Security is not a product, but a process.

learn more… | top users | synonyms (1)

12
votes
4answers
4k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
12
votes
9answers
18k views

How to secure a public facing Remote Desktop Server?

I am looking at needing to expose my Remote Desktop Server (Terminal Services) to be accessed from outside our network. Right now, it can only be accessed from inside our network. I know it's easy ...
12
votes
4answers
28k views

Any reason not to enable DoS Defense in my router?

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up ...
12
votes
4answers
1k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
12
votes
3answers
2k views

Apache: Scammers point dozens of domain names at my dedicated IP. How to prevent this?

For the sake of discussion, pretend that I have an Apache webserver which serves a website at www.example.org. This domain name resolves to the public IP address at 192.168.1.100 (pretend this is a ...
12
votes
7answers
7k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
12
votes
7answers
3k views

Storing rarely used single-purpose passwords

How do you handle the storage of passwords that, by nature of their usage, you can't expect administrators to memorize? Such as: Administrator/root password when everyone logs on using their own ...
12
votes
3answers
8k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
12
votes
3answers
12k views

How to perform a secure rsync between servers across an unsecured network

Basically what I'm asking is, has anyone come across a means by which to wrap rsync inside ssh. With OpenSSH v4.9+ sftp has some nice options that allow you to chroot the incoming connection and such ...
12
votes
5answers
22k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
12
votes
3answers
7k views

How do I setup sshd on Mac OS X to only allow key-based authentication?

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely. For security reasons I want to disable remote ...
12
votes
2answers
811 views

How to Isolate PCI Compliance

We currently process, but do not store, credit card data. We authorize the cards via a self developed application using the authorize.net API. If possible, we would like to limit all requirements of ...
12
votes
3answers
14k views

How to set up my own full-featured certificate authority?

I'd like to set up a certificate authority, which I can then import to all the company's browsers and systems to get rid of all those nasty client warnings when using HTTPS or SSL.
12
votes
3answers
1k views

Server credential management for Linux and Windows

We are a relatively small shop (as far as number of sysadmins) with a mix of RHEL, Solaris, Windows 2003 and Windows 2008 servers; about 200 servers in all. For our administrator accounts (root in ...
12
votes
2answers
2k views

How safe are Unattended Upgrades/Automatic Updates for Ubuntu

I'm in the process of trying to keep several ubuntu box's up to date and patched (10.4.2 LTS), one suggestion I've been getting is setting up unattended upgrades ...
12
votes
2answers
9k views

Anything Close to an NSA Guide for Securing RHEL 6 [closed]

Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide ...
12
votes
4answers
10k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate two processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent two ...
12
votes
1answer
4k views

Enable blowfish-based hash support for crypt

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server? I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH. As far as ...
12
votes
5answers
2k views

Reviewing firewall rules

I need to review firewall rules of a CheckPoint firewall for a customer (with 200+ rules). I have used FWDoc in the past to extract the rules and convert them to other formats but there was some ...
12
votes
3answers
1k views

Access control: Windows vs Linux

I'm reading MIT 6.893 lectures on which it says protection in Unix is a mess, no underlying principle, and it also points out that Windows has better alternatives, which can pass privileges from one ...
12
votes
2answers
746 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
11
votes
5answers
3k views

Does Linux really need Anti-Virus (other than hosted file scanning)

A large company is doing a review of our software before they will use the web software built by our start-up company. We are using Linux to host, which is properly secured and hardened. The ...
11
votes
10answers
1k views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
11
votes
11answers
5k views

Server room door security

I wanted to know if anybody had any recommendations as to how to keep the server room secure from employees. There is a lock on the door, however, anybody with a building master (maintenance, owners, ...
11
votes
9answers
6k views

How to disable responses to PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
11
votes
8answers
5k views

How can I download an executable file inside the company network when it's been locked down?

This might seem like a silly (or nefarious) question at first glance, but allow me to elaborate... We have implemented all sorts of measures on the company network and proxy to prevent the download ...
11
votes
4answers
3k views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
11
votes
3answers
6k views

Why does traceroute fail for amazon.com, yahoo.com, and ebay.com?

While troubleshooting performance issues on our network, I ran traceroute on various websites. The following websites would repeatedly not complete traceroute: yahoo.com amazon.com ebay.com ...
11
votes
5answers
10k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
11
votes
4answers
3k views

Securing file system for secure SFTP server

This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
11
votes
3answers
344 views

Suspected server or data vulnerability and reporting a fraud site

Our business is YouGotaGift.com, an online store for gift cards, two days ago someone created a website that's called YoGotaGift.com (You is missing the u), and sent a mail campaign to many people ...
11
votes
2answers
35k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
11
votes
6answers
3k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
11
votes
4answers
24k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
11
votes
2answers
658 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
11
votes
11answers
2k views

Penetration Testing [closed]

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?
11
votes
1answer
18k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
11
votes
2answers
7k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
11
votes
8answers
291 views

What is the first thing you do if your website was hacked?

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
11
votes
3answers
919 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
11
votes
4answers
7k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
11
votes
3answers
8k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
11
votes
1answer
6k views

What's the use of X-Powered-By, Server and other similar HTTP headers?

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of ...
11
votes
2answers
7k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
11
votes
2answers
1k views

Does Debian 6.0 (Squeeze) have buffer overflow protection mechanisms?

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)? Ubuntu has a handy summary table showing the main security features of each ...
11
votes
1answer
211 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
10
votes
7answers
14k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...