Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
55 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
0
votes
1answer
633 views

Workaround needed to run FileMaker Server 12 Admin Console with the new Java security model

As of Java 7 update 51 (7u51), there is a requirement for a new Permissions attribute (introduced in 7u25) that prevents the FileMaker Server 12 Admin Console from running. This also affects the ...
1
vote
3answers
243 views

Block a Non-ActiveSync Device from accessing Exchange 2010

We're trying to tighten security, and block users from accessing our mail server without having the proper MDM on their phones. With programs like Aqua Mail and CloudMagic, it seems like they go ...
0
votes
0answers
98 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
5
votes
4answers
66 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
2
votes
0answers
29 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
1
vote
3answers
298 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
-4
votes
1answer
35 views

Is it possible to have multiple domain policy for different servers? [closed]

In my organization, there is 1 domain with 13 production servers joined to it. Recently, we realized that the default domain policy that is applied to the production servers have minimal security ...
2
votes
1answer
225 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
2
votes
0answers
42 views

How can I find a security group's dependencies? [duplicate]

There is a similar question that didn't receive a proper answer. How can I find a security group's dependencies? These include EC2 instances, but other services also create dependencies, like the ...
0
votes
2answers
748 views

Allow service to interact with desktop

DC OS - Windows Server 2008 R2 Std Client OS - Windows XP, Windows 7 I have implemented Security policy through Network Policy Server and enabled Wired AutoConfig Services Automatically. While ...
1
vote
1answer
274 views

How to hide Folders for FTP user jailed to user home

Setup: VSFTPD FTP server Only the FTP user has access to FTP User home modded to /var/www User now has write access only to /var/www User still can browse folder structure - this is what i want ...
-2
votes
1answer
481 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [duplicate]

As part of hardening a standalone/dedicated MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL ...
-1
votes
1answer
95 views

Windows: View other network shares without sharing anything myself [closed]

Using windows, I would like to be able to browse computers and their shares on the network, without publishing any shares, administrative shares, and not even having my computer listed in the ...
13
votes
3answers
2k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
1
vote
2answers
97 views

Does /etc/fstab need to be world readable?

I would like to put network share mounts in /etc/fstab, but by default that file is world-readable which allows everyone to read the credentials I put into the mount options. Is it safe to make ...
1
vote
0answers
61 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
1answer
57 views

Domain admin accounts can do less than domain administrator account

On a Windows 2008R2 server, a domain admin account has lesser rights than the domain administrator account. For example, the domain admin account can't install a service or create a file on the root ...
0
votes
0answers
28 views

Are there security concerns involved with keepalive?

I'm configuring an IIS7 site for a third-party tool, and our team had a brief discussion about the keepalive setting. I have learned in my research that increasing this timeout will impact available ...
24
votes
7answers
2k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
10
votes
6answers
719 views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
1
vote
1answer
315 views

AWS: network ACL blocks outbound traffic

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using ...
0
votes
1answer
54 views

Protect public directories from download via wget and curl

My users upload their profile images and I save them in a public folder. The file names are not predictable (they are based on md5 hash of user id with salt). When someone views the user's profile, ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
2
votes
3answers
175 views

To add security to SSH-keys from Man-in-middle-attacks [closed]

I would like to get Mobile-phone verification or something else besides the SSH-key verification. How can you add defence to the SSH-keys?
0
votes
1answer
48 views

Is a VPN right for restricting server access?

I would like to set up a Few QA servers for a web application, under the app domain, however I would not like these servers to be accessible to just everyone from the Internet. Ideally, the QA team ...
2
votes
3answers
278 views

Docker: How to partition a large server?

