Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
2answers
130 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
1
vote
1answer
65 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
0
votes
1answer
248 views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
0
votes
2answers
134 views

improving soho network security

My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data ...
0
votes
0answers
38 views

Windows CE lockdown

My company just began purchasing Windows CE 5 & 7 based devices. The only application that they need to run is Remote Desktop. I am looking for solutions to lock them down so our users cannot ...
3
votes
1answer
94 views

How convince Security auditors to change frequent password change policy?

I am a new Junior IT Manager in a small company of around 500 employees and the current policy regarding passwords has enforced password expiration within 30 days, with a password history of 5. As ...
0
votes
0answers
102 views

How to block zip files containing executable (exe, jar) using Squid?

Squid Proxy Server is blocking exe and jar files by file extensions and meme type (for http traffic). However, if exe or jar files/programs are within zip files, then it is not blocking. The ...
1
vote
2answers
153 views

sketchy nginx access log entries

There were quite a few entries as below in the nginx access log. How do I know the outcome of these scripts and if my server is compromised or no? 162.232.183.48 - - [14/Jan/2016:10:54:57 +0000] "GET ...
0
votes
0answers
19 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
1
vote
3answers
49 views

DKIM: Can I simply change the RSA key used in DKIM without changing the DKIM selector?

Can I simply change the RSA key used in DKIM (DNS TXT Record) without changing the DKIM selector or will this result in any issues? If not, what's them the purpose of the DKIM selector? BTW: 20120113 ...
2
votes
1answer
183 views

DKIM: Can I use a RSA key larger than 2048bit, i.e. 4096?

I wonder if I can simply use a 4096bit RSA key for DKIM (in DNS TXT Record). Are there any downsides (neglecting computational effort)? Maybe there are mail servers which can't handle a key this large?...
0
votes
2answers
75 views

block ip with iptables ubuntu server

I am trying to block one IP with iptables in my Ubuntu server 12.04. The foreign IP is 117.16.18.95.dyna. You can take a look at the next image: I have added this ip to iptables with the next ...
3
votes
0answers
151 views

How well does haproxy scale for handling client certificate authentication?

As this is a performance-based question about a security issue, some folks at Information Security suggested I post here: My IoT company would like to use client certificate authentication to secure ...
0
votes
0answers
22 views

Modern Node.js support/security on CentOS 6

I'm inheriting a legacy Node application that's running on 0.10/CentOS 6. I'd like to upgrade it to 4.2, but am running into a few issues. Previously, my sysadmin had been installing/updating Node ...
0
votes
1answer
50 views

how to stop incoming SMTP .EML attack on an Azure Windows VM

This morning 1:53am, my Azure VM began receiving unexpected .EML files in C:\inetpub\mailroot\Queue. By about 6am when I first logged on, it had received over 36000 files. As a workaround, I stopped ...
3
votes
2answers
425 views

iptables doesn't close port 3000?

I wanted to configure iptables on my server in such a way that only specific ports are open. Nevertheless I can access e.g. port 3000, if I run a web app on it. What could be the reason why 3000 is ...
1
vote
1answer
92 views

Disabling anonymous ciphers in Apache not working

We have an Apache 2.2.3 server with OpenSSL 0.9.8e-fips-rhel5. I am running the following SSL configuration in my VirtualHost. I can't find any other config files with any SSL directives whatsoever. ...
0
votes
1answer
134 views

Linux: How to configure TCP wrappers in /etc/hosts.allow for manually started processes?

An internal server in the company I work for has been compromised and I would like to harden CentOS machines in the organization in order to avoid any future incidents so I've been reading about ...
1
vote
1answer
113 views

LDAP auth successful with additional characters

I have a service which uses a LDAP directory (anonymous bind) to get the users and their passwords in order to perform the authentication. The problem is that I've realized that I can login with a ...
0
votes
0answers
44 views

CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL

I saw this security announcement: https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/ But I could not figure out what is this "Fiddle" and whether ...
1
vote
1answer
43 views

IPMI only over HTTP

I am actually performing a security review for a customer and I'm being confusing about the IPMI case. If I'm correct, the protocol is flawed by design, thus directly exposing the IPMI service (udp/...
0
votes
0answers
11 views

What is the secure way to group /var/www folder (not apache) [duplicate]

Edit: I don not consider this question as an exact duplicate since the answered question is apache related, but in my case I don not have apache installed. What is the secure way I should group my /...
1
vote
1answer
186 views

How to avoid PHP Filesman Backdoor

We have a server and use it as a shared-server for our clients. Most of the clients use Wordpress and we have a classic LAMP environment set for it. We give SFTP access to each client (with chrooted ...
3
votes
1answer
233 views

vsftp: why is allow_writeable_chroot=YES a bad idea?

