Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
27 views

Is it possible to break out of a “trap 1 2 3” secured terminal session by using SIGSEGV?

The title says it mostly. I'm auditing the security of a terminal-based application on AIX, and the way you use it is to connect to it remotely through telnet, where the ".profile" of the telnet user ...
0
votes
1answer
381 views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
1
vote
2answers
147 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...
-1
votes
1answer
103 views

Compiling nginx and php

Im about to set up a basic web server based on ubuntu server 14.04 x64 with an online shop section, the server will also consist mysql, mail, and maybe other servers as well until it runs smoothly. ...
0
votes
1answer
44 views

I guess that my mail server is unprotected and spammers are using my mail server to spam myself [duplicate]

Since I switch to my own mail server (I folowed this two tutorials: https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-mysql and ...
2
votes
1answer
30 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
-1
votes
1answer
61 views

I see a flood of requests from Revista22

In many of the sites I am running I see in Google Analytics thousands of visits referred from a site called revista22.ro, which I don't know and which mentions nothing about any of my sites. Also, I ...
-1
votes
1answer
38 views

What are the MOST Important Things to Configure on a WAF? Specifically Barracuda Web Application Firewall

I will be hosting a web application on a cloud provider. This will be protected behind a WAF specifically Barracuda's Web Application Firewall Vx. I do not have too much experience with WAF ...
0
votes
2answers
173 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
1
vote
5answers
143 views

How to get an early warning to someone logging into a server

I like to be notified when someone is logged into one of my Linux servers, and also be able to find out what the location of the login attempt. How can I do this?
0
votes
0answers
14 views

Securing web application used for core business process

I am writing an application which will be used for our core business workflows (client registration and management etc). I have partners and employees who are spread across the globe, so I want to ...
4
votes
4answers
686 views

Is enabling https on a Cisco router a considerable security risk?

I would like to use Cisco's Network Assistant to manage my Cisco routers (I know there are other solutions for this, but for now I've decided to use CNA). It requires the HTTP or HTTPS service to be ...
0
votes
0answers
88 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
-6
votes
1answer
75 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
0
votes
0answers
72 views

IIS App cannot write to network share on a 2012 server, fine on a 2008 server

I have a Windows 2008 R2 web server running IIS, and the app needs to write files to a folder. None of the machines are on a domain, just a local workgroup. The app pool is running as the user ...
0
votes
1answer
39 views

Modify the Windows failed logon message

Is there a way to modify the message that the user sees following the entry of an insecure password, whilst changing/resetting their password, on Windows 7 / 2008 Server machines? Basically, the ...
2
votes
1answer
512 views

Host Header Attack with reverse proxies

So I was tasked with researching a problem that was identified by an Acunetix web security scan. Here are the details about the scan: Host_header_attack Automated Detection of Host Header Attacks I ...
1
vote
2answers
45 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
1answer
59 views

Block file browsing on Windows Explorer

I have a Citrix application that open Windows Explorer from a menu. The command invoked to open Explorer is: Explorer "g:\app\folder" What happens when Explorer is opened is that it shows a window ...
-1
votes
1answer
40 views

Un-Noticed Vulnerability, I need to know if i should do anything

Possible Web-Site Vulnerability. I'm not sure if this is the right place to ask this, but I am running my own website, that is still currently being developed, but since it is 'Open as Beta' it is ...
1
vote
2answers
243 views

Copying data between AWS EC2 machines

There are times where, in order to do some debugging or perhaps a manual migration, I need to copy large chunks of data from one EC2 instance to another. When the size of the data is tiny, it's simple ...
0
votes
1answer
36 views

Safest way to allow a user to write in www directory?

I mean allowing a user to modify the web files in the server. Should I change the ownership of the www directory to a certain user, or put it in a new group and give write permission, or something ...
1
vote
0answers
32 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
1answer
49 views

How can a PC be protected from malware without locally installed software?

I'm looking to find a way to protect PCs, without requiring locally installed software. I thought about a device such as a Watchguard that has UTM facilities and make it a transparent proxy, in ...
1
vote
1answer
117 views

HP ProCurve Vlan Isolation

Okay, so we have an HP ProCurve Switch 2824, a Zyxel router and a bunch of 2012 R2 servers. We currently have 3 VLANs in our network: 10(Public),20(Private) and 30(Management), but we'd like to have ...
2
votes
0answers
124 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
-4
votes
1answer
53 views

Is 10 character (letters and numbers mixed) password strong enough for Internet Servers? [closed]

Assuming ssh brute force attacks. Assuming the following IPTABLES configuration: DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 120 ...
0
votes
1answer
86 views

Linux glibc versions 2.18 and older - vulnerability

Server: Red Hat Enterprise Linux Server release 5.9 (Tikanga) I came to know that Linux GNU C Library (glibc) versions prior to 2.18 are vulnerable to remote code execution via a vulnerability in the ...
2
votes
1answer
42 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
2
votes
8answers
3k views

