Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
3answers
120 views

Is there a way to tell if there is key stroke logging software installed? [closed]

I have a Windows-XP machine as my desktop system at work. Is there any way to tell if there is keystroke logging software running on my system or any other software that may be monitoring my system ...
0
votes
3answers
138 views

Where would I go to learn to make a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS)

Where would I go to learn to set up a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS). Note that I am not looking for a favorite choice between ...
0
votes
3answers
481 views

logwatch explanation

Could anyone please explain what the various parts of the following LogWatch mean: --------------------- IMAP Begin ------------------------ [IMAPd] Logout stats: ==================== User | ...
0
votes
2answers
285 views

Why isn't this .htaccess file working?

Recently, my website was hammered with thousands of POST requests from various bots. Instead of taking the approach of blocking these bots based on their user agent, I've decided to find a way to ...
0
votes
2answers
219 views

Mysql remote encryption

I'm using a remote connection to mysql. Both the webserver and the server with mysql on it will use internal ip addresses to connect. 1) Is encrypting necessary? 2) Is their a built in / simple way ...
0
votes
1answer
151 views

Windows file sharing for only 1 NIC

Our Windows 2008 servers are at a Data Center. Both have 2 network cards. One card is connected to the switch that connects to the Internet the other is connected to a switch that serves only our ...
0
votes
4answers
53 views

Is there any application for handling groups and members on Linux?

I have a Linux production server. There are no simple codes for viewing groups, members, how many groups one member is part of etc etc. Is there any good and secure application for this? Thanks
0
votes
3answers
271 views

May the file size returned by stat be compromised?

I want to make sure that nobody changed a file. In order to accomplish that, I want not only to check MD5 sum of the file, but also check its size, since as far as I understand this additional simple ...
0
votes
2answers
1k views

How to configure mysql to connect via sockets?

My mysql server is installed on the localhost machine where my php scripts are stored. So is what they say right that it's safer to connect to mysql from php that is placed in the same server? If so, ...
0
votes
3answers
5k views

Windows Server 2003 - “The security log on this system is full.” message when logging in

When I remote desktop into one Windows Server 2003 machine, I get a popup message saying "The security log on this system is full." When I open the Event Viewer, the security log size is 512.0 KB, ...
0
votes
6answers
385 views

What is the risk of introducing non standard image machines to a corporate environment

I’m after some feedback from those in the managed desktop or network security space on the risks of introducing machines that are not built on a standard desktop image into a large corporate ...
0
votes
2answers
54 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
0
votes
1answer
53 views

Block file browsing on Windows Explorer

I have a Citrix application that open Windows Explorer from a menu. The command invoked to open Explorer is: Explorer "g:\app\folder" What happens when Explorer is opened is that it shows a window ...
0
votes
1answer
84 views

Linux glibc versions 2.18 and older - vulnerability

Server: Red Hat Enterprise Linux Server release 5.9 (Tikanga) I came to know that Linux GNU C Library (glibc) versions prior to 2.18 are vulnerable to remote code execution via a vulnerability in the ...
0
votes
2answers
945 views

Can't update to latest PHP version. Centos 7 [closed]

I'm unable to update to the latest PHP package. I ran yum update php and it updated to PHP 5.4.16. Reran the update command to see if there was any newer versions and stated there was no packages ...
0
votes
1answer
39 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
0
votes
1answer
77 views

An account failed to log on Message on Windows 2008 R2

I'm having hundreds of messages in my Security Event System like: An account failed to log on. Failure Reason: Unknown user name or bad password. Caller Process Name: ...
0
votes
1answer
147 views

A ghost process started automatically and drains CPU [duplicate]

I am running an Ubuntu virtual machine that has few sites installed on it. I think due to my error and wrong permissions a malicious code was uploaded on the server and the "worm" had root access for ...
0
votes
3answers
181 views

How to use `rsync` to securely push to a mirror?

I am using rsync --rsh "ssh" to push to a mirror. Setting the necessary file system permissions on the mirror requires rsync to run with root privileges on the mirror. However, the mirrored files ...
0
votes
1answer
150 views

How open ports in INPUT chain, only for a target IP, with iptables?

I have a server Debian 7 Wheezy, with 2 assigned IPs. I have different service on different port assigned to the IPs. How can i set iptables rule, to work only with one of IP? Example: I Have 2 IPs: ...
0
votes
2answers
69 views

How can i make my all webistes only accessible by browsers and not auto scripts

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101 Is there any way that my all websites are only avaiable to genuine browsers and not ...
0
votes
2answers
73 views

How Do I Defend WebEx Security?

My company is an ISV selling software to banks and credit unions. We provide customer support via WebEx but every once in a while we'll have a customer that won't open their firewall to the WebEx ...
0
votes
2answers
516 views

Does open_basedir works recursive?

