Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
586 views

How can I edit web.config to have a different MIME type for a single XML file not others?

I am trying to set the MIME type for Flash's cross domain file in web.config. Since this file has an extension of .XML the following command will edit the MIME type of all XML documents in my site ...
1
vote
1answer
851 views

SQL injection security vulnerability in Plesk control pannel [closed]

I have plesk 10.3.1 and I received following email from the Plesk admin Parallels, the manufacturer and distributor of the Plesk Control Panel, has identified a SQL injection security ...
1
vote
2answers
189 views

FTP SITE CHMOD Error

When trying to edit file/folder permissions via FTP I am getting the error: 505 Security server forbids SITE commands. Contact admin. I am currently using VSFTPD with the config value ...
1
vote
1answer
94 views

Securing php webserver from exploits? [closed]

We are running a PHP application on a linux apache webserver. How can we secure the server, so if someone finds a hole in our application, they can only get access to the application (Files inside ...
1
vote
1answer
448 views

How to secure a Windows SBS Server against fraudulant login attempts?

I administer a Windows Small Business Server 2003 R2 server for a small business. The only ports that this server has exposed to the internet are SSL and the RDP tunnelling port used by the SBS remote ...
1
vote
2answers
446 views

Finding source of directory traversal attack originating from my server

Two weeks ago, I was notified by my VPS provider that my server (CentOS 5.5, yum is up to date) had originated "NULL byte/Directory Traversal" attacks agains some servers at DreamHost. I spent a few ...
1
vote
1answer
412 views

openVAS scan against new instance fails test (possible false positive) How to debug plug-in

I have openVAS installed from the atomic corp YUM repo, and it all seems to be functioning wonderfully, however I am seeing a single "Security Hole" which is that OpenVAS detects that "arora" is ...
1
vote
2answers
464 views

OpenSSH 5.9p1 on Ubuntu 11.10

I want to build a deb package with the latest version of openssh from source. Then I want to install it on my machine. I am running: Linux Ubuntu-1110-oneiric-64-minimal 3.0.0-12-server #20-Ubuntu ...
1
vote
0answers
261 views

ejabberd changing ports?

I changed the ports in the listen section (just added a 1 in front of them) in the /etc/ejabberd/ejabberd.cfg, but after a /etc/init.d/ejabberd restart The server still listens on the original ...
1
vote
0answers
1k views

Why is my access being denied when I am an adminstrator on my Windows Server 2003 Installation?

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to ...
1
vote
1answer
122 views

Do Mac OS X servers have a security mechanism that blocks a user if they log in from two different IPs?

A trusted friend and I had ssh'ed into a Mac OS X Web Server (either 10.6.8 Snow Leopard or 10.7 Lion) from two different locations. Then my password stopped working when trying to log in. I can ...
1
vote
2answers
46 views

Security Policy based on Subnet [closed]

We are implementing a security policy and Firewall access rules based on the subnet using static dhcp bindings. There is one scenario where some one can manually assign ip address from a subnet with ...
1
vote
2answers
169 views

Securing shared Apache2 + PHP

We want to setup a shared webserver running Apache2 and PHP5. Our need is to host some PHP apps like Wordpress, Zend framework applications... Some of the sites may be controlled by external ...
1
vote
0answers
452 views

Can ApacheDS LDAP change root user name?

ApacheDS 1.5 has the following account by default. Bind dn or user: uid=admin,ou=system Bind password: secret i would like to change it to the following to avoid making changes in my code Bind dn ...
1
vote
1answer
70 views

multi-purpose server - security

running ubuntu server 10.04. This box is both a web (apache2) and vpn (openvpn) server. Here is how the network is currently configured. router 192.168.1.1 | | LAN | | ubuntu server 192.168.1.2 NAS ...
1
vote
3answers
91 views

How to give web users access to server securely?

I'm building an application that will enable users to write code from the browser. Once the code is written I save the contents to my webserver in a user-specific folder. I'd also like to add a ...
1
vote
2answers
250 views

Can httpd check permissions of private key file used with SSL certificate?

Is it possible to have httpd fail a configtest if a SSLCertificateKeyFile value exists, and points to a file with any permissions other than the minimum necessary for reading the key? I have httpd ...
1
vote
0answers
605 views

Where can I find information about inbuilt registry keys for Windows Server 2008 R2?