No success when trying to upgrade glibc on RHEL4 due to GHOST

Due to the recent GHOST vulnerability I was trying to upgrade the glibc version on our RHEL4. The command I tried using was: rpm -Uvh glibc-2.3.4-2.57.x86_64.rpm Result was: [root@rhel4-test ~]# ...
0
votes
1answer
64 views

Configure account event auditing with Secedit

I'm currently putting together a number of PS scripts which can be run against a new webserver in order to harden it prior to it being placed in production. One of these scripts will launch secedit ...
-1
votes
2answers
113 views

Open port to only one external IP address

I am having trouble with unwanted traffic on a certain open port and want to lock the open port so it only allows incoming traffic from One single external IP address. I have had a Google and cant ...
2
votes
2answers
117 views

Windows UAC disabled but I'm still getting the elevation pop-up

I have UAC disabled on my Windows 2008R2. Why am I still getting UAC "Windows needs your permission to continue" window before trying to change Owner of a folder? My user is a member of the ...
1
vote
1answer
407 views

Allowing Internet traffic into DMZ using Azure Network Security Group

I am trying to create a simple DMZ using Azure Network Security Groups, using a Barracuda WAF as the public entrypoint into the DMZ, however I am having some trouble allowing internet traffic to ...
0
votes
0answers
33 views

Debian server hacked - root login on /dev/tty1 - therebel exploit [duplicate]

I have a test server running Debian Wheezy (Kernel 3.2.0-4-amd64) and OwnCloud 7. It is a virtual machine hosted on a Debian Wheezy kvm Server. It uses an own IP address configured via br0. I made ...
0
votes
1answer
66 views

How to lower security level of IE on Win 2008R2 to allow product register?

There is IE 11 installed on Win2008R2 server. After installing a Visual studio express, we are asked to register the software. A user account was created on outlook.com. However after entering login ...
1
vote
1answer
77 views

How can I avoid passwords

I'm the default IT guy at a small family business. We have 5-10 employees that only work at the office for about half the year. Because of this, it's a pain to have unique passwords - so people seem ...
3
votes
4answers
1k views

Am I at risk by leaving a test FTP account available on the server?

I have two Filezilla server instances on different WAN connections, both mapping to the same /test directory on the file server. To validate that clients have connectivity I have a read/list only ...
0
votes
1answer
31 views

VBulletin 3.6, disable “Invalid SQL” errors

VBulletin likes to dump SQL query and database metadata in case of query-error. I do not find it entertaining from security point of view. Is there a way to disable this and just show "something went ...
1
vote
1answer
48 views

How often does an SSAE 16 audit have to be performed in order to be good enough for HIPPA compliance

I need to find a dedicated hosting service that has (among other things) passed SSAE 16 audit. I found one that had the audit performed between 1/1/2013 and 6/1/2013. Should that be considered current ...
0
votes
1answer
25 views

vSphere-created node complaining about ECDSA fingerprint?

I just cloned an Ubuntu template in vSphere Client, just like I've done hundreds of times before. It didn't give me any errors, however when I went to SSH into this server to test it, I get the ...
4
votes
2answers
243 views

Should I need to provide a root certificate when setting SSL cert on nginx

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed. However, from Comodo website, their guide on installing cert on nginx is NGINX Needed for ...
1
vote
1answer
28 views

Does it make sense to remove NFS from a simple web server?

Does it make sense security- and performance-wise to remove NFS on a simple server which has ~10 Wordpress websites? Or is simply stopping the services enough?
1
vote
1answer
96 views

ACS - Where to find Audit Logs

I think i got the Audit Collection service working. Where do I see the Audit Logs from my Managed Agents? I looked in my Operations Manger Console: Monitoring - Microsoft Audit Collection Services - ...
0
votes
0answers
75 views

Docker non-root secure?

If I set up a Docker container on an Ubuntu server, and then let it run arbitrary/untrusted code like uploaded PHP, Python etc. as a NON-ROOT user. Is this totally contained and secure by ...
0
votes
1answer
99 views

Strange TCP Flood / Flood from Port 445

Good Evening. Today I noticed a strange flood on a box that I am working with, here is a dump from tcpdump: 23:21:07.580917 IP (tos 0x0, ttl 64, id 5746, offset 0, flags [DF], proto TCP (6), length ...
0
votes
1answer
22 views

Viewing older entries for lastb on linux

I have a server (Amazon Linux) that has been up for 261 days: [server]$ uptime 16:29:46 up 261 days, 4:47, 1 user, load average: 0.05, 0.16, 0.18 I am trying to find out if there have been any ...
0
votes
0answers
26 views

SQL 2012 IPSec or SSL

I have a requirement to secure connections to SQL server. (at transit that is) - TDE will be used for encryption at rest. SQL provides two options which are either certificate based SSL or Windows ...
2
votes
1answer
236 views

Is default Apache version in Ubuntu 14.04 secure?

I have installed apache on ubuntu server 14.04 using apt-get. I set up a simple site, uploaded a few pictures etc, the website is working. I've decided to take a look at security of the thing using ...
0
votes
1answer
2k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...