Security is not a product, but a process.

learn more… | top users | synonyms (1)

10
votes
1answer
15k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
10
votes
3answers
1k views

Website defaced, what can I do?

My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong? I mean what to look out for among all those ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
10
votes
5answers
288 views

My site was recently attacked. What do I do?

This is a first for me. One of the sites I run was recently attacked. Not at all an intelligent attack - pure brute force - hit every page and every non-page with every extension possible. Posted ...
10
votes
2answers
968 views

Does Debian 6.0 (Squeeze) have buffer overflow protection mechanisms?

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)? Ubuntu has a handy summary table showing the main security features of each ...
10
votes
6answers
1k views

How to choose a cloud service for backups

I am thinking of using a cloud service to backup one of my client's website. My (clients) main concerns are (in decreasing order of importance) Protection of IP (trade secrets, source code), user ...
10
votes
1answer
306 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
10
votes
2answers
1k views

How did spammer spoof emails with my google apps domain (it even has DKIM!)

I have been getting a lot of bounce-backs lately. I thought my google apps account has been compromised, but there is no activity on my apps account, and there is certainly no malicious user that I ...
10
votes
5answers
3k views

Why is /dev/urandom only readable by root since Ubuntu 12.04 and how can I “fix” it?

I used to work with Ubuntu 10.04 templates on a lot of servers. Since changing to 12.04 I have problems that I've now isolated. The /dev/urandom device is only accessible to root. This caused SSL ...
10
votes
3answers
595 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
10
votes
1answer
603 views

How do I audit user's mailbox actions performed via IMAP in Exchange 2010?

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access. I perform the following cmdlet to enable auditing of the owner: > Set-Mailbox -Identity ...
9
votes
12answers
718 views

When I have to administrate an existing Linux server what's the best way to check if it is secure?

There are many tutorials on how to set up a new secured server. But what if I have to administrate a server someone else had set up some time ago and I don't know much about its configuration yet? ...
9
votes
20answers
3k views

How do I determine if my Linux box has been infiltrated?

I recently read an article about analyzing malicious SSH login attempts. This got me thinking, are the SSH username, password combinations on my Debian box that uncommon? Had I been targeted by a ...
9
votes
12answers
2k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
9
votes
8answers
9k views

How to secure phpmyadmin?

I checked out my apache logs, and, whooooaaa, there are a lot of bots trying to exploit phpmyadmin. The first thing i did was to change the directory name to something more obscure. But, are there ...
9
votes
6answers
506 views

Security Admins toolkit? What's in yours? [closed]

Resource question :- I need to collate a list of security admin tools For: Web Network Wifi Server unix/Linux/windows/macosx SQL Xss Please state -links/version/os used/free v buy
9
votes
4answers
1k views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
9
votes
15answers
3k views

How to manage rack keys?

As a result of a security audit there's the need to lock the racks and manage the keys: Keep the keys safe Record key usage Complying with these two requirements has many challenges as there are a ...
9
votes
14answers
37k views

How to securly join two networks together over the Internet?

Let's say there are two locations. Both locations have their own fast Internet connections. How do you join these two networks together such that every computer can see every other computer? Do you ...
9
votes
6answers
11k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
9
votes
3answers
5k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
9
votes
3answers
509 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
4answers
2k views

When is it appropriate / prudent to use chroot?

I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
9
votes
8answers
15k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
9
votes
3answers
339 views

“Template” for handing out user & passwords for employees

Within this relatively small company I work for, I have been handing out usernames and passwords written very simply in a word document. I wish for this process to be more professional now that we ...
9
votes
5answers
4k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
9
votes
4answers
17k views

How to create a limited “domain admin” that does not have access to domain controllers?

I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
9
votes
2answers
24k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
9
votes
1answer
14k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
9
votes
3answers
5k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
9
votes
6answers
671 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
9
votes
4answers
36k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
9
votes
6answers
940 views

When/why to use a web proxy/gateway?

Right now we have about a 25-30 PC network, connected to the internet with a run-of-the-mill SonicWall Firewall/Router device. There isn't much filtering / blocking other than outgoing SMTP (for ...
9
votes
1answer
681 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
9
votes
2answers
11k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
9
votes
2answers
3k views

Why is “AcceptEnv *” considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
9
votes
2answers
3k views

How to Protect Sensitive (HIPAA) SQL Server Standard Data and Log Files

I am dealing with electronic protected health information (ePHI or PHI) and HIPAA regulations require that only authorized users can access ePHI. Column-level encryption may be of value for some of ...
9
votes
6answers
5k views

How can I log users' bash commands?

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
9
votes
1answer
135 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
9
votes
2answers
2k views

How safe are Unattended Upgrades/Automatic Updates for Ubuntu

I'm in the process of trying to keep several ubuntu box's up to date and patched (10.4.2 LTS), one suggestion I've been getting is setting up unattended upgrades ...
9
votes
2answers
6k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
9
votes
1answer
245 views

Where can I embed proprietary information in a layer 2 or layer 3 packet?

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
9
votes
1answer
1k views

Configuring WPA2-Enterprise with Freeradius

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc. The problem is Windows clients need to uncheck the "Automatically ...
8
votes
3answers
13k views

Why won't automatic login through ssh with authorized_keys work?

I have created a private/public dsa-keypair. I've put the public key on the server in ~/.ssh/authorized_keys Everything is set up like my other server, but it seems like the server is just ...
8
votes
9answers
4k views

What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?

Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
8
votes
9answers
3k views

Who can eavesdrop on a user's HTTP traffic?

I have heard many times that HTTPS should be used for transferring private data, since HTTP is vulnerable to eavesdroppers. But in practical terms, just who is capable of eavesdropping on a given ...
8
votes
6answers
581 views

First time opening an SSH server to internet, what to check

I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it). ...
8
votes
13answers
7k views

How do I stop Ubuntu from starting daemons I've not explicitly asked to run?

One of the basic principles of computer security is never to run anything you don't need. I was pgrepping for a process today when I noticed that my Ubuntu 9.04 (desktop) machine was running a git ...
8
votes
5answers
813 views

Accurate, Unspoofable Time Source

I need an unspoofable and accurate time source. Short of setting up my own atomic clock (unless that's easier than it sounds) how could I accomplish this? It's not that I don't trust the NTP ...