There are several thousand blog posts about vsftp and allow_writeable_chroot=YES The common error message: Fixing 500 OOPS: vsftpd: refusing to run with writable root inside chroot () I solved ...
0
votes
1answer
319 views

Is this an SQL injection attack? If so, what's it trying to do?

I'm seeing a number of entries in my access log where 'A=0 is added to a query parameter, eg: http://www.server.org/foo/?bar=1'A=0&type=xml The parameter that 'A=0 is attached to varies, but it'...
-1
votes
2answers
75 views

set up secure connection over SSH [closed]

I'm setting up a server application which requires to establish a secure connection over SSH2, e.g. a client must open SSH2 connection to the server to reach specific application: % ssh -s -p5000 my....
2
votes
1answer
116 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
1
vote
1answer
41 views

How to deny requests that contains a certain header and not coming from whitelisted IPs in nginx?

I would like to double protect an application that uses a custom header to authorize some critical views. Since those calls should only originate from some well-known IPs, I would like to block ...
0
votes
1answer
217 views

Server 2012 and RDP Properties

I am looking to change RDP-Tcp-Properties security layer to: 'RDP security layer' in Windows Server 2012. Looked up: Windows 2012 R2 - RDP properties? However this server has no RD features/roles ...
0
votes
0answers
35 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...
2
votes
1answer
43 views

ssl certificates from SSL Resellers - what are they reselling?

I've seen SSL resellers everywhere (such as namecheap for several of their options). How are they reselling? What are they reselling? Are there any security issues with them?
0
votes
1answer
23 views

// , Can I change the MASTERAUTH value on a running Redis instance in a Redis Cluster?

// , According to http://redis.io/topics/security, I can set a requirepass value, for example, requirepass foobared, in the Redis configuration files. However, I don't want this in my configuration ...
3
votes
0answers
34 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
0
votes
1answer
35 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
0
votes
1answer
380 views

Filter Windows Event Security logs by Source IP Address

I can't seem to get the Event Viewer to filter on the source IP address that is in the Security Event Log in Windows server Event Viewer. This is the XML query string I'm using. Where did I go wrong?...
0
votes
0answers
36 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
1
vote
1answer
252 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
0answers
59 views

block more fragmented packet using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
2answers
23 views

What's the best practice: HTTPS at the webservice level or at the proxy level?

These days I had to deploy several web apps, like Jenkins or jupyter. These apps must be served through HTTPS. I was wondering if it's better to configure HTTPS on each app (listening port, ssl ...
0
votes
1answer
84 views

Hide Original URL using mod_proxy

I have been successfully able to use ProxyPass and ProxyPassReverse to reverse-proxy an application running under a Tomcat Server. However, the challenge is that I want to use a fake URL, to ...
0
votes
1answer
76 views

Should I use amazon VPC or EC2 in this scenario?

My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word ...
0
votes
1answer
50 views

Should a Load balancer be bypassed via server specific URLs?

We have a web farm with an F5 load balancer on Windows 2012 R2. Previously it was configured so that a single url redirected users to a specific machine in the load balanced farm. For example: ...
0
votes
0answers
64 views

How to implement a dead man switch in Windows 7?

I am looking for a way to make domain-joined Windows 7 laptops brick themselves after 90 days of no-contact with a domain controller. I do not want the laptop to wipe itself or anything severe like ...
0
votes
2answers
122 views

Fail2ban not banning after update to latest version

I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93. When I start it up, I get two error messages. WARNING ...
0
votes
1answer
42 views

Does TSIG and DNSSEC provide encryption of entire DNS packet?

it says TSIG and DNSSEC provide authentication. Does it mean whole DNS traffic would be encrypted so if I do packet capturing I would not be able to parse anything ? Or DNS data is still plain text ...
0
votes
0answers
72 views

Forcing a user on remote connection, in to a rails console, and prevent them accessing any system commands

I'm try to set up access to a system so that a ruby web dev can remote on to a system and access a rails console in order to do some tests when they're having problems with an application. They wouldn'...
0
votes
2answers
80 views

Locking down Azure Portal

My company does not want any staff to have access to our corporate Azure account from outside of our offices. So, is it possible to lock down the Azure Portal? Preferably by IP whitelist. I can find ...
1
vote
1answer
67 views

Creating custom AMI in AWS that can be used with a key pair to get the Windows password after launch

I wanted to create a custom AMI for use with Elastic Beanstalk. Up until now I have been logging on to my instance by using the key pair to retrieve the Windows Password. I launched a new instance ...
0
votes
1answer
156 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
2
votes
1answer
263 views

Is there something like a virtual VPN?

I am a small business owner, an ecommerce company, faced with following problem. Current situation. We have an office with a physical location. The office has a Cisco ASA Firewall / Router to connect ...