Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
90 views

Is storing password hashes in plain text dangerous?

We have a server that is going to be managed through a chef cookbook. Each user for the system is configured using hashes from /etc/shadow. Can we safely store these shadow hashes in our ...
1
vote
0answers
20 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
0
votes
1answer
81 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
2
votes
1answer
365 views

chattr - How to change file +i attribute without using chattr

Here`s the problem. My server got probably hacked. I would like to change a config file, but it is immutable (has the +i attribute), so I can't edit it. trying to execute a "chattr -i" on the file ...
1
vote
2answers
63 views

Ability to use SSH Key / PEM for web authentication in lieu of password protection?

I've been trying to figure out a way to lock down our dev site even more, and the idea came up that instead of using IP centric + Password protection, using something more akin to a PEM key, like I ...
-2
votes
1answer
281 views

Prevent/Stop Namespace Mining [duplicate]

Enviroment: Plesk v12, latest Windows Server 2012 SmarterMail My web hosting provider told me that someone hacked into my server a couple of weeks ago and was hitting various mail servers (Gmail, ...
-2
votes
1answer
73 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
-1
votes
1answer
52 views

Making Private Domain Marriage Public Domain Name - Revisited

I'm building a server with Windows Server 2012 and I've checked many articles on the net about "naming" your internal domain. Interestingly, most of the comments are from 2009. As we all know, times ...
0
votes
1answer
365 views

How to block spambots and about security

Is it normal to have many many lines in /var/log/kern.log about UFW block? For example: Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me ...
1
vote
3answers
480 views

Why does Windows Server 2012 R2 recognize a local administrator over the network for some purposes but not others?

I have researched this at length, but cannot find a solution to the specific issue I'm getting. Evidently there are a number of similar issues that regularly cause problems for people trying to ...
0
votes
1answer
70 views

Under what conditions in Apache installations is AddHandler application/x-httpd-php .php required?

I am a security researcher who has been running into multiple cases where file upload forms can be exploited, allowing attacker-controlled PHP code to be interpreted by the server, leading to remote ...
0
votes
2answers
536 views

IE11: Allow display of local HTML files

How can I enable Internet Explorer 11 that has Enhanced Protected Mode turned on to display local HTML files? This is very annoying also I see the security need behind this feature. Can someone ...
1
vote
0answers
139 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
13
votes
4answers
359 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
0
votes
1answer
48 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
0
votes
0answers
46 views

RHEL 5 with PHP 5.1.6 VS RHEL 6 with PHP 5.3.3: Security implications

Using only the RHEL Repositories, RHEL 5 considers PHP 5.1.6 to be up to date, and RHEL 6 considers PHP 5.3.3 to be up to date. My question is: Are security updates/patches backported so that 5.1.6 ...
2
votes
1answer
3k views

How can I upgrade apache in Ubuntu 14.04 LTS

I'm running an Ubuntu server 14.04 LTS (Long Time Support), it comes with Apache/2.4.7. However, Apache 2.4.10 is out, with some security fixes I'd like to have. So how can I get these security ...
-1
votes
3answers
102 views

Is it possible to configure inheritance for EC2 VPC Security Groups?

We'd like to be able to access the instances in our VPC from the various public IPs that we have in our corporate network. Is it possible to create security groups (like operator-security-group) and ...
2
votes
1answer
170 views

Is the server still vulnerable to attack if we don't turn off cgi.fix_pathinfo?

The /etc/nginx/sites-available/default file that comes with nginx installation has the following content: # You may add here your # server { # ... # } # statements for each of your virtual hosts to ...
0
votes
0answers
38 views

Restrictions for remote Vmware View users

We have a Vmware View VDI infrastructure with several thousands of users that can log on from the internal network and from Internet thru a VMware View Security Server. We want to restrict ...
-1
votes
1answer
72 views

What is it that makes BSD a popular choice for firewalls? [closed]

What is it that makes BSD a popular choice for firewalls? Is the kernel generally more secure?
-1
votes
2answers
50 views

Multiple non-http services, 1 static IP [closed]

I have an issue where we have several non-http(s) services which we would like to access from across the WAN. SSH is a primary protocol we'd be using, FTP as well. Here's how things are laid out. We ...
-2
votes
1answer
40 views

Unix Server Protection from Physical Access?

I'm working to license our software to some buyer. Our software will be ran from an unix server that is physically controlled by the buyer. Is there any way to prevent the buyer who have physical ...
0
votes
1answer
237 views

Is it possible to create a read-only user account for security auditing purposes?

An organization requires several administrators to have a role of a security auditor. They must have read-only (via network/remote) access to Windows Server 2008 / R2 systems and have permissions to ...
0
votes
1answer
463 views

Nginx Password Protect Directory Downloads Source Code

I'm trying to password protect a WordPress login page on my Nginx server. When I navigate to http://www.example.com/wp-login.php, this brings up the "Authentication Required" prompt (not the WordPress ...
0
votes
3answers
299 views

Securely executing system commands as sudo from PHP

Is it possible? I have written a command line tool in PHP for creating new environments for our company. It creates system users, directories, databases, VHosts and restarts apache, amongst other ...
0
votes
0answers
140 views

Cloudfront - How to invalidate objects in a distribution that was transformed from secured to public?

