Security is not a product, but a process.
9
votes
2answers
2k views
How to Protect Sensitive (HIPAA) SQL Server Standard Data and Log Files
I am dealing with electronic protected health information (ePHI or PHI) and HIPAA regulations require that only authorized users can access ePHI. Column-level encryption may be of value for some of ...
9
votes
2answers
4k views
My linux server was hacked. How do I find out how and when it was done?
I have a home server running a desktop ubuntu distribution. I found this in my crontab
* * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1
and when looking in that directory ...
9
votes
2answers
2k views
Enable blowfish-based hash support for crypt
How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server?
I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH.
As far as ...
9
votes
2answers
423 views
How did spammer spoof emails with my google apps domain (it even has DKIM!)
I have been getting a lot of bounce-backs lately.
I thought my google apps account has been compromised, but there is no activity on my apps account, and there is certainly no malicious user that I ...
9
votes
2answers
642 views
Does Debian 6.0 (Squeeze) have buffer overflow protection mechanisms?
My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)?
Ubuntu has a handy summary table showing the main security features of each ...
8
votes
4answers
667 views
Updating Malware cleaning skills
I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
8
votes
9answers
2k views
What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?
Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
8
votes
9answers
3k views
Who can eavesdrop on a user's HTTP traffic?
I have heard many times that HTTPS should be used for transferring private data, since HTTP is vulnerable to eavesdroppers. But in practical terms, just who is capable of eavesdropping on a given ...
8
votes
6answers
505 views
First time opening an SSH server to internet, what to check
I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it).
...
8
votes
3answers
2k views
Why does traceroute fail for amazon.com, yahoo.com, and ebay.com?
While troubleshooting performance issues on our network, I ran traceroute on various websites. The following websites would repeatedly not complete traceroute:
yahoo.com
amazon.com
ebay.com
...
8
votes
12answers
1k views
Securing SSH server against bruteforcing
I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN servern... but do want it to be secure.
I just renewed my ...
8
votes
4answers
604 views
Git commit auditing
I have a git server running over ssh and each user has a unix account on the system.
Given that two users have access to a repo, how can I be sure which user performed which commit, since the commit ...
8
votes
8answers
414 views
Servers harrassed by individual on constantly changing IPs
We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
15answers
2k views
How to manage rack keys?
As a result of a security audit there's the need to lock the racks and manage the keys:
Keep the keys safe
Record key usage
Complying with these two requirements has many challenges as there are a ...
8
votes
3answers
464 views
What are some best practices when taking over IT at a new company?
I thought this would make for a good topic with some interesting suggestions.
What are the first things you would do when taking over IT at a new organization?
What are some red flags you would look ...
8
votes
6answers
477 views
Security Admins toolkit? What's in yours? [closed]
Resource question :- I need to collate a list of security admin tools
For:
Web
Network
Wifi
Server unix/Linux/windows/macosx
SQL
Xss
Please state
-links/version/os used/free v buy
8
votes
4answers
2k views
Securing file system for secure SFTP server
This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
8
votes
6answers
1k views
What should every sysadmin know before administrating a public server?
Similar to this question on Stack Overflow, what should a sysadmin who is used to private, intranet-type situations know before being the administrator of a public site?
These could be security ...
8
votes
5answers
343 views
Is setting a very strong password enough to secure an SSH on port 22?
Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols ...
8
votes
5answers
592 views
8
votes
4answers
1k views
When is it appropriate / prudent to use chroot?
I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
8
votes
8answers
2k views
How to secure a public facing Remote Desktop Server?
I am looking at needing to expose my Remote Desktop Server (Terminal Services) to be accessed from outside our network. Right now, it can only be accessed from inside our network.
I know it's easy ...
8
votes
5answers
555 views
How to check that a known Windows Vulnerability has been patched?
Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service
Windows 2008 R2 SP1
8
votes
5answers
1k views
Using gmail as your primary mail server
I have read that there is an option of using Gmail as your primary mail server. In the sense that you can add mx records etc and you do not have to do it on your own server.
Do you think this is a ...
8
votes
2answers
3k views
Is SSH Key Exchange more secure than password authentication?
