Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
36 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
1
vote
1answer
193 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
0answers
53 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
2answers
23 views

What's the best practice: HTTPS at the webservice level or at the proxy level?

These days I had to deploy several web apps, like Jenkins or jupyter. These apps must be served through HTTPS. I was wondering if it's better to configure HTTPS on each app (listening port, ssl ...
0
votes
1answer
73 views

Hide Original URL using mod_proxy

I have been successfully able to use ProxyPass and ProxyPassReverse to reverse-proxy an application running under a Tomcat Server. However, the challenge is that I want to use a fake URL, to ...
0
votes
1answer
71 views

Should I use amazon VPC or EC2 in this scenario?

My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word ...
0
votes
1answer
44 views

Should a Load balancer be bypassed via server specific URLs?

We have a web farm with an F5 load balancer on Windows 2012 R2. Previously it was configured so that a single url redirected users to a specific machine in the load balanced farm. For example: ...
0
votes
0answers
64 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
2answers
111 views

Fail2ban not banning after update to latest version

I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93. When I start it up, I get two error messages. WARNING ...
0
votes
1answer
37 views

Does TSIG and DNSSEC provide encryption of entire DNS packet?

it says TSIG and DNSSEC provide authentication. Does it mean whole DNS traffic would be encrypted so if I do packet capturing I would not be able to parse anything ? Or DNS data is still plain text ...
0
votes
0answers
61 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They wouldn'...
0
votes
2answers
74 views

Locking down Azure Portal

My company does not want any staff to have access to our corporate Azure account from outside of our offices. So, is it possible to lock down the Azure Portal? Preferably by IP whitelist. I can find ...
1
vote
1answer
63 views

Creating custom AMI in AWS that can be used with a key pair to get the Windows password after launch

I wanted to create a custom AMI for use with Elastic Beanstalk. Up until now I have been logging on to my instance by using the key pair to retrieve the Windows Password. I launched a new instance ...
0
votes
1answer
121 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
2
votes
1answer
261 views

Is there something like a virtual VPN?

I am a small business owner, an ecommerce company, faced with following problem. Current situation. We have an office with a physical location. The office has a Cisco ASA Firewall / Router to connect ...
0
votes
0answers
45 views

How to limit user permissions

I have 2 servers, one web server and one SQL Server. All Windows. Both servers have the same account created with the same password and IIS and SQL Server are configured to use those accounts. I also ...
1
vote
1answer
124 views

Q: Strange web traffic - Is this an attack?

I recently noticed some strange traffic in my nginx access logs. I'm not sure if these indicate an attack, a mistake, or something else. I've started sending these to HTTP 444, so these logs will ...
1
vote
1answer
96 views

Getting heavy traffic from random IP addresses

Digital ocean closed my droplet dude to have traffic on droplet. I made a new droplet(instance) and I am facing the same issue again. My nginx access.log is full of random ip address trying to make ...
0
votes
1answer
81 views

Why are some big corporations still worried about cloud security? [closed]

My company sells an app subscription, which is hosted as SAAS on Amazon Cloud. I have had a few clients who weren't very keen on uploading their documents to my product because my product is hosted ...
0
votes
1answer
54 views

Apache2 HPKP without HSTS

Is there a way to use public key pinning without HTTP Strict Transport Security? Both protocols (http and https) are configured via a respective vhost I need the HTTP connection for an old program, ...
0
votes
0answers
39 views

IIS to SQL Server IPSec configuration

I'm trying to configure 2 servers on a VPC on Amazon AWS to use IPSec. One server has Win2008 R2 with SQL Server 2008 and the other one is a Win 2012 R2 with IIS. I want to secure the connection ...
0
votes
1answer
32 views

IIS Request Filtering per Site

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting ...
-1
votes
2answers
74 views

Vmware Got Hit By Brute Force More Than 60K Attempt

I have a vmware with 2012 server in it. Recently int he vsphere seens alot of attempt. Smells like a brute force. I understand that Security.AccountUnlockTime exists in the ESXi 6.0 that has a lockout ...
-5
votes
2answers
89 views

Does UDP includes of source address?

Both UDP and TCP does not include source address, but how does it say UDP IP spoofing is easier than TCP? For example, the following webpage also says about UDP vulnerability. "Unlike TCP, UDP does ...
0
votes
2answers
52 views

Change apache ssl configuration to nginx config

I want to ask your help to change my apache ssl config to nginx style. Actually i have tried it a googled but SSLEngine on SSLCertificateKeyFile /etc/apache2/ssl/key/netlime_tk.key ...
0
votes
1answer
1k views

MikroTik Configuration - Add a Public Wireless Router (internet only) to Office LAN

Goal Provide internet access for employees' personal devices without providing access to the internal network. Equipment Netgear WNDR4500v2: Wireless router intended for the guest network (has ...
4
votes
0answers
32 views

ransom email, followed by DDos attack [duplicate]