The setting I have an Amazon Cloudfront distribution that was originally set as secured. Objects in this distribution required a URL signing. For example, a valid URL used to be of the following ...
0
votes
3answers
63 views

Is there some free remote sniffer (aka sniffer on free remote server)? [closed]

I have this setup: ________Company LAN_______ _________ . '| _________ | | .| BUNCH OF | ...
0
votes
0answers
106 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
3answers
91 views

How do I restrict a removable NTFS drive to domain access only? [closed]

A fixed NTFS drive in my computer requires a login by me, or if on the corporate network, a login by any domain user. So if the drive is stolen, no one can get at it - correct? But a removable drive ...
0
votes
1answer
567 views

How to block server's internet access and only allow LAN [closed]

I was wondering what the best way to block a server's internet access is while allowing LAN connections. Essentially, I want a server to be only accessible by LAN. What ips, ports, etc should I block? ...
6
votes
1answer
2k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
0
votes
5answers
218 views

Should I change the SSH port to < 1024? [duplicate]

Many server configuration guides recommend that the SSH port should be changed to something > 1024, for obscurity and to avoid conflicts. This is interesting, because it recommends using a port < ...
2
votes
0answers
570 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
0
votes
4answers
100 views

Email + data server for a small company needed?

I am currently working with a small company (10 people), whose main business has nothing to do with IT. But we have some IT-Infrastructure, namely an aging Small Business 2003 server, which runs ...
2
votes
4answers
689 views

/etc/hosts.deny ignored in Ubuntu 14.04

I have Apache2 running on Ubuntu 14.04LTS. To begin securing network access to the machine, I want to start by blocking everything, then make specific allow statements for specific subnets to browse ...
0
votes
1answer
295 views

Securing MySQL debian-sys-maint

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password. This bothered me as the default situation, ...
0
votes
1answer
206 views

I think my server was hacked - how do i know what has been changed? [duplicate]

I have read the following posts which didn't answered my questions: - My linux server was hacked. How do I find out how and when it was done? - How do I know if my Linux server has been hacked? - and ...
1
vote
1answer
44 views

What are (if any) possible scenario whereby hacker can find multiple sites hosted in one VPS?

Let me clarify: Say that I have 10 sites hosted in one VPS host. And for some reason, one of these sites gets famous and a hacker wants to know where it is hosted, and how many other sites are hosted ...
6
votes
4answers
583 views

Security of Apache DocumentRoot

I have a general question about security of Apache DocumentRoot, which comes from a statement I read when installing Galaxy, a bioinformatic web service and infrastructure. The statement says ...
-2
votes
1answer
165 views

Is the Datadog install script safe to run? [closed]

I have a production server (CentOS 6, Apache, Nginx, MySQL, PHP, wordpress). I want to see some metrics (e.g., load bandwidth, RAM, CPU and so on). I chose a Datadog for this task. The instructions ...
1
vote
1answer
542 views

Apache 2.4/PHP-FPM ProxyPassMatch and access restriction

I've got Apache/PHP setup exactly like this: https://wiki.apache.org/httpd/PHP-FPM It includes the ProxyPassMatch rule as mentioned: ProxyPassMatch ^/(.*\.php)$ ...
2
votes
2answers
331 views

EC2 & MySQL security

The current infrastructure contains two servers located in Amazon EC2: application server, and MySQL server. Concern: security of communication between the application server and the database, ...
2
votes
2answers
845 views

Advanced Audit Policy not getting applied on 2012 R2

I have configured several avanced audit policy settings under: Computer Configuration => Policies => Windows Settings => Security Settings => Advanced Audit policy Configuration => ...
0
votes
1answer
66 views

Should I still disable root if I disable password authentication and enable only key authentication?

I'm new to the linux world and I've been reading a few tutorials on security. I've seen some questions on StackExchange tackling this subject, but from what I've seen, none of the answers clarified ...
0
votes
0answers
108 views

Ssecurity Log (Audit Event 5140) ipc$

The security log on my file server is filling up with Event 5140 for connections to \*\IPC$ This makes my security log useless for auditing file share events. How do I disable auditing security ...
0
votes
2answers
72 views

Remote login terminal

I have an unusual request. I have a box - running Fedora 19 - that I'm using as a server. I have a crappy Atom netbook - also running Fedora - that isn't good for anything. I was wondering if there is ...
0
votes
1answer
83 views

Interpreting ** RABHIT ** logs - Potential Attak - SYN?

I am hosting a web on a Linux - Debian Wheezy x64. Our Web Server is LiteSpeed using APF-Firewall and DDoS-Defeat Recently, we are getting logs of below sort, telling us it may be a potential ...
27
votes
3answers
2k views

Is it safe to reboot a server open to the internet?

Specifically I have an iptables ruleset defined on a server running CentOS. Am I guaranteed / can I guarantee / how can I guarantee that when networking comes online (either at machine boot, or after ...
0
votes
1answer
424 views

Installing VirtualBox and restricting NAT and Bridged Network Adapters for Corporate Security

I work as a developer in a security heavy finanical services company. As a group we are finding that our Windows 7 workstation security policy is preventing us from performing our jobs. We do not ...