Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
179 views

Why would I have a 4624 (logon) and 4634 (logoff) event at the exact same second?

I'm investigating who was using one of our company computer's a certain time. While I was looking through the 4624 / 4634 events in the event log, I found that several times throughout the day there ...
0
votes
1answer
91 views

TACACS+ configuration: how to receive priv-lvl value?

I need to configure TACACS+ server to know if the given user is authenticated* and what is his priv-lvl. As a client I'm using tactest (tacacs.net) and TACACS+ Client Java Library (AXL). I tried with ...
1
vote
0answers
42 views

Encrypt credentials JNDI authenticating to JBoss 7.1.1.Final

In my JNDI Lookup, connecting to JBoss 7.1.1.Final from remote clients with plain text password is working fine. Now, I am trying to encrypt credentials in the form, but it's not working. ...
0
votes
1answer
38 views

Store OpenLDAP connection on a php session with cookies [closed]

Só I have a ldap server that should be managed via php, I can modify anything in Apache,OpenLDAP or php. But as this site already covered I can't store a LDAP connection in a _SESSION variable on ...
2
votes
1answer
95 views

Allowing remote server access while preventing file transfers [closed]

I am setting up a Linux server that needs to: (1) Allow remote access. (2) Prevent files from being downloaded. Specifically, the server holds data that users will be analyzing, building models with, ...
3
votes
2answers
3k views

How to generate new, 2048-bit Diffie-Hellman parameters with Java keytool?

We are non-experts trying - unsuccessfully so far - to update our web server (JBoss-5.1.0.GA) settings to meet Diffie-Hellman standards. After running a test on https://weakdh.org/sysadmin.html, we ...
1
vote
1answer
36 views

Possibilities and best practises regarding deployment of GPO for the user right “Log on as a service”

Background I have a case where a developer computer is in a environment where the IT department have set up a forced group policy for the user rights assignment policy "Log on as a service". The ...
0
votes
1answer
438 views

How to Make JBoss 5.1.0 GA Meet Diffie-Hellman Standards?

As non-experts on web server administration and security, we are struggling to update our JBoss 5.1.0 GA web server configuration to meet Diffie-Hellman standards. JBoss was installed for us as part ...
0
votes
1answer
53 views

CentOS - make a user run a script on login and exit

Is there a way to lock down an account to when it logs in, it runs a specific command/script and then exits after the action is completed, while keeping it locked out of performing any additional ...
1
vote
3answers
325 views

is it safe to exchange a systems server ssh-keys?

Instead of exchanging ftp/sftp credentials over email is it safer to to exchange a systems ssh-keys over email? If a person didnt have the physical ssh private file, would a hacker be able to gain ...
0
votes
2answers
86 views

Business case: managing company laptops

I've been searching and reading on this topic for a few weeks now, and this is my current understanding of the situation: Use case: employees working on company laptops. They need to be able to work ...
0
votes
0answers
40 views

olcRequires: difference between authz and bind (with olcDisallows: bind_anon)?

With OpenLDAP, what is the difference between: olcDisallows: bind_anon oldRequires: bind and: olcRequires: authc It seems to me that both configurations would require the client to authenticate ...
6
votes
1answer
435 views

How to protect from dangerous bash commands? [closed]

When using bash with or without sudo there are many traps. For example when logged in as root between rm -rf ~/bin and rm -rf /bin there is just one character but this difference can make you ...
0
votes
0answers
39 views

Why do I always get 401 when trying to access main folder of web site?

I am trying to set up a web site on Windows Server 2008 using IIS 7.5. I have created a new application pool (TestAppPool) and a new web site at c:\inetpub\wwwroot\test. I have given the Read/Execute ...
1
vote
0answers
153 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
1answer
344 views

Firewall UDP Flood Dos/DDoS

Recently I have been suffering from what appears to be a UDP query flood attack. I am looking for a way to block the attack using a software firewall such as iptables, this should be possible, as ...
2
votes
1answer
54 views

Can I use a proxy to secure elasticsearch?

I have deployed an open source public web service (elasticsearch) on Ubuntu. Problem is - no security at all (only if you pay). I've researched a bit about blocking ports only to internal requests ...
1
vote
0answers
51 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
2
votes
4answers
383 views

Why do you need the awverify CNAME record for Azure?

