Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
3answers
3k views

Block a Non-ActiveSync Device from accessing Exchange 2010

We're trying to tighten security, and block users from accessing our mail server without having the proper MDM on their phones. With programs like Aqua Mail and CloudMagic, it seems like they go ...
1
vote
0answers
210 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
0answers
55 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
1
vote
1answer
490 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
1
vote
0answers
2k views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
2answers
359 views

Suspicious Login Success in Event Viewer

Hope you can help. We have been noticing another user's local machine creating logon entries in the event viewer of our machine. The message received is "An account was successfully logged on". The ...
1
vote
1answer
745 views

Can a windows service running with network service or local system account, updated active directory container?

I have two windows services (one running as network service and the other as local system) - because of some architecture reasons these cannot run under domain user account. And there will be a store ...
1
vote
1answer
826 views

Why is PHP open_basedir not considered a security model

On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to his/...
1
vote
0answers
235 views

What are recommended permissions for files in /var/log? [closed]

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
1
vote
0answers
1k views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
1
vote
0answers
211 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
1
vote
0answers
128 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...
1
vote
1answer
158 views

Securely configuring nginx for php

I want to use nginx for both Symfony2 sites and other software like phpMyAdmin. I've read the nginx docs on setting up Symfony2 and came across this issue: http://www.webhostingtalk.com/showthread....
1
vote
1answer
222 views

Outbound ports for a firewall for webserver and db server

I have an environment where there is one firewall, and there is a secure segment and a DMZ segment behind it. There is a bunch of servers in the secure segment - DB server, the QA server, etc and ...
1
vote
1answer
2k views

Warning: Unavailable Version of Java Requested

We are updating client computers to JRE 1.7 but a partner Web application has a mention of the older java version in its applet HTML tags (java_version=1.6*). Because of this mention, the applet ...
1
vote
1answer
30 views

SQL Server Access Logs

Is it possible to show some type of access log where a valid user (who had access to a specific database [or multiple ones]) tried to access a database they didn't have access to? For example, if I ...
1
vote
2answers
475 views

Ubuntu Apache2 Secure Directory Issue

I have been trying to prevent access to WordPress wp-admin and wp-includes directories on Ubuntu 13.04 with Apache2 2.2.22. First I tried to do this using .htaccess which for some reason wouldn't ...
1
vote
1answer
99 views

Which way is more secure: apache:admin or folder group owner:apache?

I have been learning in recent days how to set up var/www/ permissions. I understand the common solution is set a group owner of all new folders to apache via sticky bit. How about giving the Apache ...
1
vote
1answer
434 views

I want to find a way to visualise security groups and their members

I hope someone can help... I want to find a way to visualise security groups and their members, and be able to show that to users in a simple format for discussion. I have a simple matrix in Excel ...
1
vote
2answers
69 views

Is it possible to limit access to an svn server to not just credentials but to machines as well?

my office has provided laptops to all staff in addition to the new desktops we just have. I have been asked to secure our svn server which is a dedicated server hosted somewhere with ubuntu running on ...
1
vote
1answer
113 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
1
vote
2answers
74 views

Apache 2.2 isn't obeying file level cgi permissions

I have two serveers. Server 1 runs Apache 2.2 and mod_perl 2.0.4. Server 2 runs Apache 2.0 and mod_perl 1.99. They have nearly identical conf files. The perl section of the vhost looks like this: &...
1
vote
3answers
445 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
1
vote
1answer
869 views

Java 7 Server SE JRE installation

I want to install Java 7 Server SE JRE on a Windows server box. Reading through the instructions here: http://docs.oracle.com/javase/7/docs/webnotes/install/windows/server-jre-installation-windows....
1
vote
1answer
377 views

How to Block Web Crawler from Downloading File

Is it possible to block web crawler from downloading files (like zip file) in my server? I supposed to create a PHP script using cookies to track visitors specially web crawlers to login/register ...
1
vote
1answer
831 views

How to ban web crawler using fail2ban

I am using nginx and I am always hit by web crawler if I am correct. I tried to configure fail2ban but the IP address cannot be detected by fail2ban. The reason that it is not detected because it ...
1
vote
1answer
1k views

Can't reach server without proxy (website down from my home)

I have a website hosted on Hostinger However I am experiencing problems with my wordpress site. This is really annoying. If I understood the situation right, The server is blocking me or denying ...
1
vote
2answers
4k views

httpd high cpu usage slowing down server response [duplicate]

my client has a image sharing website with about 100.000 visitor per day it has been slowed down considerably since this morning when i checked processes i've notice high cpu usage from http .... ...
1
vote
1answer
472 views

Windows 7: Allow installation of software by non-admins?

