Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
2answers
244 views

Can httpd check permissions of private key file used with SSL certificate?

Is it possible to have httpd fail a configtest if a SSLCertificateKeyFile value exists, and points to a file with any permissions other than the minimum necessary for reading the key? I have httpd ...
1
vote
0answers
596 views

Where can I find information about inbuilt registry keys for Windows Server 2008 R2?

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances. ...
1
vote
1answer
138 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
1
vote
0answers
41 views

Access error with administrator accounts

Problem: I have access denied on system files and folders, using accounts that are in the local\administrators group. system is W7 Ultimate 64 bit that is joined to a domain. the users that login to ...
1
vote
1answer
3k views

How to set a network interface as 'trusted' on Centos 6 (with multiple interfaces)

I have a box with two wired network interfaces. On Centos 5 I could run the setup command in console and set which interface is trusted and which not in the firewall configuration (e.g. eth1 trusted, ...
1
vote
2answers
262 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
1
vote
1answer
245 views

Security risk of JIRA standalone installation running JRE version 1.6.0_26 vs 1.6.0_29 (latest)

Atlassian recently introduced a standalone installer that installs JIRA, along with its own JRE. Unfortunately the JRE Atlassian bundles with this installer is 1.6.0_26, whereas the current version of ...
1
vote
1answer
105 views

SelfSSL in IIS 6.0

I am using IIS 6.0 and selfSSL to create a self signed certificate, but it only lasts one week. How do I prolong the time of this?
1
vote
1answer
55 views

Application hosted in IIS7 does not provide credentials to Web Service on another server

At the moment we identified that the error is due to security issues. The old server ServerA managed to communicate with WebServerC without problems, now the new server ServerB can connect but the ...
1
vote
1answer
549 views

Windows EC2 instances in same security group cannot communicate

I have 2 instances (windows machine) in the same security group. I create a network drive on instance machine(A) for share a folder to other instance machine(B). But when I map a network path on ...
1
vote
2answers
494 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
1
vote
0answers
104 views

subdomain security IIS doesn't have authentication

I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are ...
1
vote
1answer
249 views

ASA 5520, I cannot communicate to the DMZ

Well im having some serious issue here. My internal PCs cannot communicate to the DMZ to access the www plus the mail server- Im a bit new to the game and therefore im n not tchat good at all.. ...
1
vote
0answers
57 views

Oracle SGD 4.61.915 not closing Windows 2003 application sessions

I'm using a Windows 2003 Application Server and I have followed this article: http://download.oracle.com/docs/cd/E19351-01/821-1926/z40000df1311155.html#bbjiefec but still.. when i close a application ...
1
vote
1answer
285 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
1
vote
1answer
165 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
39 views

Hiding admin panel on separate domain?

I have a large site, I was thinking of the safest way to hold an admin panel for a site and was wondering what if I put the admin panel on a separate site? Would google find my admin panel site just ...
1
vote
0answers
34 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
0answers
239 views

can SECEDIT.exe be used to only add 1 group to 1 security policy? example?

I am assuming based on my research for using SECEDIT.exe -- that a template would be added to the exisitng security .SDB file. That this template would be very tiny... only naming the security policy ...
1
vote
0answers
373 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
1
vote
1answer
205 views

PolicyKit vs polkit

What is the difference between PolicyKit and polkit? They seem to do the same thing in different ways and seem to be referred to interchangeably, but also seem to be two different things. Which one ...
1
vote
1answer
285 views

Which is more secure - windows authentication or encrypted config sections?

I recently had this discussion with a colleague. We need to secure the connection strings that are in our .config files (for SOX compliance) and found two options: Encrypt the connection string ...
1
vote
1answer
162 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...
1
vote
1answer
162 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
2k views

Help needed accessing the %UserProfile%\AppData\Roaming\Microsoft\Crypto folder

Z:\Users\markk\AppData\Roaming\Microsoft>whoami shunranet\markk Z:\Users\markk\AppData\Roaming\Microsoft>cacls Crypto Z:\Users\markk\AppData\Roaming\Microsoft\Crypto NT ...
1
vote
1answer
223 views

Scripting access permission to Mac OS X 10.6 managed services

On Snow Leopard, I can give access to services like SSH only to specific users by using the "only these users:" option in the sharing tab of the System preferences. This is bothersome to use when ...
1
vote
1answer
98 views

Does MS SQL 2005 encryption protect data in the case of physical server access?

