Security is not a product, but a process.

learn more… | top users | synonyms (1)

11
votes
10answers
1k views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
11
votes
4answers
3k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
11
votes
8answers
4k views

How can I download an executable file inside the company network when it's been locked down?

This might seem like a silly (or nefarious) question at first glance, but allow me to elaborate... We have implemented all sorts of measures on the company network and proxy to prevent the download ...
11
votes
3answers
5k views

Why does traceroute fail for amazon.com, yahoo.com, and ebay.com?

While troubleshooting performance issues on our network, I ran traceroute on various websites. The following websites would repeatedly not complete traceroute: yahoo.com amazon.com ebay.com ...
11
votes
9answers
13k views

How to secure a public facing Remote Desktop Server?

I am looking at needing to expose my Remote Desktop Server (Terminal Services) to be accessed from outside our network. Right now, it can only be accessed from inside our network. I know it's easy ...
11
votes
5answers
9k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
11
votes
3answers
2k views

Apache: Scammers point dozens of domain names at my dedicated IP. How to prevent this?

For the sake of discussion, pretend that I have an Apache webserver which serves a website at www.example.org. This domain name resolves to the public IP address at 192.168.1.100 (pretend this is a ...
11
votes
5answers
17k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
11
votes
3answers
337 views

Suspected server or data vulnerability and reporting a fraud site

Our business is YouGotaGift.com, an online store for gift cards, two days ago someone created a website that's called YoGotaGift.com (You is missing the u), and sent a mail campaign to many people ...
11
votes
6answers
2k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
11
votes
2answers
604 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
11
votes
6answers
24k views

How to check that an OpenVPN server is listening on a remote port without using OpenVPN client?

I need to check that an OpenVPN (UDP) server is up and accessible on a given host:port. I only have a plain Windows XP computer with no OpenVPN client (and no chance to install it) and no keys needed ...
11
votes
11answers
2k views

Penetration Testing [closed]

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?
11
votes
8answers
291 views

What is the first thing you do if your website was hacked?

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?
11
votes
2answers
6k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
11
votes
3answers
10k views

How to perform a secure rsync between servers across an unsecured network

Basically what I'm asking is, has anyone come across a means by which to wrap rsync inside ssh. With OpenSSH v4.9+ sftp has some nice options that allow you to chroot the incoming connection and such ...
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
11
votes
3answers
902 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
11
votes
3answers
13k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
11
votes
3answers
6k views

How do I setup sshd on Mac OS X to only allow key-based authentication?

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely. For security reasons I want to disable remote ...
11
votes
4answers
5k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
11
votes
1answer
3k views

Enable blowfish-based hash support for crypt

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server? I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH. As far as ...
11
votes
1answer
187 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
11
votes
2answers
493 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
10
votes
7answers
13k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
10
votes
4answers
723 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
10
votes
11answers
5k views

Server room door security

I wanted to know if anybody had any recommendations as to how to keep the server room secure from employees. There is a lock on the door, however, anybody with a building master (maintenance, owners, ...
10
votes
5answers
4k views

How did Matasano get hacked?

from: http://seclists.org/fulldisclosure/2009/Jul/0388.html If I understand it best from the posts from: http://news.ycombinator.com/item?id=723798 the Matasano guys left sshd internet accessible - ...
10
votes
9answers
6k views

How to disable responses to PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
10
votes
9answers
4k views

Multiple *NIX Accounts with Identical UID

I am curious whether there is a standard expected behavior and whether it is considered bad practice when creating more than one account on Linux/Unix that have the same UID. I've done some testing on ...
10
votes
6answers
4k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
10
votes
2answers
3k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
10
votes
5answers
3k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
10
votes
7answers
611 views

Career shift to security - learning tracks? [closed]

I've had to learn enough to be dangerous (if only to myself), managing the firewalls, switches, etc for small networks over the past ten years. However, I know there's a pretty massive gap between ...
10
votes
14answers
39k views

How to securely join two networks together over the Internet?

Let's say there are two locations. Both locations have their own fast Internet connections. How do you join these two networks together such that every computer can see every other computer? Do you ...
10
votes
7answers
507 views

Where to maintain central source repository?

What is the industry best practice regarding securing access to source code? I am thinking SSL only connections via apache allowed over to our server on an obscure port that doesn't conflict with ...
10
votes
6answers
13k views

What is the best way to find Conficker infected PCs in company networks remotely?

What is the best way remotely to find Conficker infected PCs in company/ISP networks?
10
votes
4answers
3k views

Securing file system for secure SFTP server

This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
10
votes
7answers
25k views

Is using integrated security (SSPI) for accessing SQL Server better for web applications?

When deploying web applications (.net) to a production environment, is it better to use integrated security or does it even matter? It seems to me that if a hacker breaks the web server, it won't ...
10
votes
3answers
1k views

Security considerations of WPA versus WPA2?

As we replacing our existing WEP infrastructure across multiple offices, we are weighing the value of upgrading to WPA versus WPA2 (both PSK). We have several different types of devices that do not ...
10
votes
8answers
5k views

Best file system for external (USB) hard drives/USB memory media

Almost all external USB hard drive and USB memory media/sticks come today preformatted with FAT32. As far as I know the only advantage of the file system is the compatibility among OSes and devices. ...
10
votes
5answers
628 views

Tips to gracefully take over a (UNIX) production server

After months of neglect, e-mail flames and management battles our current sysadmin was fired and handed over "the server credentials" to me. Such credentials consist in a root password and nothing ...
10
votes
7answers
4k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
10
votes
5answers
2k views

Prevent execution of Windows executables

Is there any way to tell Windows (XP and above) not to execute files (*.exe files), which are present in drives/folders other than certain folders, that I mention? In short I want executables from ...
10
votes
4answers
32k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
10
votes
3answers
472 views

piping a password and security

I sometimes do echo "secret" | mysql -u root -p .... Now I'm concerend about security here: can someone listing all processes see the password? To check I tried with echo "test" | sleep 1000 and the ...
10
votes
2answers
257 views

Should the virtualization host be allowed to run any service?

I recently setup a virtualization server for the small company I'm running. This server runs few virtual machines that are used for development, testing, etc... My business partner works from a ...
10
votes
3answers
27k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
10
votes
4answers
6k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...