Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
225 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
1
vote
0answers
22 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
1
vote
2answers
95 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
1
vote
1answer
36 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
1
vote
1answer
65 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
1
vote
0answers
43 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
1answer
53 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
1
vote
0answers
37 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
1
vote
0answers
47 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
1
vote
1answer
26 views

Setting up BART in a Solaris non-global zone (aka Solaris Zone)

So my question is about running BART (The Solaris Basic Audit Reporting Tool) inside of a Solaris non-global zone. I'm confused on this subject due to I have been reading a lot of conflicting views, ...
1
vote
0answers
24 views

How to protect nginx proxy from being spoofed by other reverse proxies?

I've recently noticed that one of my sites that's running behind nginx proxy became accessible via bunch of random domains. Some of them are proxies generated by sites like http://unblocksit.es and ...
1
vote
0answers
18 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
1
vote
2answers
34 views

Passphrase-less ssh keys on a puppet master?

Our puppet code lives on github, so we pull to the puppet master. But our github repository is private. Is standard (best) practice to give the puppet master ssh keys to github without passphrase (...
1
vote
1answer
72 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
1
vote
0answers
316 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
1
vote
0answers
144 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
1
vote
0answers
104 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
1answer
61 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
1
vote
1answer
113 views

LDAP auth successful with additional characters

I have a service which uses a LDAP directory (anonymous bind) to get the users and their passwords in order to perform the authentication. The problem is that I've realized that I can login with a ...
1
vote
1answer
41 views

IPMI only over HTTP

I am actually performing a security review for a customer and I'm being confusing about the IPMI case. If I'm correct, the protocol is flawed by design, thus directly exposing the IPMI service (udp/...
1
vote
0answers
67 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
3answers
256 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
1
vote
0answers
49 views

Allowing IIS_IUSRS to encrypt & decrypt files [closed]

I have a simple ASP.NET site (on Windows Server 2012 R2 & IIS 8.5) for uploading files to a server. I would like to automatically encrypt these files using Windows' built-in Cryptographic Service ...
1
vote
0answers
21 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
1
vote
1answer
158 views

PCI compliance Apache versions [duplicate]

We are working with current version of Apache 2.4. 6 available in a Centos 7 repos. Installed with yum. and we are dealing with the PCI compliance and the report says: IP Address: x Host: x Path: ...
1
vote
0answers
17 views

Preventing abuse when running recursive DNS forwarder [closed]

I have a running instance of Unbound on a server, which forwards certain personal non-ICANN domains to authoritative DNS servers on the same machine, and forwards everything else (com, net, etc) to ...
1
vote
0answers
11 views

Securing APIs with oAuth

I've been reading up on oAuth the last few days but there is one thing that is not totally clear to me. So I've got this oAuth Authorization Server which (skipping a few steps in between here) in the ...
1
vote
0answers
23 views

Allow log on locally custom message

I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the ...
1
vote
0answers
40 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
1
vote
0answers
17 views

Should each task/process/role run as its own user on a Windows server?

I know that on Linux servers, it's widely considered best practice to run each task/role/process/server/program as its own user and usually in its own group. How should separate tasks be handled on a ...
1
vote
0answers
64 views

any problems with UseLogin yes? /(workaround on no system information safe?)

this is about the system information, shown to the user after login on an ubuntu-server. by default, an ubuntu-server is showing you system information, when logging in, such as the servers ip-...
1
vote
1answer
60 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
1
vote
0answers
192 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
63 views

Encrypt credentials JNDI authenticating to JBoss 7.1.1.Final

In my JNDI Lookup, connecting to JBoss 7.1.1.Final from remote clients with plain text password is working fine. Now, I am trying to encrypt credentials in the form, but it's not working. #==========...
1
vote
0answers
291 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
0answers
60 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
1
vote
0answers
50 views

Public Key Pinning and subdomains [closed]

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
0answers
162 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
1answer
553 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
1
vote
0answers
2k views

sysctl: cannot stat /proc/sys/kernel/exec-shield: No such file or directory

Enable ExecShield protection - ExecShield is security Linux kernel patch to avoid worms and other problems. After Adding to /etc/sysctl kernel.exec-shield = 1 Getting this error sysctl: cannot ...
1
vote
0answers
94 views

iis 7.5 ipSecurity denyAction=NotFound causes 500 error instead of 404

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config: <ipSecurity allowUnlisted="false"> <add ...
1
vote
0answers
60 views

Allow Execution, Deny Interactive login by GPO

Problem: Accounts to log into work stations are locked down tightly and unable to run nessesary applications on windows 7 stations. Saving an admin accounts credentials to elevate access is currently ...
1
vote
1answer
149 views

Audit Logs for Environment Path Changes

Something (or someone) keeps changing our environment path variables on several of our servers. I have the Audit Policy (under local sec pol) set to Success, Failure for all but Process Tracking (...
1
vote
1answer
30 views

Webserver | IIS | Configuring to not run certain files

I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP. Lets assume the a user is able to upload a trojan onto my server, either through a ...
1
vote
1answer
104 views

Virtual web server configuration dmz [closed]

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running: - Mail server - WEB server for enterprise website and ecommerce. the esxi server has an iscsi ...
1
vote
0answers
34 views

I can installa “Ossec” on xenserver host? [closed]

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec (...
1
vote
0answers
37 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
1
vote
1answer
621 views

MS CRM: How secure is an Internet Facing Deployment (IFD)?

From a security perspective, how secure is an IFD deployment of MS CRM 2013 or CRM 2015? I know it's the recommended way to expose MS CRM to the net, but what are the vulnerabilties? Is it ...
1
vote
0answers
101 views

SSH Passwords are working using IP address, but not when using the server name [closed]

We recently rebuilt one of our servers using Ubuntu 12.04 LTS and experienced something we haven't seen before. When we attempt to ssh into the box, we are able to ssh into the box if we use the ip ...
1
vote
1answer
302 views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...