Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
2answers
89 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
1answer
30 views

SecAst: Premature Exit in Daemon Mode

To Generation D: This is a new problem with build secast-1.0.4.0-x86_64-ub12 that didn't happen with the previous build, secast-1.0.1.0-x86_64-ub12. When secast is run as a service (service secast ...
1
vote
1answer
40 views

SecAst: Configuring Email Alerts for Google Apps Account

Requesting assistance with configuring SecAst email alerts to work with Google Apps hosted account (posting here as per request by Generation D)... We have SecAst installed on a system with a new ...
0
votes
1answer
54 views

Fixing Apache Struts XSS vulnerability

A recent network scan revealed the following vulnerability: Apache Struts s:a / s:url Tag href Element XSS. Here is a link with more info about this vulnerability: http://osvdb.org/show/osvdb/54122 I ...
-5
votes
1answer
62 views

How much harm can a non-root user cause? [closed]

Let's say you add a user to your Linux server, and allow the user to connect over SSH with full command-line access, but do not add him to the list of sudoers. What sort of security vulnerabilities ...
-1
votes
1answer
218 views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
2
votes
1answer
39 views

Hardened compiler flags VS automatic security patches?

I noticed that a few select pieces of software in the Long Term Support repository for my Operating System, have not been compiled with PIE, or Immediate binding (for example). In the opinion of ...
0
votes
1answer
797 views

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account?

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account? I tried to run script under local system account on the client which ...
28
votes
3answers
3k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
3
votes
3answers
325 views

How can I prevent the compromise of a Domain Controller on ESX stored in a unsecured location?

A client of ours has a DC that will be located in an insecure location. RODCs and separate domains/forests are not permitted by management. All the servers will be located on a VMWare ESX server. ...
-1
votes
1answer
104 views

Alerting on threshold crossing?

We are using logstash + elasticsearch + Kibana to parse, store and view our logs respectively. Now, we want a notification/alert when a threshold for a particular log or threshold for a particular ...
4
votes
3answers
65 views

Server 2008 permissions issues

We have a selection of top level folders: E:\Data1 E:\Data2 E:\Data3 The permissions are simple - the default CREATOR OWNER, SYSTEM Full Control, some security groups allowing Modify and the LOCAL ...
2
votes
1answer
49 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
0
votes
2answers
138 views

nginx as reverse proxy on front of Apache - protection and security

I'm just concerned whether to install Nginx WS alone or nginx as reverse proxy on front of Apache based on security and protection. If I had to choose nginx as reverse proxy on front of Apache, would ...
2
votes
2answers
109 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...
2
votes
1answer
548 views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
3
votes
2answers
127 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
30 views

Private, secure network between web nodes

I need to create small network of vps (linux) servers. Their main puropse is to server some data over http to clients. Each server is going to be located elsewhere in the world. I want those servers ...
2
votes
1answer
43 views

How can I avoid logging file not founds commonly caused by vulnerability scanners?

My apache logs are pretty much full of 'admin.php' not found or unable to stat and similar statements for wp-login.php, default.php, and so on that are often sought after by vulnerability scanners. ...
1
vote
1answer
135 views

iptables connection limit does not work on debian

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
-2
votes
1answer
39 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
1
vote
1answer
26 views

OpeVPN log connecting client IPs

I looking for the best solution to log all connecting client's ip to either a text file or a database who logs into my VPN server. Under the IP I mean the public WAN IP on the internet where they are ...
5
votes
1answer
375 views

Recursive reset file permissions on Windows

There is a big, complex directory structure on a relative big NTFS partition. Somebody managed to put very bad security privileges onto it - there are directories with randomly given/denied ...
0
votes
2answers
50 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
330 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
4answers
86 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
0
votes
0answers
29 views

Security concerns regarding php://stdin

I'm using xinet.d and php://stdin to host a raw tcp-connnection, (following the excellent guide at http://gonzalo123.com/2010/05/23/building-network-services-with-php-and-xinetd/) I'm concerned with ...
1
vote
1answer
66 views

How can I disallow a user's scripts from accessing anything above their user folder?

This is probably an extremely simple question to answer for anybody who knows what they're doing, but I can't find any answers myself. I'm trying to set up a subdirectory for my good friend to test ...
0
votes
1answer
44 views

Starting SecAstQFSFileEngine::open: No file name specified - error when starting secast

I'm receiving the below error when starting secast service secast start Starting SecAstQFSFileEngine::open: No file name specified [FAILED] Has anyone run into this issue before? I'm running CentOS ...
0
votes
2answers
67 views

Does the server SSL certificate need to be kept private?

