Security is not a product, but a process.

learn more… | top users | synonyms (1)

11
votes
9answers
5k views

Multiple *NIX Accounts with Identical UID

I am curious whether there is a standard expected behavior and whether it is considered bad practice when creating more than one account on Linux/Unix that have the same UID. I've done some testing on ...
11
votes
4answers
3k views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
11
votes
5answers
4k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
11
votes
7answers
18k views

Will a reverse proxy in front of web server improve security?

Third-party security professional is recommending we run a reverse proxy in front of the web server (all hosted in the DMZ) as a best practice security measure. I know this is a typical recommended ...
11
votes
5answers
10k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
11
votes
4answers
4k views

Securing file system for secure SFTP server

This might not seem as a development question, but in essence it is. Let me explain how. Our main development focus is dynamic content pages. Some of our customers have asked us to allow them space ...
11
votes
6answers
33k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
11
votes
6answers
3k views

Does disabling root login enhance security?

I have recently found an argument against disabling a root user login in Linux at http://archives.neohapsis.com/archives/openbsd/2005-03/2878.html I assume that, if everybody uses a public key ...
11
votes
4answers
28k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
11
votes
2answers
699 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
11
votes
11answers
2k views

Penetration Testing [closed]

We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?
11
votes
1answer
20k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
11
votes
4answers
53k views

How can I know when a file was last read or accessed on Windows?

I need to determine if a particular file was accessed in the last, say, 2 days. Is this possible on Windows Server 2008 R2?
11
votes
5answers
60k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES userlist_deny=...
11
votes
2answers
7k views

Does https include protection from a replay attack?

Is it possible to perform a replay attack on a request transfered via https? Meaning, does the https protocol enforce a mechanism similar to digest access authentication where a nonce is introduced ...
11
votes
8answers
292 views

What is the first thing you do if your website was hacked?

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for CVE-...
11
votes
3answers
928 views

Finding how a hacked server was hacked

I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is ...
11
votes
3answers
8k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
11
votes
2answers
8k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
11
votes
2answers
1k views

Does Debian 6.0 (Squeeze) have buffer overflow protection mechanisms?

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)? Ubuntu has a handy summary table showing the main security features of each ...
11
votes
1answer
217 views

Find out how many browsers reject SSL certificate

I'd like to find out how many browsers reject our SSL certificate when making HTTP requests to our webserver. We're using a free CA which now seems to be recognised by most modern browsers, but I'd ...
11
votes
2answers
19k views

Whats the difference between local and remote addresses in 2008 firewall address

In the firewall advanced security manager/Inbound rules/rule property/scope tab you have two sections to specify local ip addresses and remote ip addresses. What makes an address qualify as a local ...
10
votes
20answers
4k views

How do I determine if my Linux box has been infiltrated?

I recently read an article about analyzing malicious SSH login attempts. This got me thinking, are the SSH username, password combinations on my Debian box that uncommon? Had I been targeted by a ...
10
votes
3answers
18k views

Why won't automatic login through ssh with authorized_keys work?

I have created a private/public dsa-keypair. I've put the public key on the server in ~/.ssh/authorized_keys Everything is set up like my other server, but it seems like the server is just ...
10
votes
4answers
734 views

Updating Malware cleaning skills

I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? ...
10
votes
9answers
4k views

Who can eavesdrop on a user's HTTP traffic?

I have heard many times that HTTPS should be used for transferring private data, since HTTP is vulnerable to eavesdroppers. But in practical terms, just who is capable of eavesdropping on a given ...
10
votes
5answers
4k views

How did Matasano get hacked?

from: http://seclists.org/fulldisclosure/2009/Jul/0388.html If I understand it best from the posts from: http://news.ycombinator.com/item?id=723798 the Matasano guys left sshd internet accessible - ...
10
votes
7answers
727 views

What is required for developers to run their own VM server in an enterprise environment [closed]

This scenario was also posted on SO, with different questions for different audiences - and I'm very glad I did as I've received some very good responses. We are attempting to implement a development ...
10
votes
12answers
2k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
10
votes
5answers
35k views

SSH / SSHD - How do I set max login attempts?

What is the easiest way to setup max login attempts in a LAMP environment (sshd installed via yum)? Is there a package or simple firewall rule?
10
votes
6answers
7k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
10
votes
2answers
3k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}...
10
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
10
votes
7answers
629 views

Career shift to security - learning tracks? [closed]

I've had to learn enough to be dangerous (if only to myself), managing the firewalls, switches, etc for small networks over the past ten years. However, I know there's a pretty massive gap between ...
10
votes
14answers
51k views

How to securely join two networks together over the Internet?

Let's say there are two locations. Both locations have their own fast Internet connections. How do you join these two networks together such that every computer can see every other computer? Do you ...
10
votes
6answers
3k views

What should every sysadmin know before administrating a public server?

Similar to this question on Stack Overflow, what should a sysadmin who is used to private, intranet-type situations know before being the administrator of a public site? These could be security ...
10
votes
5answers
5k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly secured"...
10
votes
7answers
564 views

Where to maintain central source repository?

What is the industry best practice regarding securing access to source code? I am thinking SSL only connections via apache allowed over to our server on an obscure port that doesn't conflict with ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
10
votes
6answers
16k views

What is the best way to find Conficker infected PCs in company networks remotely?

What is the best way remotely to find Conficker infected PCs in company/ISP networks?
10
votes
8answers
27k views

Is using integrated security (SSPI) for accessing SQL Server better for web applications?

When deploying web applications (.net) to a production environment, is it better to use integrated security or does it even matter? It seems to me that if a hacker breaks the web server, it won't ...
10
votes
3answers
1k views

Security considerations of WPA versus WPA2?

As we replacing our existing WEP infrastructure across multiple offices, we are weighing the value of upgrading to WPA versus WPA2 (both PSK). We have several different types of devices that do not ...
10
votes
8answers
5k views

Best file system for external (USB) hard drives/USB memory media

Almost all external USB hard drive and USB memory media/sticks come today preformatted with FAT32. As far as I know the only advantage of the file system is the compatibility among OSes and devices. ...
10
votes
5answers
677 views

Tips to gracefully take over a (UNIX) production server

After months of neglect, e-mail flames and management battles our current sysadmin was fired and handed over "the server credentials" to me. Such credentials consist in a root password and nothing ...
10
votes
3answers
4k views

Is it possible to have a 100% secure virtual private server?

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS. Obviously there are some things that you could do to ...
10
votes
5answers
5k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
10
votes
4answers
37k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
10
votes
5answers
2k views

Prevent execution of Windows executables

Is there any way to tell Windows (XP and above) not to execute files (*.exe files), which are present in drives/folders other than certain folders, that I mention? In short I want executables from ...
10
votes
5answers
2k views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...