Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
2answers
69 views

How can i make my all webistes only accessible by browsers and not auto scripts

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101 Is there any way that my all websites are only avaiable to genuine browsers and not ...
0
votes
2answers
73 views

How Do I Defend WebEx Security?

My company is an ISV selling software to banks and credit unions. We provide customer support via WebEx but every once in a while we'll have a customer that won't open their firewall to the WebEx ...
0
votes
2answers
546 views

Does open_basedir works recursive?

Does open_basedir works recursive? For example if I write in php.ini something like: open_basedir=/client3/web3/web Does it include all directories in /client3/web3/web (/client3/web3/web/1, ...
0
votes
2answers
46 views

Should my database server offer SSL?

I was installing a renewed SSL cert on my web servers and noticed that my DB server doesn't have one set up, which got me wondering: Should my database server only accept connections via SSL? The ...
0
votes
2answers
449 views

Can I use SSL termination for sensitive data, and if not what is the point of even using SSL with termination?

I have read, namely on Rackspace, that one should not use SSL termination for sensitive information (search the page for "SSL Termination should not be used"). Firstly, why would that be the case. ...
0
votes
3answers
85 views

centos private key and root login

I wanted to know if it's good practice / secure to allow login as root with ppk (private key) file. (no password). This server is only for me and no one else is working on it. Thanks, Danny
0
votes
2answers
114 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
0
votes
1answer
320 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
0
votes
3answers
6k views

Windows: disable remote access of local drive, even by domain admin

We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In ...
0
votes
2answers
12k views

ASDM unable to launch device manager from

I can't access to my Cisco asa 5505 from my Windows 7 64bit. The problem is that i can connect on it using the ASDM from another PC (WinXP 32bit), and i can connect using my win7 64bit to another ...
0
votes
1answer
122 views

Microsoft Security Compliance Manager terms

Recently i have installed Microsoft Security Compliance Manager. But i am confused with some terms. As per the print-screen ( which is mark in Red-Colour Round ) 1st - the 'Default' here means the ...
0
votes
3answers
489 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
1answer
146 views

ssyn.c and slow.c used on my VPS [duplicate]

I have noticed some changes on VPS Debian Squeeze and looked with history to see what commands were run. Then I found some which I'm 100% sure I didn't run because I don't know what are they. Somebody ...
0
votes
3answers
780 views

How to set the ulimit (fd) when you fork a process?

Normally /etc/security/limits.h only work when you login into a shell. How about when you fork a process in Linux, where is the value of Max open files of /proc/PID/limits is controlled by?
0
votes
2answers
93 views

Can't get rid of Apache server-status

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server. I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP ...
0
votes
2answers
364 views

Script to check server for WordPress installs and report version information [closed]

I'm looking for a script that can be run on a linux server that will find all WordPress installs and report their versions, or report if a version is out of date. I've googled for something and it ...
0
votes
1answer
401 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
1answer
60 views

How to find on the Windows 7 who and when use(d) a certain share?

We have a workstation using Win7 on a LAN with a domain. On that workstation we set up some network shares. Can we find who used (user name and/or computer name) and when the shares? Note that we ...
0
votes
2answers
160 views

Why should I keep the root user if I'm not supposed to use it?

I'm on a fresh VPS with Ubuntu Server 12.04. I wanted to ask you the good practices to apply to enhance security over a stock Ubuntu-server. This is what I did up to now: I added Google Authenticator ...
0
votes
2answers
3k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
0
votes
1answer
295 views

Can /etc/hosts.deny/allow be overridden?

I have security measures put in place to keep unwanted users out of my server. I've changed the SSH port, disabled root login, have a software firewall to block portscans, and have entries in ...
0
votes
1answer
2k views

Iptables: Block all countries except my own for specific port

I would like to block all IPs (CIDR 0.0.0.0/0) except for German IPs for the SSH, FTP and SMTP ports. So, the default policy for those ports should be "DROP". I have a list of all German IP ...
0
votes
1answer
2k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
0
votes
1answer
263 views

How to restrict user to run and use only one program running on my server?

I have a cloud server running windows-server-2008 and i want my customer to log in to the server using remote desktop and the customer can run my own program only , he should not be able to run any ...
0
votes
3answers
849 views

How can I tell which ColdFusion hotfixes are installed?

I saw the new secruity hotfix for ColdFusion on adobe.com, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765. How can I tell which ColdFusion hotfixes ...
0
votes
4answers
304 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
0
votes
1answer
59 views

How to protect file if physicall access to the server is possible? W2008R2

Is there a way to protect exe if server is on colocation hence the physical access is possible for the colo people? I have W2008R2 and was thinking of using BitLocker but it seems encrypting the whole ...
0
votes
3answers
2k views

Mysterious Network Client

When I look at my data network with Windows Explorer My Network Places I see all of my network clients and printers. However, I am seeing an unknown client called tsclient. When I click on it I ...
0
votes
1answer
181 views

My website keeps being hit by iPhones…am I being DDOSed?

