Security is not a product, but a process.

learn more… | top users | synonyms (1)

-1
votes
1answer
28 views

Practical effects of setting dev.example.com to 127.0.0.1

The idea is to point a DNS entry to 127.0.0.1, so that it's possible to test "inline installation" of browser extensions. Here's an example service that does this: http://readme.localtest.me/ I'm ...
-2
votes
2answers
47 views

Risks of not updating an Ubuntu server on a local network?

Through work I recently came across a server that is used by 10-20 users daily as a sort of web server. It is running Ubuntu 12 and it has not been updated for a very long time it seems. Currently ...
0
votes
0answers
16 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run ...
1
vote
2answers
42 views

Reverse proxies and ssl, should I use the same certificates

Currently I'm using nginx as a reverse proxy over https and everything that is proxied is itself over https. SSL termination happens at Nginx and since the traffic is over https it get encrypted again ...
1
vote
2answers
63 views

.htaccess deny/allow rules denying folder, but not direct to files

We have a .htaccess file in a folder configured with deny,allow as follows: Order deny,allow Deny from all Allow from <whitelist IP> Allow from <whitelist IP> .... There are no other ...
1
vote
3answers
224 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
0
votes
1answer
211 views

Office 2010 GPO - Block macros, but still warn about them?

I'm planning on setting up a GPO to disable any unsigned macros in Office 2010 documents. Seems easy enough: Disable all except digitally signed macros: The application displays the Trust Bar for ...
0
votes
1answer
57 views

Nginx & PhpMyAdmin standard practices

I'm currently migrating a small dev server from Apache to Nginx and I'm wondering about the "standard" way to manage PhpMyAdmin : I've simply symlinked the phpmyadmin folder to my nginx site root ...
0
votes
2answers
346 views

Logs: “Received disconnect from…” without the “Accepted” couterpart

I'm seeing lots of logs with this line: Nov 7 03:47:41 s1 sshd[23430]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 05:08:16 s1 sshd[24474]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 ...
0
votes
1answer
48 views

Track web application access through windows server

I have a web application running on Amazon EC2 accessed on the port 80. I would like to track the users who have accessed my application via windows server log. However when i go on the logs i can ...
0
votes
1answer
96 views

Hyper-V 2012 EAL 4 certified

Is the Hyper-V 2012 (R2) hypervisor EAL4 certfified? I only found an EAL4 certification for Hyper-V 2008, but not for newer products.
1
vote
2answers
46 views

I am unable to deny server filesystem access with a custom DocumentRoot in Apache?

CentOS 7.1 - Apache 2.4.6 Default configuration contains the following: .... <Directory /> AllowOverride none Require all denied </Directory> ... DocumentRoot "/var/www/html" ...
0
votes
1answer
34 views

Did I comprimise this server? [duplicate]

A few days I was working on a new feature on a form. The photo uploader on the form only accepts jpegs, jpgs, and png files. I went to upload a photo on my desktop and accidently selected a PHP file ...
0
votes
0answers
58 views

Prevent my website from being displayed under foreign domains

I'm not sure what's happening but i've just found, that someone has registered domain name *-auth.ga that displays my website. I'm not sure how can i block that kind of issue, i don't just want to ban ...
2
votes
3answers
180 views

AWS Security Groups vs Windows Firewall

Is it considered best practice to disable the Windows Firewall on an Amazon EC2 instance, and control traffic only via EC2 Security Groups? If I open a port on the server firewall, and then open the ...
0
votes
1answer
30 views

Prevent Coldfusion server from writing uploaded files to disk

Coldfusion writes uploaded files to it's temporary folder, where the cffile tag will pick it up. However I want my server to ignore uploaded files and not have them written to disk at all. How can I ...
1
vote
0answers
48 views

Allowing IIS_IUSRS to encrypt & decrypt files [closed]

I have a simple ASP.NET site (on Windows Server 2012 R2 & IIS 8.5) for uploading files to a server. I would like to automatically encrypt these files using Windows' built-in Cryptographic Service ...
1
vote
0answers
21 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
2
votes
0answers
33 views