I am looking into MS SQL 2005 encryption (not 2008, so TDE is out), and I believe I understand the concept of how a column is encrypted. The OS uses the service credentials to encrypt the service ...
1
vote
1answer
102 views

Restrict access to network location from Windows Explorer

We have a legacy application which has data and PDF files available on a network share, and a locally-installed EXE to run it. The EXE uses a UNC path to access the data and PDFs. The customer is ...
1
vote
1answer
157 views

Create Mobile Device Management Server for iPhone Management on Windows Server

I need to create Mobile Device Management server to manage my enterprise's iPhone devices. I need to configuration it on Windows 2008 server. What are the steps to configure Mobile Device Management ...
1
vote
0answers
111 views

Client certificate based encryption

I have a question about security of a file on a webserver. I have a file on my webserver which is used by my webapplication. It's a bitcoin wallet. Essentially it's a file with a private key in it ...
1
vote
1answer
1k views

Reset Security on Win7 Windows folder

Is there a way to reset the security settings on the c:\windows folder of Win7. I have found this approach here, but formatting an copying back seems a little complex. Any ideas?
1
vote
2answers
218 views

IIS IP Adress Restriction - can I rely on it online?

I have an idea I'd like to float to the smart people of serverFault to pick holes in it. I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login ...
1
vote
0answers
646 views

Dell PowerConnect 6224F ACL Not Performing as Expected

What I'm trying to achieve is as follows: Allow full access to the device on 10.58.9.32 (our VoIP server), from anywhere on our network. Allow ICMP to flow in all directions to/from any device. ...
1
vote
1answer
247 views

How do I configure a server to stop blocking unzipped files

I have an application running on Windows2008 server. The automated deployment process drops a zipped package onto a folder, and then another script unzips this and copies the executables. The problem ...
1
vote
1answer
122 views

secure L2 connection

Due to some rapid changes I need to also provide vlan(s) in a new location. The topology looks like this: (main location, vlans:id=6(workstations),id=8(phones)) | my_switch01 \ \ ...
1
vote
1answer
924 views

Changing TCP/IP IPID sequence generation algorithm on Windows Server

a recent security review on a customers webserver yielded the following results: "[...] The system under test is using incremental ip ids. This means that every outgoing ip packet has an ...
1
vote
1answer
919 views

LSASS.exe trying to communicate over port 80

We are running a standalone web server (Windows 2008 + IIS 7), and our antivirus is blocking LSASS.exe (C:\Windows\system32\lsass.exe) from making outbound connections over port 80. Why is LSASS ...
1
vote
1answer
1k views

FTP virtual hosting proxy

I'm setting up OpenVZ to divide several of my sites from each other. I have one external ip address which I use to serve my sites. I'm using nginx to proxy http requests to nginx in each container ...
1
vote
0answers
566 views

VPN Error 619: Behind Cisco Router WRT310N

I've researched a lot on all the forums and this error is too generic for any of the proposed solutions to work. I'll try to give as much detail and tried solutions. I'm running a CentOS PPTP server ...
1
vote
1answer
1k views

Apache: disable directory listings

I'm using Apache 2.2. In the var/www directory I've created a .htaccess file that contains this: Options -indexes When I reach my site and want to see the directories and files like this: ...
1
vote
1answer
127 views

IIS and PHP restrict IO permissions

I have php installed trough a fastCGI module. Is there a way to restrict the module (php.exe) read / write permissions to only the directory (+ subdirs) of the IIS site that is calling it? I need ...
1
vote
1answer
271 views

Need advice in setting up server. fastCGI, suExec, speed, security, etc

I am running my own dedicated server with centOS 5 and WHM/cPanel. I would like to configure my server to meet my needs but I need a little help. It will only be my own websites being run on this ...
1
vote
1answer
133 views

How do I apply a security baseline to 2008 R2?

I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
1
vote
1answer
299 views

How to forbid postfix to send to external domains

I have a local postfix server, and i want it to only relay emails to the only local domain (localdomain.be): myhostname = localdomain.be mydomain = localdomain.be alias_maps = hash:/etc/aliases ...
1
vote
3answers
181 views

Securing HTTP traffic between data-logger and website, options

Got some IP data-loggers (that measure temp., humidity, light-level) sitting inside bunch of warehouses / stores with each warehouse / store being a different customer from my standpoint. These ...
1
vote
1answer
110 views

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
999 views

File permissions on web server

I have just read this useful article on files permissions, and I am about to implement a as-strict-as-possible file permissions policy on our webserver. Our situation: we have a web server accessed ...
1
vote
1answer
118 views

Where I can get the SQL-Server 2005 C2 Audit Event List

I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
1
vote
1answer
48 views

Securing access to a website on IIS

I've got a website running on IIS7.5. I want to ask for credentials (fixed user/password) on access to the website. I don't need to do anything with those credentials - just to make sure the user ...