I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief ...
1
vote
0answers
69 views

Difference between “Security Configuration Manager” and “Security Configuration Wizard”

I want some clarifications about differences between SCW and SCM. strictly Speaking when I use SCM baseline for specific Server Role (domain controller, ftp server, ...), I get for example 200 gpo's ...
1
vote
1answer
607 views

Windows 7: Update a file in the system32 folder via GPO

I'd need to update a Windows file in the system32-folder I've made a script to do this task. When I run it locally on a system (from a prompt with elevated privileges) it works fine. I've created a ...
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
1
vote
0answers
75 views

Restrict users to certain applications only

We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us ...
1
vote
1answer
463 views

How to forbid user to bind a socket on other than a certain address?

I want this user not to be allowed to bind ports (effectively creating world-accesible servers, though on ports >1024) on the Internet interface, but be allowed to do in the loopback interface on ...
1
vote
2answers
241 views

How to implement firewall in LAN(out of users' os) like EC2 have done?

In aws ec2, users can set up security groups which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too. For example, ...
1
vote
0answers
29 views

What is a logical approach to tracking IPv6 connections for abuse? [duplicate]

I have a web server that issues AAAA records and I want to understand how I should monitor that interface for abuse. Specifically, how should I dice up that address to determine hacking or brute ...
1
vote
2answers
87 views

Securing a remote LAMP server that uses Capistrano for Git deploys

I am deploying my Github repo to a Media Temple Grid Server using Capistrano. In order to do this, I've setup the following: Enabled logging into the remote server with SSH keys (following this ...
1
vote
0answers
32 views

How to give Admins Access to move users to a Single OU [duplicate]

We are delegating few acceses to some admins via taskpads; So we created a OU called "Delete" and we want the admins to move all the users to be deleted to that OU; How can we do that , how can we ...
1
vote
0answers
385 views

Blue Coat - Blacklist list import

Is there a way to mass import domains into Blue Coat blacklist ? I get daily feeds from various sources and I was thinking whether I can modify the input file to a format to meet Blue coat ...
1
vote
1answer
965 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
1
vote
0answers
351 views

Securing iis 8 nt permissions

I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible. I have moved the websites to "c:\sites\mysiteA\", "c:\sites\...
1
vote
0answers
202 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
662 views

security group not allowing connection to postgres ec2 aws

Hey im having some trouble allow remote connections to postgres from other ec2 instances using the named security group feature to rules. I have set the listens directive in postgres.conf to "*" and ...
1
vote
1answer
119 views

Is opening port 80 for basic websites ok?

I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers. The information inside them is important to some extent, but not like credit ...
1
vote
1answer
430 views

Mounting /home as noexec [closed]

Does mounting /home with noexec really add security? All it does is disable binary execution right? So that means other scripts can still run and execute shell code into services. Run shared ...
1
vote
1answer
819 views

NIS: which mechanism hides shadow.byname for unpriviledged users?

On some Linux box (SLES 11.1) which is a NIS client I can do as root: ypcat shadow.byname and get output, i.e. some lines with the encrypted passwords, amongst other information. On the same Linux ...
1
vote
0answers
1k views

Disabling all write (cd burning) permissions for a specific group of users on all CD/DVD drives mounted in Windows XP Pro SP3

I want all users within 'Restricted' user group (Windows XP Professional SP3) to be able to read from CDs/DVDs they insert. I don't want these users to be able to burn any CDs/DVDs using CDRW/DVDRW ...
1
vote
1answer
201 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...
1
vote
1answer
325 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN (http/...
1
vote
2answers
189 views

prevent files modification from users: is this method safe?

I was wondering today if there was a way to enforce a non root user to have a specific authorized_keys file (among other sensible files). I came up with this solution. Disable StrictModes in ...