

How is Docker being used in VPS hosting? [closed]

I'm curious how Docker is being used to host VPS 's ? e.g. I get that it's very fast to boot, but I've heard that security of Docker is not enough to keep people out of the main system... How are ...
0
votes
1answer
54 views

Windows server private shared folders

What is the best practice for sharing private home folders with the users (Windows Fileserver with AD)? I was asked this question today after someone watched this video, and it got me thinking.. ...
4
votes
2answers
87 views

Multiple websites on multiple servers - seperate mysql or not

I currently have 2 Debian servers (VPS with 4 GB memory) and am hosting a variety of websites of differing importance: some are production sites, while others are demo/staging/test sites. ...
1
vote
1answer
69 views

Windows 7 Unchangable AppLocker Rules

I have a windows 7 image that appears to be using an applocker ruleset that I'm unable to modify or disable. Performing the following appears to have no effect on this enforced AppLocker mystery ...