So I have a Dell XS23 Rack with 8 CPUs and 40G Ram with vmware esxi in my production environment. The way I'd partitioned it before was 2 API servers (quad core, 8gig ram) 2 DB servers same specs, ...
2
votes
2answers
112 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
-1
votes
1answer
46 views

Site security - how to filter incoming traffic to a specific port

Just ran a security test on ScanMyServer.com, the results showed a medium risk vulnerability: Database Reachable from the Internet Summary: The remote host is running a database server that is ...
0
votes
1answer
60 views

DDoS Attack Mitigation Techniques [duplicate]

Our hosting is set up on Amazon EC2 servers, which have been performing great. The problem we run into are spikes in requests for invalid URLs from scripts/bots looking for security holes. When ...
1
vote
0answers
31 views

Dynamics Business Portal [closed]

I have installed SharePoint 2010, Dynamics Business Portal Version 6.0.1053.0. When I try to log on to the BP site I get the error given below: ...
1
vote
1answer
100 views

Traffic in a AWS virtual private cloud

On Amazon AWS, should I encrypt sensitive traffic between instances in a virtual private cloud? More specifically, is the traffic between the instances in such a VPC private as in a virtual network, ...
0
votes
1answer
39 views

removing process (and child process) access to file systems? [closed]

is there a unix-type free OS that allows me to remove all disk access for a specific process and any of its children? #!/usr/bin/perl -w use strict; use Perl6::Slurp; my $infile= ...
1
vote
0answers
32 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
0
votes
0answers
69 views

Why AD DS user is able to write to ADLDS(ADAM) container(user is neither imported nor added as foreignsecurityprincipal)?PS/dsacls cmd to fix it-DENY

I have installed 'AD LDS' instance on one of my windows server 2012 which is part of a domain. I brought few users (windows security principals to 'AD LDS') as 'ForeignSecurityPrincipals' from AD DS ...
0
votes
1answer
53 views

Is the following setuid program a security risk?

I have the following program in .c set as setuid chmod only read/execute by owner and will set it immutable, as i will the php script it invokes. #include <stdio.h> #include <stdlib.h> ...
-2
votes
2answers
259 views

List of TCP & UDP ports known to be used by malware, etc [closed]

Where can I find a regularly updated, downloadable list of TCP & UDP ports that are known to be commonly used by malware, trojans, etc.? This is for import into an IT asset management system to ...
1
vote
1answer
151 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
1
vote
1answer
50 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
1
vote
2answers
370 views

Web server atack DDOS

I have a server (vps) to use as a repository and testing (gitlab and redmine) server. However apache crashed, seeing the /var/log/apache2/error.log have many errors of this type: [Fri Jan 31 ...
1
vote
0answers
220 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
2answers
136 views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
7
votes
1answer
144 views

what is the usefulness of logging of martians packet

Most of the time when I perform any search on hardening of a linux box etc, in the list there is always a section of log of Martian packet(IP) without any further explanation. ...
1
vote
1answer
261 views

Pros / cons of using password-less OpenVPN client keys

I'm setting up an OpenVPN server for my organization, and I'm reading up on the different ways that the client side keys work. I'm still a little unfamiliar with all of the concepts behind these ...
1
vote
1answer
53 views

Defending PCs against APTs

We are evaluating the security of the PCs used by people with access to high-value company documents. At the moment they are kept patched and run a virus checker, but we are concerned about zero-day ...
1
vote
1answer
62 views

SMB 3 encrypted over internet

SMB 3 offers an option to enable encryption. Does that mean it would be a possible option to let people use SMB over the internet or are there other not securable aspects about SMB left? What extra ...
2
votes
2answers
170 views

With Azure, can I create a VLAN and put all my worker roles and VM's in there?

Is it possible to create a sort of VLAN or private azure LAN thingy .. where I can put any new Workers or VM's in that VLAN? one of the reasons is because I was hoping to create a SQL server on a VM ...
1
vote
1answer
88 views

Securing PHP on Ubuntu 12.04 LTS?

I recently set up an Ubuntu 12.04 server (with Apache 2.2 & PHP 5.3.10). While I was testing it, I noticed in the Apache access logs that an unknown IP address was trying to perform a PHP CGI ...
3
votes
2answers
134 views

Mongo Sharding - Config Server and Mongo Authentication

I am needing to shard a database fairly soon, and am unclear on what the best practice is for enabling authentication on the mongos and config servers. I would like to have everything be secured with ...
0
votes
3answers
55 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...