I understand that private key definitely does, but what about the certificate file? I also understand that the server sends (part of?) the certificate to a connecting client, but does it send the ...
0
votes
0answers
72 views

UNC shared path not accessible though necessary permissions are set

I have 2 environments A and B. A is an original environment whereas B is a clone of A, exactly except AD servers. AD server of B has been assigned a trust relationship with A, so that all the service ...
1
vote
1answer
107 views

Switch to switch encryption over a wireless bridge (TrustSec?)

I am planning to connect an existing Cisco 3750 switch to a 3560C switch over a wireless PTP bridge. The bridge will be WPA2 protected, but I am looking for an additional measure of security between ...
0
votes
0answers
94 views

Reverse a command and disable su on Ubuntu

Whilst following an online guide on how to secure Ubuntu server, I ran this command on one of my test VM's. sudo dpkg-statoverride --update --add root admin 4750 /bin/su I know the intention of ...
1
vote
2answers
180 views

Permissions to edit network configuration

We ship a virtual machine to the clients which runs a web service. Clients need to install this virtual machine on one of their hosts using an hypervisor and just need to modify the network ...
0
votes
1answer
80 views

Computers in-scope for PCI DSS [closed]

I am trying to determine what servers & workstations, etc. that are in-scope for PCI compliance. PCI DSS SAQ-D states that any devices that "store, process or transmit cardholder data" are in ...
3
votes
1answer
370 views

“Net Send” command into Microsoft server 2008 r2 [duplicate]

I remember with the old windows server was able to send messages with the command "NET SEND", now I am using "Windows 2008 R2" and this feature is not active. Can you give me some additional ...
0
votes
0answers
145 views

Red Hat 6.5 - Login Errors After Security Hardening

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server: To configure the system to lock out accounts after a ...
0
votes
0answers
56 views

Which modules can be disabled in apache2.4 on windows

I have an Apache 2.4 webserver running on Windows. I am looking into system hardening and the config file httpd.conf. There are numerous load modules and I am wondering which modules I can safely ...
-4
votes
1answer
2k views

Does adding ?.jpg after url really bypasses wifi security? And how? [closed]

So I stumbled upon the following lifehack the other day: I currently don't have access to an airport with expensive WiFi but it seems that adding ?.jpg to any url doesn't cause any problems with ...
1
vote
1answer
635 views

JAVA blocks File Manager in Webmin

There's a file manager tool in webmin that is based on java platform. After I set up my VPS, I get the security warning, the connection to this website is untrusted and when I hit continues, I see ...
1
vote
8answers
444 views

Can I (practically) block access to the SSH port to my country only?

I'm thinking that blocking access to the SSH port to allow for my country only is an obvious step, but I can't see a practical way to do this. I'm in the UK if it matters. I have full access to the ...
0
votes
2answers
222 views

Protecting my Bind dns server from slow kaminsky-style cache poisoning attacks

Dan Kaminsky described how DNS servers could be poisoned with spoofed DNS responses [1]. As I understand it, the problem was that Kaminsky found a way to account for most other sources of randomness ...
2
votes
1answer
721 views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
1
vote
0answers
247 views

Non-admin users can't run mmc on Domain Controller on Windows Server 2008 (ok for Enterprise not for Standard edition)

I have created some delegation for IT administrators. One of the groups of people have some Active Directory permissions but is not server administrators or domain administrators. They also are ...
0
votes
2answers
77 views

Blocking geographic cities from accessing Asterisk using Secast

I am using Secast for intrusion protection on my Asterisk PBX. It’s working great, and I now want to start blocking specific geographic regions. My system is getting hammered from Ramallah ...
2
votes
1answer
215 views

Ubuntu/Grub2: Crypted grub password doesn't work, what could be the reason?

I've used the command grub-mkpasswd-pbkdf2 in order to encrypt my password, then I took the hashed password and placed it in my Ubuntu 14.04 /etc/grub.d/00_header: cat << EOF set ...
3
votes
1answer
309 views

Grant temporary access to Ubuntu 14.04 EC2 machines

My company intends to hire an external contractor for some dev-ops jobs on our EC2 servers. We use Ubuntu accessed using a .pem certificate file. For obvious reasons, I do not want to share my .pem ...
2
votes
3answers
358 views

Blocking IP addresses of obvious hack attempts [duplicate]

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this: [Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client ...
1
vote
1answer
465 views

Can I clean these two hacked servers withour reinstalling? [duplicate]

I've got two dedicated servers that some days ago started to send me notifications about unknown cron jobs running. On both servers I've got secondary accounts for my websites and the hacker has ...
33
votes
6answers
3k views

Is it safe for a production server to have make installed?

During the setup of my virtual server instances I require some applications to be built using make. Are there any security risks associated with having make installed? Or should I clean it up before ...