2 days ago, we received an ransom email from Armada Collective, followed by 1 hour of DDos attack. This group has been in the news recently (http://www.forbes.com/sites/thomasbrewster/2015/11/09/...
2
votes
1answer
56 views

fail2ban rules not coming into effect

I have installed the Apache web server on a stock installation of Ubuntu 14.04, and I am trying to use fail2ban to block requests that check for vulnerabilities. I have put the following in /etc/...
0
votes
0answers
24 views

Our server is launching brute force attacks on other websites, please advise [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
-2
votes
1answer
82 views

Lock Down Linux SSH Users

I am wondering if there is a simple way to restrict ssh users accesses so they can only cd to only three directories. /tmp /home/UserID /opt/apps It would also be useful if we could remove ...
0
votes
0answers
151 views

Missing Secure Flag & HttpOnly Flag From Exchange 2013 OWA

I have got a request from one of my clients asking me to add the following flag to OWA's web.config file but I am unable to find the whole flag in the first place. I guess the flag exists in ...
1
vote
1answer
153 views

AWS, NodeJS - Connecting app to Mongodb on another EC2 instance

I am trying to connect my app, running on one EC2 instance, to MongoDB, running on another EC2 instance. I'm pretty sure the problem is in the security settings, but I'm not quite sure how to handle ...
0
votes
1answer
33 views

AV CLI Scanner for Linux [closed]

I need an Anti Virus CLI Scanner for a standalone server (without internet access). OS is RHEL 7, but it must be able to scan windows file systems (for a windows viruses). I'm using a ClamAV, but I ...
1
vote
0answers
67 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
1answer
547 views

SSH everywhere without password, as administrator, is this a good idea?

I have worked in places where it is a common practice to be able to move between all servers, with SSH, as administrator without passwords. There are usually a couple of servers, which by their nature ...
-1
votes
1answer
28 views

Practical effects of setting dev.example.com to 127.0.0.1

The idea is to point a DNS entry to 127.0.0.1, so that it's possible to test "inline installation" of browser extensions. Here's an example service that does this: http://readme.localtest.me/ I'm ...
-2
votes
2answers
48 views

Risks of not updating an Ubuntu server on a local network?

Through work I recently came across a server that is used by 10-20 users daily as a sort of web server. It is running Ubuntu 12 and it has not been updated for a very long time it seems. Currently ...
0
votes
0answers
17 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run as"...
1
vote
2answers
43 views

Reverse proxies and ssl, should I use the same certificates

Currently I'm using nginx as a reverse proxy over https and everything that is proxied is itself over https. SSL termination happens at Nginx and since the traffic is over https it get encrypted again ...
1
vote
2answers
63 views

.htaccess deny/allow rules denying folder, but not direct to files

We have a .htaccess file in a folder configured with deny,allow as follows: Order deny,allow Deny from all Allow from <whitelist IP> Allow from <whitelist IP> .... There are no other ...
1
vote
3answers
249 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
0
votes
1answer
225 views

Office 2010 GPO - Block macros, but still warn about them?

I'm planning on setting up a GPO to disable any unsigned macros in Office 2010 documents. Seems easy enough: Disable all except digitally signed macros: The application displays the Trust Bar for ...
0
votes
1answer
59 views

Nginx & PhpMyAdmin standard practices

I'm currently migrating a small dev server from Apache to Nginx and I'm wondering about the "standard" way to manage PhpMyAdmin : I've simply symlinked the phpmyadmin folder to my nginx site root ...
0
votes
2answers
441 views

Logs: “Received disconnect from…” without the “Accepted” couterpart

I'm seeing lots of logs with this line: Nov 7 03:47:41 s1 sshd[23430]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 05:08:16 s1 sshd[24474]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 06:...
0
votes
1answer
48 views

Track web application access through windows server

I have a web application running on Amazon EC2 accessed on the port 80. I would like to track the users who have accessed my application via windows server log. However when i go on the logs i can ...
0
votes
1answer
105 views

Hyper-V 2012 EAL 4 certified

Is the Hyper-V 2012 (R2) hypervisor EAL4 certfified? I only found an EAL4 certification for Hyper-V 2008, but not for newer products.
1
vote
2answers
46 views

I am unable to deny server filesystem access with a custom DocumentRoot in Apache?

CentOS 7.1 - Apache 2.4.6 Default configuration contains the following: .... <Directory /> AllowOverride none Require all denied </Directory> ... DocumentRoot "/var/www/html" ...
0
votes
1answer
34 views

Did I comprimise this server? [duplicate]

A few days I was working on a new feature on a form. The photo uploader on the form only accepts jpegs, jpgs, and png files. I went to upload a photo on my desktop and accidently selected a PHP file ...
0
votes
0answers
58 views

Prevent my website from being displayed under foreign domains

I'm not sure what's happening but i've just found, that someone has registered domain name *-auth.ga that displays my website. I'm not sure how can i block that kind of issue, i don't just want to ban ...
2
votes
3answers
204 views

AWS Security Groups vs Windows Firewall

Is it considered best practice to disable the Windows Firewall on an Amazon EC2 instance, and control traffic only via EC2 Security Groups? If I open a port on the server firewall, and then open the ...