See i.e.: How to set up CNAME to point to Azure or the text within the azure portal: Why is this necessary in the first place? Why does pointing the domain name through an A record not prove that ...
0
votes
0answers
35 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
1
vote
0answers
42 views

Public Key Pinning and subdomains [closed]

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
1answer
101 views

Many failed ssh logins even with password authentication off

There are some bots trying to ssh (hundreds per day) all my servers at digital ocean. On /etc/ssh/sshd_config I´ve set: PermitRootLogin without-password PermitEmptyPasswords no ...
-3
votes
2answers
40 views

Modifiying a server securely [closed]

I wanted to purchase a dedicated server to host my site. I am a newcomer to this and wanted to know if I hired someone to secure the server and SSH for me, will that put me at risk? Or is there an ...
-1
votes
1answer
32 views

Webmin - Disallow access by IP [closed]

I have installed a Webmin instance. I can access by both domain:port and ip:port. Is there any way to restrict access to an specific domain name and disallow direct access by IP?
8
votes
2answers
81 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
-1
votes
1answer
18 views

winserver2012 “closed access” permissions to folder

I have some sensitive files, that should be accessed only by a small group of users. Currently the files are stored in a folder, on a WinServer 2012 machine, and will be accessed via a mapped location ...
0
votes
1answer
30 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
0
votes
1answer
56 views

How to save output from grub-md5-crypt to a file ?

I am using Cent OS 6.5 and I want to save the generated output and md5 hash from grub-md5-crypt command to a file. The grub-md5-crypt command asks us to set a password. I want the password(which I ...
3
votes
2answers
955 views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
2
votes
3answers
667 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
0
votes
1answer
41 views

DNS queries are high for non existent records. can safely do a 0.0.0.0 wildcard record?

I have a domain and i am use dnsmadeasy for the DNS. I have noticed the queries are up in the millions each month for records i don't even have. So is it okay to do a wildcard A record such as ...
-1
votes
2answers
27 views

okay to allow any outgoing port for sending mail

I have a small app on my centos6.6 server i am running that allows the user to send an email on a custom port and I am allowing any port to be used. Is there any security risk for allowing this app to ...
0
votes
0answers
112 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
-1
votes
1answer
149 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
98 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
3answers
86 views

SSH and security guidelines

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines. One of these guidelines suggests to disable root user and create a new user that works as an administrator using ...
1
vote
1answer
24 views

Ubuntu production server access configuration recovery options

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server The configuration of SSH is as follows: # ...
-2
votes
3answers
127 views

Is there a GUI tool to log and view outgoing CURL requests from a Linux server? [duplicate]

I've seen several similar questions - but none that truly answer the question. So here goes: PROBLEM: A script is being run on one of our servers that is making outgoing post (and other) requests ...
2
votes
1answer
109 views

Group Policy settings for account policies disappeared

Looking for any ideas, we discovered that our group policies (default policy) was no longer applying our account policies (password age/complexity/history etc). Our DCs still had the local policy ...
0
votes
0answers
174 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
1answer
63 views

Linux DMZ in a Windows Network

I'm a wet-behind-the-ears reluctant sysadmin, so I'm playing catch-up here. I've come across the term DMZ before, but I never looked into it until just recently. In fact I'm still not sure exactly ...
1
vote
1answer
95 views

Using a whitelist too large for an AWS VPC Security Group

I have a large list of IPs I need to whitelist for a VPC instance. I've added as many ranges as possible to the security group until I ran out of available rules. I'm adding rules for HTTP and HTTPS ...
0
votes
1answer
42 views

How to forbid access to admin URL path in Apache config by IP subnet?

I want to only allow a private IP range to be able to access the administrator panel on my site. I found an article explaining how to do it for a specific directory path, such as /var/www/admin/, ...
0
votes
1answer
87 views

Permission issue on windows server

I have logged on to a windows server 2012 R2 machine with local admin account. I was trying to save a file on the hard drive but it says that I do not have permission to save file on the disk. I have ...
0
votes
2answers
157 views

Lost all local admin rights on domain joined computer

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled. On a new domain I'm ...
0
votes
1answer
57 views

Openswan L2TP setup to allow admin user access to AWS VPC

I've got an ssh bastion host, but managing the ssh whitelist is annoying, opening ssh to the world is suboptimal. I'd like to tuck a vpn server in front. Can't get openvpn to stay connected for more ...
0
votes
1answer
26 views

mitmproxy device identification

Currently am experimenting with mitmproxy. I have a setup where I can see all the traffic that is running through. I have multiple mobile devices (ios and android). I have installed the mitm ...
0
votes
1answer
48 views

How to access AD directory user which has no read permission

While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible". I've done the ...
2
votes
1answer
62 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
1
vote
1answer
299 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...