Remote users connect to several services at our main office over the internet using SSH. The SSH password is synched with their LAN A/D account.
Would having users bring a copy of an SSH key home ...
8
votes
6answers
4k views
Is it possible to create your own root DNS server?
I'm curious. I keep reading about how our ISPs and internet middle men record and keep track of all DNS requests basically leaving a trail of breadcrumbs in many logs, and also allowing DNS hijacking ...
8
votes
5answers
267 views
Securing Acrobat Reader to mitigate viruses
Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
8
votes
5answers
376 views
How good/safe are disk to disk backups?
In the good old days, backups went to tapes, some of which were often offline if not offsite. This made it difficult to destroy all backups (accidentally or maliciously), especially if the ...
8
votes
3answers
11k views
Failed to generate a user instance of SQL Server
I'm using Windows 7 Beta and trying to install a web application locally. This web site uses Microsoft SQL Server 2005 Express (SQLEXPRESS) and a MDB file in the web site's ~/App_Data folder. I was ...
8
votes
6answers
400 views
Why shouldn't root be allowed to login via ssh?
why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
8
votes
6answers
523 views
ddos. Are we that helpless?
With recent DDOS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
8
votes
5answers
664 views
Is it risky to have a database server and a web server on the same machine?
It seems like life would be simple to run the database server on the same machine as the web server, but are we taking a big secuirty risk by doing this?
The environment will be Windows 2008 server, ...
8
votes
4answers
593 views
Remote Root Login
I know one of the first things you do to secure a server is disallowing remote root login.
Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
5answers
5k views
OSX - Full Disk Encryption
What options are available for OSX full disk encryption? Which of them is the best?
8
votes
2answers
583 views
What the heck is really going on in these Lion LDAP vulnerability reports?
Just read a Slashdot thread on LDAP brokenness on OSX. Can anyone explain exactly what is being secured by OpenLDAP and why anything other than data stored on a Lion machine might be at risk?
A quote ...
8
votes
4answers
332 views
Who gets root access?
I'm working on a web application which handles some sensitive data. We're getting pretty tight on security, and laying out policies to lock down access to machines, and log everything for technical ...
8
votes
1answer
2k views
SSH passphrase remembered in MacOSX Snow Leopard
I am facing a very strange situation with Snow Leopard.
I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
8
votes
5answers
8k views
What steps should I take to secure Tomcat 6.x?
I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible.
I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory ...
8
votes
4answers
2k views
How to manage a web servers SSL private key protection (password vs. no password)?
We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key.
The web server needs access to the private key for the encryption ...
8
votes
5answers
7k views
A secure, standard iptables rule-set for a basic HTTP(s) webserver
I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
8
votes
4answers
2k views
Use standard USB flash disk as security token
We want our users in company to login their computers by using their USB Flash Disks or something else. Is there a way to achieve this without buying a USB token from a company ?
8
votes
1answer
344 views
Who do I report a hacked server to?
This server http://62.193.248.163/ is used to hack Trixbox 2.6 PBX's.
I can't tell if this server is a customers of http://www.amenworld.com/, or is it is actually one of theirs?
Who should I report ...
8
votes
5answers
727 views
Web Based (and Encrypted) Password/License/Etc Database
Looking for a system to store the many credentials I use as a consultant/contract programmer. While I know I could use KeePass or similar for desktop use, or something like PassPack for web based ...
8
votes
1answer
2k views
Is LXC secure enough for VPS hosting?
Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ ...
8
votes
2answers
3k views
Free OCSP server for testing purposes?
Can anyone recommend a free and simple OCSP server for Windows or Linux?
8
votes
2answers
150 views
Dealing with SMTP invalid command attack
One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands.
In the past two days:
incoming smtp ...
8
votes
3answers
524 views
Unsecured MySQL 'root'@'localhost' account accessed remotely?
A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
8
votes
4answers
993 views
Stopping a DOS attack
One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
8
votes
1answer
200 views
Where can I embed proprietary information in a layer 2 or layer 3 packet?
The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
8
votes
2answers
446 views
Is there a way to force all cPanel users to change their passwords one time?
One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password ...