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances. ...
1
vote
1answer
138 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
1
vote
0answers
41 views

Access error with administrator accounts

Problem: I have access denied on system files and folders, using accounts that are in the local\administrators group. system is W7 Ultimate 64 bit that is joined to a domain. the users that login to ...
1
vote
1answer
3k views

How to set a network interface as 'trusted' on Centos 6 (with multiple interfaces)

I have a box with two wired network interfaces. On Centos 5 I could run the setup command in console and set which interface is trusted and which not in the firewall configuration (e.g. eth1 trusted, ...
1
vote
2answers
264 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
1
vote
1answer
246 views

Security risk of JIRA standalone installation running JRE version 1.6.0_26 vs 1.6.0_29 (latest)

Atlassian recently introduced a standalone installer that installs JIRA, along with its own JRE. Unfortunately the JRE Atlassian bundles with this installer is 1.6.0_26, whereas the current version of ...
1
vote
1answer
106 views

SelfSSL in IIS 6.0

I am using IIS 6.0 and selfSSL to create a self signed certificate, but it only lasts one week. How do I prolong the time of this?
1
vote
1answer
55 views

Application hosted in IIS7 does not provide credentials to Web Service on another server

At the moment we identified that the error is due to security issues. The old server ServerA managed to communicate with WebServerC without problems, now the new server ServerB can connect but the ...
1
vote
1answer
550 views

Windows EC2 instances in same security group cannot communicate

I have 2 instances (windows machine) in the same security group. I create a network drive on instance machine(A) for share a folder to other instance machine(B). But when I map a network path on ...
1
vote
2answers
505 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
1
vote
0answers
105 views

subdomain security IIS doesn't have authentication

I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are ...
1
vote
1answer
249 views

ASA 5520, I cannot communicate to the DMZ

Well im having some serious issue here. My internal PCs cannot communicate to the DMZ to access the www plus the mail server- Im a bit new to the game and therefore im n not tchat good at all.. ...
1
vote
0answers
57 views

Oracle SGD 4.61.915 not closing Windows 2003 application sessions

I'm using a Windows 2003 Application Server and I have followed this article: http://download.oracle.com/docs/cd/E19351-01/821-1926/z40000df1311155.html#bbjiefec but still.. when i close a application ...
1
vote
1answer
286 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
1
vote
1answer
165 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
40 views

Hiding admin panel on separate domain?

I have a large site, I was thinking of the safest way to hold an admin panel for a site and was wondering what if I put the admin panel on a separate site? Would google find my admin panel site just ...
1
vote
0answers
34 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
0answers
239 views

can SECEDIT.exe be used to only add 1 group to 1 security policy? example?

I am assuming based on my research for using SECEDIT.exe -- that a template would be added to the exisitng security .SDB file. That this template would be very tiny... only naming the security policy ...
1
vote
0answers
373 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
1
vote
1answer
208 views

PolicyKit vs polkit

What is the difference between PolicyKit and polkit? They seem to do the same thing in different ways and seem to be referred to interchangeably, but also seem to be two different things. Which one ...
1
vote
1answer
285 views

Which is more secure - windows authentication or encrypted config sections?

I recently had this discussion with a colleague. We need to secure the connection strings that are in our .config files (for SOX compliance) and found two options: Encrypt the connection string ...
1
vote
1answer
163 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...
1
vote
1answer
162 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
2k views

Help needed accessing the %UserProfile%\AppData\Roaming\Microsoft\Crypto folder

Z:\Users\markk\AppData\Roaming\Microsoft>whoami shunranet\markk Z:\Users\markk\AppData\Roaming\Microsoft>cacls Crypto Z:\Users\markk\AppData\Roaming\Microsoft\Crypto NT ...
1
vote
1answer
223 views

Scripting access permission to Mac OS X 10.6 managed services

On Snow Leopard, I can give access to services like SSH only to specific users by using the "only these users:" option in the sharing tab of the System preferences. This is bothersome to use when ...
1
vote
1answer
98 views

Does MS SQL 2005 encryption protect data in the case of physical server access?

I am looking into MS SQL 2005 encryption (not 2008, so TDE is out), and I believe I understand the concept of how a column is encrypted. The OS uses the service credentials to encrypt the service ...
1
vote
1answer
103 views

Restrict access to network location from Windows Explorer

We have a legacy application which has data and PDF files available on a network share, and a locally-installed EXE to run it. The EXE uses a UNC path to access the data and PDFs. The customer is ...
1
vote
1answer
157 views

Create Mobile Device Management Server for iPhone Management on Windows Server

I need to create Mobile Device Management server to manage my enterprise's iPhone devices. I need to configuration it on Windows 2008 server. What are the steps to configure Mobile Device Management ...
1
vote
0answers
111 views

Client certificate based encryption

I have a question about security of a file on a webserver. I have a file on my webserver which is used by my webapplication. It's a bitcoin wallet. Essentially it's a file with a private key in it ...
1
vote
1answer
1k views

Reset Security on Win7 Windows folder

Is there a way to reset the security settings on the c:\windows folder of Win7. I have found this approach here, but formatting an copying back seems a little complex. Any ideas?
1
vote
2answers
218 views

IIS IP Adress Restriction - can I rely on it online?

I have an idea I'd like to float to the smart people of serverFault to pick holes in it. I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login ...
1
vote
0answers
658 views

Dell PowerConnect 6224F ACL Not Performing as Expected

What I'm trying to achieve is as follows: Allow full access to the device on 10.58.9.32 (our VoIP server), from anywhere on our network. Allow ICMP to flow in all directions to/from any device. ...