Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
2answers
453 views

Considerations for Security appliance/software in DMZ

What are the significant considerations when designing and setting up a dmz for a relatively small office (15-20users) with a limited budget? The network traffic across the dmz will be inbound smtp (...
1
vote
2answers
54 views

OpenStack Horizon behind reverse proxy (nginx preferred)

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
1
vote
2answers
47 views

Block SSH hop based on traffic origin?

Is there a way to find where the SSH traffic origins from? We have two servers A and B. A is on a private network. B has 2 nics, private and public. A can SSH into B and B can SSH into A problem is, ...
1
vote
1answer
49 views

How to install secrets safely on EC2 instances?

Context: Setting up an infra with some Auto-scaling groups and some non-scaling self-standing VMs. Some roles need secrets (private keys) which should be restricted to root or to specific users. ...
1
vote
0answers
35 views

Someone Uploaded PHP Backdoor to Wordpress Site [duplicate]

I have enough security that I was alerted to a PHP backdoor that was uploaded to a WordPress site hosted on one of my servers. It was removed within minutes of being uploaded so no damage was done. No ...
1
vote
0answers
45 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
1answer
36 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...
1
vote
1answer
53 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
1
vote
0answers
29 views

Determine server damage - File injected possibly through ProFTPD [duplicate]

I just found a file at the /tmp/ directory named .<?php passthru($_GET['cmd']);echo 'm3rg3';?> Owner and GroupOwner are "proftpd" and "nogroup", respectively, as follows: -rw-r--r-- 1 proftpd ...
1
vote
0answers
21 views

How I can look from that script runs sendmail?

my problem is that some script in php or some other script or program is sending spam. I am not able to trace where this program runs. do the following: ps aux | grep sendmail nginx 28286 0.0 ...
1
vote
0answers
16 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
49 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...
1
vote
0answers
409 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
1
vote
0answers
22 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
1
vote
2answers
138 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
1
vote
1answer
38 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
1
vote
1answer
83 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
1
vote
0answers
44 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
1answer
59 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
1
vote
0answers
39 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
1
vote
0answers
53 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
1
vote
1answer
30 views

Setting up BART in a Solaris non-global zone (aka Solaris Zone)

So my question is about running BART (The Solaris Basic Audit Reporting Tool) inside of a Solaris non-global zone. I'm confused on this subject due to I have been reading a lot of conflicting views, ...
1
vote
0answers
24 views

How to protect nginx proxy from being spoofed by other reverse proxies?

I've recently noticed that one of my sites that's running behind nginx proxy became accessible via bunch of random domains. Some of them are proxies generated by sites like http://unblocksit.es and ...
1
vote
0answers
20 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
1
vote
2answers
34 views

Passphrase-less ssh keys on a puppet master?

Our puppet code lives on github, so we pull to the puppet master. But our github repository is private. Is standard (best) practice to give the puppet master ssh keys to github without passphrase (...
1
vote
1answer
75 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
1
vote
0answers
423 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
1
vote
0answers
182 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
1
vote
0answers
116 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
1answer
63 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
1
vote
1answer
113 views

LDAP auth successful with additional characters

I have a service which uses a LDAP directory (anonymous bind) to get the users and their passwords in order to perform the authentication. The problem is that I've realized that I can login with a ...
1
vote
1answer
43 views

IPMI only over HTTP

I am actually performing a security review for a customer and I'm being confusing about the IPMI case. If I'm correct, the protocol is flawed by design, thus directly exposing the IPMI service (udp/...
1
vote
0answers
69 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
3answers
290 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
1
vote
0answers
49 views

Allowing IIS_IUSRS to encrypt & decrypt files [closed]

I have a simple ASP.NET site (on Windows Server 2012 R2 & IIS 8.5) for uploading files to a server. I would like to automatically encrypt these files using Windows' built-in Cryptographic Service ...
1
vote
0answers
21 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
1
vote
1answer
173 views

PCI compliance Apache versions [duplicate]

We are working with current version of Apache 2.4. 6 available in a Centos 7 repos. Installed with yum. and we are dealing with the PCI compliance and the report says: IP Address: x Host: x Path: ...
1
vote
0answers
17 views

Preventing abuse when running recursive DNS forwarder [closed]

I have a running instance of Unbound on a server, which forwards certain personal non-ICANN domains to authoritative DNS servers on the same machine, and forwards everything else (com, net, etc) to ...
1
vote
0answers
12 views

Securing APIs with oAuth

I've been reading up on oAuth the last few days but there is one thing that is not totally clear to me. So I've got this oAuth Authorization Server which (skipping a few steps in between here) in the ...
1
vote
0answers
24 views

Allow log on locally custom message

I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the ...
1
vote
0answers
43 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
1
vote
0answers
17 views

Should each task/process/role run as its own user on a Windows server?

I know that on Linux servers, it's widely considered best practice to run each task/role/process/server/program as its own user and usually in its own group. How should separate tasks be handled on a ...
1
vote
0answers
69 views

any problems with UseLogin yes? /(workaround on no system information safe?)

this is about the system information, shown to the user after login on an ubuntu-server. by default, an ubuntu-server is showing you system information, when logging in, such as the servers ip-...
1
vote
1answer
62 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
1
vote
0answers
208 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
67 views

Encrypt credentials JNDI authenticating to JBoss 7.1.1.Final

In my JNDI Lookup, connecting to JBoss 7.1.1.Final from remote clients with plain text password is working fine. Now, I am trying to encrypt credentials in the form, but it's not working. #==========...
1
vote
0answers
318 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
0answers
61 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
1
vote
0answers
55 views

Public Key Pinning and subdomains [closed]

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
0answers
173 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...