Forced to change expired password when using ssh key

I am working in an environment where I have an account on multiple linux machines where accounts and passwords are managed independently (no active directory/LDAP/etc) and passwords expire every 30 ...
2
votes
1answer
90 views

Detecting/preventing malicious outlook rules

Attackers like to abuse Outlook for a variety of purposes. For example, an attacker could auto forward emails to a remote address or persist inside a network by creating client-side rules that ...
0
votes
0answers
23 views

If cron as www-data/apache user have security issue?

Last year I checkout a server where I found some exploit bash script in /tmp folder which download a binary file from 3rd party server. When I further checked it, I found apache user's cron entry for ...
0
votes
2answers
255 views

permission denied on authorized_keys

I am attempting to set up SFTP for chrooted users, and use SSH public key authentication. In this example I'll be working with the dummy user "globocorp" who's a member of "sftpusers". This user is ...
-4
votes
3answers
171 views

If no service is listening on a port can a system still be accessed using that port? [closed]

If I have a linux server with a FW rule (iptables) to allow inbound to a particular port does a service have to be running and listening to accept that connection or is there another way to access the ...
0
votes
0answers
31 views

Securing ports on Linux with multi-factor authentication

I have dedicated Ubuntu server in the Internet so I want to: Connect to my server via HTTP(s) Input password and MFA token (i.e. Google Authenticator token) If both are correct, server executes ...
1
vote
1answer
29 views

Allowing Pubkey OR Password Authentication for Chrooted users

I manage a legacy system that numerous clients connect to in order to consume large files of scientific data. Currently these users connect via SFTP, and because of the huge diversity of experience ...
0
votes
1answer
315 views

How to prevent password expiration in apache Archiva

I am running a standalone Archiva 2.2.0 installation. I added security.properties file to ~\conf directory. In security.properties I defined: security.policy.password.expiration.days=999999 ...
1
vote
2answers
60 views

How to secure network against connecting bad device with DHCP?

I have a network with 500+ computers, at my area there is lots of cooperation companies that sometimes bring their own routers. If they do it in sneaky way and do not turn off DHCP service on the ...
1
vote
4answers
339 views

Webserver exposes client real IP address in OpenVPN network

One of our corporate websites run on Linux server, built with Apache2 and PHP5. Several web pages can only be accessed from OpenVPN subnet (addresses 10.8.0.1/24). To check each request, php script ...
0
votes
2answers
91 views

Not getting credential prompt on Win Server 2012 for Ubuntu Samba share

I set up a share in Ubuntu with read/write permissions using system-config-samba. I configured my user to also be a smbuser. On all of my other systems (2 Win10, 1 Win8, 1 Ubuntu) I am prompted to ...
2
votes
1answer
211 views

Powershell Remoting security implications by adding users to WinRMRemoteWMIUsers

In our current workflow, we have to RDP to several servers just to know if a service is up-and-running. We do not have admin rights to those servers but are allowed to view, start and stop services. ...
0
votes
1answer
37 views

Cassandra security using openssl (not keytool)

I saw Cassandra documentation. http://docs.datastax.com/en/cassandra/2.1/cassandra/security/secureSSLCertificates_t.html I found this line "SSL certificates must be generated using keytool". But I ...
2
votes
0answers
155 views

Spring Shiro is not authenticating login screen in SpringMVC web application

I am trying to use Apache Shiro framework 1.2.4 for security requirements of our Spring MVC web application. I have included configuration details in the application context, pom.xml and web.xml ...
-1
votes
2answers
55 views

ESXi 5.5 Isolate Network [closed]

I have recently acquired a poweredge running esxi 5.5, and am creating a network for pentesting purposes. Currently my main network and the pentesting network are entirely seperate entities, having no ...
0
votes
1answer
44 views