66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
0
votes
2answers
135 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
0
votes
2answers
128 views

Oracle Security Update Patch July 2011 - How to know if i am affected?

Oracle Security Update Patch July 2011 I am using JDK 1.4.2_08, 1.4.2_19, 1.4.2_22, and Oracle DB 9.2.0.8. Can any experts tell me how to tell if i am affected, i.e. after installing the patch ...
0
votes
2answers
174 views

Hide SQL Server 2008 from attackers

I am using an MS-SQL Server 2008 instance as back-end DB server for a project. I did some security tests on the machine hosting my project and SQL Server and got the following report on SQL Server: ...
0
votes
4answers
404 views

Safety concerns on allowing connections to MySQL with no password on localhost?

In the case of a Linux system, is there any security concern to let MySQL users with standard privileges (that is, not the root users) connect to the database with no password from localhost? I think ...
0
votes
3answers
1k views

Security: How to check if our server is hacked?

Our server are hosting a website, but we find our database are added some tables, so we suspect if the server was hacked ? How can I confirm this and solve it ?
0
votes
2answers
291 views

Windows Server 2003/2008: Please recommend security software and practices [duplicate]

Possible Duplicate: What do I have to configure on my server to increase security from default? Hello, I am a "returning" MS Windows Server admin, I haven't been in in MS server business ...
0
votes
1answer
468 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
0
votes
3answers
66 views

One of my VPSes is very sluggish usually past midnight ( 1-5AMish )

I've noticed that on one of my VPSes ( debian 5 lenny ) ( not my linode ones but a host I used prior to linode ), the filesystem is very, very sluggish past midnight. If I try to use the command ...
0
votes
3answers
478 views

Database security guidelines and tips

I have been recently hired by an event-planning company to create a web application that will allow online payment for specific events and keep a list of registrants. My employers are asking for a ...
0
votes
6answers
118 views

Which are services or programs do I need to watch from linux security point of view

I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password. i just saw ...
0
votes
3answers
3k views

Win2003 Folder sharing : Group permissions not working while user permissions work

I'm very new to windows server. I'm a software engineer but since we don't have a real sysadmin I'm supposed to figure out everything that is slightly computer related (you know how it is...). I need ...
0
votes
1answer
2k views

What is host/computer SID in Windows AD? and what is needed to identify the elements of network with it? [closed]

SID as http://en.wikipedia.org/wiki/Security_Identifier 1) Help me to clarify the concept of computer SID on hypothetical situation: suppose, I want to secure a network cable (for ex., from a ...
0
votes
2answers
605 views

Potentially vulnerable to CVE-2009-3555

When checking my (secure) site https://www.just-great-software.com/ with Firefox 3.6.6 the Error Console shows: www.just-great-software.com : potentially vulnerable to CVE-2009-3555 Is this ...
0
votes
2answers
2k views

Only allow ssh connections to a specific domain

I have a server setup with several domains and subdomains. I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured. Connecting ...
0
votes
2answers
359 views

Ubuntu server security; Is this enough?

I have a classifieds website, which uses php5 and mysql, and also java (solr). I am new to linux and VPS... I have installed SSH, and I have installed IPtables, and also I have PuTTY which I use as ...
0
votes
3answers
464 views

Is it good to defense for DOS attacks with 2 request/sec?

Lots of example told me to defense with 5 or 4 request per second. Because usually a visitor clicking about in 1 or 2 links in one second, I think defense with 2 request per second is just fine. But ...
0
votes
2answers
269 views

I found a Ukranian spammer and have the exact query, IP and access time. What next?

Before I turned on comment moderation, these guys would leave comments meant to steal my Google juice (by getting an inbound link). I can still see them visit... the question is what should I do ...
0
votes
3answers
907 views

Is AuthType Basic secure when used over SSL?

I am authenticating clients of an apache2 server using AuthType Basic over SSL secured connections. I imagine these are secure, as the usernames and passwords are encrypted before they are sent to ...
0
votes
2answers
99 views

Accesibility of modified EC2 instances

This page on EC2 documentation site describes how to modify and store an EC2 instance. What it does not specify is whether the resulting instance is publicly available or not. How, and where do you ...
0
votes
2answers
3k views

How do I hide the version of Linux from a port scan?

How do I hide version of Linux I am running when I scan server ports? When I nmap'ed (nmap -A -T4 192.168.40.12) the server's ip from the outside, this is the result: Starting Nmap 4.62 ( ...
0
votes
3answers
880 views

Windows Server 2008 Firewall: Do inbound rules override outbound rules?

I have in inbound rule to allow all communication with MyApp.exe I have an outbound rule to block all traffic to 192.168.0.88 Can MyApp.exe communicate with 192.168.0.88 - I don't understand which ...