Does open_basedir works recursive? For example if I write in php.ini something like: open_basedir=/client3/web3/web Does it include all directories in /client3/web3/web (/client3/web3/web/1, ...
0
votes
2answers
46 views

Should my database server offer SSL?

I was installing a renewed SSL cert on my web servers and noticed that my DB server doesn't have one set up, which got me wondering: Should my database server only accept connections via SSL? The ...
0
votes
2answers
430 views

Can I use SSL termination for sensitive data, and if not what is the point of even using SSL with termination?

I have read, namely on Rackspace, that one should not use SSL termination for sensitive information (search the page for "SSL Termination should not be used"). Firstly, why would that be the case. ...
0
votes
3answers
84 views

centos private key and root login

I wanted to know if it's good practice / secure to allow login as root with ppk (private key) file. (no password). This server is only for me and no one else is working on it. Thanks, Danny
0
votes
2answers
114 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
0
votes
1answer
311 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
0
votes
2answers
11k views

ASDM unable to launch device manager from

I can't access to my Cisco asa 5505 from my Windows 7 64bit. The problem is that i can connect on it using the ASDM from another PC (WinXP 32bit), and i can connect using my win7 64bit to another ...
0
votes
1answer
121 views

Microsoft Security Compliance Manager terms

Recently i have installed Microsoft Security Compliance Manager. But i am confused with some terms. As per the print-screen ( which is mark in Red-Colour Round ) 1st - the 'Default' here means the ...
0
votes
3answers
479 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
1answer
137 views

ssyn.c and slow.c used on my VPS [duplicate]

I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
3answers
735 views

How to set the ulimit (fd) when you fork a process?

Normally /etc/security/limits.h only work when you login into a shell. How about when you fork a process in Linux, where is the value of Max open files of /proc/PID/limits is controlled by?
0
votes
2answers
93 views

Can't get rid of Apache server-status

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server. I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP ...
0
votes
2answers
336 views

Script to check server for WordPress installs and report version information [closed]

I'm looking for a script that can be run on a linux server that will find all WordPress installs and report their versions, or report if a version is out of date. I've googled for something and it ...
0
votes
1answer
399 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
1answer
60 views

How to find on the Windows 7 who and when use(d) a certain share?

We have a workstation using Win7 on a LAN with a domain. On that workstation we set up some network shares. Can we find who used (user name and/or computer name) and when the shares? Note that we ...
0
votes
2answers
160 views

Why should I keep the root user if I'm not supposed to use it?

I'm on a fresh VPS with Ubuntu Server 12.04. I wanted to ask you the good practices to apply to enhance security over a stock Ubuntu-server. This is what I did up to now: I added Google Authenticator ...
0
votes
2answers
3k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
0
votes
1answer
289 views

Can /etc/hosts.deny/allow be overridden?

I have security measures put in place to keep unwanted users out of my server. I've changed the SSH port, disabled root login, have a software firewall to block portscans, and have entries in ...
0
votes
1answer
2k views

Iptables: Block all countries except my own for specific port

I would like to block all IPs (CIDR 0.0.0.0/0) except for German IPs for the SSH, FTP and SMTP ports. So, the default policy for those ports should be "DROP". I have a list of all German IP ...
0
votes
1answer
2k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
0
votes
1answer
253 views

How to restrict user to run and use only one program running on my server?

I have a cloud server running windows-server-2008 and i want my customer to log in to the server using remote desktop and the customer can run my own program only , he should not be able to run any ...
0
votes
3answers
819 views

How can I tell which ColdFusion hotfixes are installed?

I saw the new secruity hotfix for ColdFusion on adobe.com, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765. How can I tell which ColdFusion hotfixes ...
0
votes
4answers
298 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
0
votes
1answer
59 views

How to protect file if physicall access to the server is possible? W2008R2

Is there a way to protect exe if server is on colocation hence the physical access is possible for the colo people? I have W2008R2 and was thinking of using BitLocker but it seems encrypting the whole ...
0
votes
3answers
2k views

Mysterious Network Client

When I look at my data network with Windows Explorer My Network Places I see all of my network clients and printers. However, I am seeing an unknown client called tsclient. When I click on it I ...
0
votes
1answer
181 views

My website keeps being hit by iPhones…am I being DDOSed?

66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
0
votes
2answers
134 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
0
votes
2answers
128 views

Oracle Security Update Patch July 2011 - How to know if i am affected?

Oracle Security Update Patch July 2011 I am using JDK 1.4.2_08, 1.4.2_19, 1.4.2_22, and Oracle DB 9.2.0.8. Can any experts tell me how to tell if i am affected, i.e. after installing the patch ...