Tomcat startup with security-manager - CentOS

I've seen this topic before, and the solution given works. However, it doesn't fit in my needs, since it's granting read access to every directory, by setting this catalina.policy: grant { ...
1
vote
1answer
133 views

PCI compliance Apache versions [duplicate]

We are working with current version of Apache 2.4. 6 available in a Centos 7 repos. Installed with yum. and we are dealing with the PCI compliance and the report says: IP Address: x Host: x Path: ...
0
votes
0answers
39 views

Power User with Elevated Access on Domain Network

We have new IT Helpdesk staff joined our firm and we'd like to provide them with an account with power user privileges in such they can only elevate access on user computers to install, uninstall ...
2
votes
1answer
496 views

ejabberd: set Diffie-Hellman (DH) ciphers bitsize to >= 2048

In the modern version of ejabberd there is a possibility to use custom Diffie-Helman parameters by providing a self-generated pem-file to the dhfile and s2s_dhfile options in ejabberd.yml. I had ...
1
vote
1answer
20 views

Where does Flash Player store its trusted site list on Linux?

Specifically, we have a fairly large network of HP thin clients running HP ThinPro (a variant of Debian) with Adobe Flash Player pre-installed. We have a new application coming to the network which ...
1
vote
0answers
16 views

Preventing abuse when running recursive DNS forwarder [closed]

I have a running instance of Unbound on a server, which forwards certain personal non-ICANN domains to authoritative DNS servers on the same machine, and forwards everything else (com, net, etc) to ...
2
votes
1answer
332 views

Possible Cisco Router Hack?

We have a Cisco EPC3928AD EuroDocsis 3.0 2-PORT Voice Gateway from our ISP. The router is connected to a firewall (an Ubuntu-box running iptables and Wireshark). Our LAN (10.0.0.1/24) is beyond the ...
1
vote
2answers
887 views

Server got hacked by some Crypto Lockers [duplicate]

My server (CentOS) recently got hacked by some Crypto Hackers. They encrypted all of my files and asking for ransom to decrypt the files. They kept a message in all folders, which start like this ...
1
vote
0answers
11 views

Securing APIs with oAuth

I've been reading up on oAuth the last few days but there is one thing that is not totally clear to me. So I've got this oAuth Authorization Server which (skipping a few steps in between here) in the ...
7
votes
2answers
393 views

Why should you disable network login for local accounts?

This question is in reference to @SwiftOnSecurity's Twitter thread: https://twitter.com/SwiftOnSecurity/status/655208224572882944 After reading through the thread, I still don't quite get why you ...
1
vote
0answers
23 views

Allow log on locally custom message

I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the ...
0
votes
0answers
291 views

How to install a strong ephemeral Diffie-Hellman public key on windows server 2008 r2?

I have a server running windows server 2008 R2, which sits on my LAN. I'm a programmer rather than a server administrator, so I don't know how make the security on the server stronger. When I ...
0
votes
1answer
55 views

Block user network access except back to address of ssh client

On a linux server, how can I set up permissions so that a certain group of users are allowed to log in via ssh, but all network connections by their processes are blocked unless the connection is back ...
0
votes
0answers
52 views

Secure settings for an upload directory

I have a website running on Ruby on Rails + Nginx and I let my users upload files. I don't want to limit the file format they can upload and instead I want to make sure that the directory/folder ...
1
vote
1answer
25 views

WiFi Perimeter Fence

Is there a process to virtually dictate WiFi boundaries? For instance, confining WiFi to a small office. (This excludes directional antennas or faraday cages.) I was told this was implemented at an ...
0
votes
0answers
12 views

Flush audit logs before process termination

I configured auditd by modifying /etc/pam.d/common-auth: session required pam_loginuid.so session required pam_tty_audit.so enable=* The logging works fine. The issue is that the log is not written ...
3
votes
1answer
43 views

How to secure an open proxy (mod_proxy) for demoing service

A client has a service that requires a bit javascript to be added to a customer's page. As a marketing tool to show prospective customers, I created a web app that demonstrates how the customer's page ...