Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
3answers
669 views

How is a private data center more secure than a public cloud?

I have customers in the financial services industry that insist that a SaaS hosted on public clouds like Amazon's are not as secure as colocation in a private data center. However, I can't find ...
1
vote
1answer
355 views

Security risks of using Google DNS to resolve names on a private net (192.168.x.x)?

Are there any known risks associated with using a public DNS versus a DNS which we or our partners control? Our solution involves a few embedded devices so using Google DNS would give us a degree of ...
-2
votes
1answer
151 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
-1
votes
1answer
144 views

IIS 8.5 Securing FTP [closed]

I have a IIS installation on Windows Server 2012 R2. I need to provide FTP access to a website. Its only one person. The easiest way to make it secure is to make an ip-restriction and only ...
0
votes
0answers
52 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
0
votes
1answer
89 views

“File not found” from bash script executed by Apache (CentOS)

I have a bash script that sets up a classpath for accessing a series of JARs (it's tf, the cross-platform, command line tool for Team Foundation Server). The file structure is something like: ...
1
vote
1answer
730 views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
0answers
63 views

Failed logons not being audited Server 2008r2

We recently configured advanced auditing on our Windows Server 2008 R2 domain and now the domain controller is not displaying failed user login attempts. There are some 4625 login failures, but none ...
1
vote
2answers
319 views

Is PHP 5.3.3 on RHEL 6.5 receiving security fixes?

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check: $ php -v PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08) However, the PHP website claims that ...
2
votes
1answer
539 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
5
votes
1answer
2k views

Why are some CentOS 5 boxes still vulnerable to ShellShock after upgrading Bash?

I have two CentOS 5.10 boxen where I have upgraded bash to the latest version. However, in one of the boxes, bash is still vulnerable to CVE-2014-7169 (I am using the test from this ServerFault ...
3
votes
1answer
325 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
1
vote
1answer
308 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
206 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [closed]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
1
vote
1answer
241 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...
0
votes
0answers
86 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
1answer
41 views

MySQL via SSL on VPC private subnet

Is an SSL connection recommended when connecting to a MySQL database server via a private subnet? SSL provides encryption but SSL causes a performance hit. The MySQL database server only serves ...
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
68
votes
6answers
48k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
3
votes
4answers
162 views

Disable Windows Share Without Administrator Access

We have a folder on a windows server shared to provide access to an important application. When the application is being updated we (DBAs) change the permissions on the share to deny all access to it ...
1
vote
2answers
75 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
1
vote
1answer
144 views

Roundcube does not add IP address information into sent emails

Usually the mail client is supposed to add IP information into emails, in order for the sender to be tracked. But when you send emails from Roundcube Webmail/0.8.4+, the IP address of the server is ...
0
votes
1answer
29 views

Set base directory for dynamic virtual hosts

I use Dynamic VirtualHosts for a hosting service I run. Currently, it only allows static sites, however I'm working on a new version which will support PHP. This clearly opens some security issues. ...
0
votes
0answers
45 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
2answers
296 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
132 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
-3
votes
1answer
65 views

Securing a LAN whose wires cross over public hallway? [closed]

I want to record video in rooms (A B C) and start/stop/monitor the recordings from (only) room D. There is a public hallway separating D from the rest, and the data is sensitive. Preliminary setup ...
7
votes
2answers
259 views

Storing AWS credentials securely on a personal machine

How can I securely store AWS credentials on personal machines? In detail: Everybody in our team requires AWS security credentials for doing administrative tasks (credentials are separated by role). ...
-3
votes
3answers
105 views

How to find out who accessed a document? [closed]

I got a call today from a friend asking for help, it is not my area, he is from a school, it is a big institution. They have 2 windows 2003 server sp 1, one for MS Sql and the other is Domain ...
1
vote
1answer
296 views

Detect files of folders which do not inherit permissions from their parent

Is there an easy way to find any files/folders (recursively) within a directory which do not inherit permissions from their parent. i.e. To gauge the effects of selecting "replace permissions on ...
0
votes
3answers
230 views

Why do we really need apache + php if php can run as web server?

A few months ago i did an experiment that kinda went out very well, today we have an intranet portal using the following technologies: JeasyUI phpgrid Kibana So, based on our tests why do we need ...
0
votes
1answer
229 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
171 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
0
votes
2answers
452 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
1
vote
0answers
38 views

Most secure way to encrypt critical data to be shared, edited and seen (must ALWAYS be secure)

This question does not rely on time... so it's not about keeping data on tape or anything similar. I have 3 distinct PCs with critical information. PCs are running Windows OS. They all hold critical ...
-1
votes
3answers
177 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
7
votes
1answer
3k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
0
votes
0answers
405 views

Check for SSL Weak Ciphers SSL3_RSA_RC4_128_MD5, SSL3_RSA_RC4_128_SHA, TLS1_RSA_RC4_128_MD5, TLS1_RSA_RC4_128_SHA

I am getting a serve ready for PCI compliance, and have one area with crypto from apache with the following report: Weak ciphers offered by this service: SSL3_RSA_RC4_128_MD5 SSL3_RSA_RC4_128_SHA ...
-1
votes
1answer
199 views

Is www-data considered a non-privileged user on Apache?

Great Apache Hardening post that recommends "Run Apache from non-privileged account" because "Default apache configuration is to run as nobody or daemon." Is www-data:www-data considered a ...
0
votes
1answer
35 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?
0
votes
1answer
209 views

Security Auditing on Ubuntu 14.04 LTS

The Tiger security auditing tool has been a standard install in the past. However, it doesn't look like Tiger is being updated. Is Tiger still a valid security auditing tool on Ubuntu 14.04. If ...
4
votes
2answers
650 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
19
votes
2answers
2k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
1
vote
0answers
126 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
1
vote
1answer
91 views

Is storing password hashes in plain text dangerous?

We have a server that is going to be managed through a chef cookbook. Each user for the system is configured using hashes from /etc/shadow. Can we safely store these shadow hashes in our ...
1
vote
0answers
22 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
0
votes
1answer
90 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
2
votes
1answer
411 views

chattr - How to change file +i attribute without using chattr

Here`s the problem. My server got probably hacked. I would like to change a config file, but it is immutable (has the +i attribute), so I can't edit it. trying to execute a "chattr -i" on the file ...
1
vote
2answers
71 views

Ability to use SSH Key / PEM for web authentication in lieu of password protection?

I've been trying to figure out a way to lock down our dev site even more, and the idea came up that instead of using IP centric + Password protection, using something more akin to a PEM key, like I ...
-2
votes
1answer
324 views

Prevent/Stop Namespace Mining [duplicate]

Enviroment: Plesk v12, latest Windows Server 2012 SmarterMail My web hosting provider told me that someone hacked into my server a couple of weeks ago and was hitting various mail servers (Gmail, ...