Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
172 views

Securing a “one purpose” server

I don't know much about securing a server. I've heard of iptables, but I've never used it (maybe that's not what I need?). So right now my goal is to have a main webserver, and a separate database ...
0
votes
3answers
123 views

Disallowing user right to edit various settings

I'm going to be installing windows 2008 server R2 and running desktop applications (MS Office, Autocad) for novice users (3). I want to disallow following things ability to change outlook, firefox ...
0
votes
1answer
672 views

hosts.deny not working

Currently I am watching the live auth.log and someone is continuously trying the brute force attack for 10 hours. Its my local server so no need to worry but I want to test. I have installed ...
0
votes
2answers
732 views

why should I chmod 511 /usr/local/apache/bin/httpd?

I'm using Ubuntu 10.04 and installed apache2 HTTP server. On the security page @ apache.org documentation they recommend to change the permissions on the file /usr/local/apache/bin/httpd to 511, but I ...
0
votes
2answers
226 views

Vista cmd.exe fails to run if users and/or auditors group not present

In the current environment there exists a policy where files within %system32% are only allowed to be owned by System and Administrators. An issue has arisen where after converting these ...
0
votes
1answer
205 views

How can I limit a site's access to LAN users only in IIS 5.1?

I want to limit a site's access to connections from the LAN only. How can I do this? When I go to the Directory Security tab of the website, it looks like I need to use IP address and domain name ...
0
votes
3answers
1k views

Firewalls that block RDP over port 443

I need people to reach my servers over SSH and RDP. Both ports are blocked outbound at many companies, especially the large ones. However, I also suspect that in 90% of companies there is nothing to ...
0
votes
3answers
549 views

How to secure LDAP

Not sure if this belongs more on serverfault or not... BACKGROUND: I am using openldap, and pam/nss/ldap for authentiction on my server (webmail, etc). My files, which work fine: ...
0
votes
1answer
133 views

Is it illegal to modify a cookie to become a chat admin? [closed]

I doubt it is, but I found a site where you can modify a cookie to become admin, is this legally okay? Thanks
0
votes
2answers
355 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
0
votes
4answers
152 views

Is there a way to secure my server and give 10 untrusted persion my ssh access

Okay here is the situation, I bought a hosting server that gives me version control and ssh access. I'm working on a big project that needs team work so I need at least 10 person around the globe to ...
0
votes
3answers
229 views

Does a 1 year break in career hinders the chance of new job IT job

I have 3 years experience as web developer as small Linux /window server networking. I had to go to overseas (home country) for some reason for about 1 year. I was thinking of doing some ...
0
votes
1answer
88 views

Symantec End Point Protection

We are planning a mass rollout of Symantec Endpoint protection. We currently have Symantec antivirus version 10 running on the systems. From testing the roll out works fine but it does not take affect ...
0
votes
3answers
344 views

secure data transport between web server and database server

I asked this question in stackoverflow and it was suggested to try here so here goes... I'm planning on provisioning a web server and database server in a server farm environment. They will be in the ...
0
votes
1answer
132 views

What type of security problems are mitigated by this .NET architecture?

Given the following physical layout for a .NET web application: DB (sql server, windows) - No public route (no table access, only stored procs) Web Service DAL (iis, windows) - No public route (can ...
0
votes
1answer
103 views

Should windows services be created with custom users, or should I use one of LocalSystem/LocalService/NetworkService

I'm asking the question in general for the average custom developed NT service or unix OSS daemon ported to windows with SCM support. However, at the moment my immediate concern is for mongodb. From ...
0
votes
1answer
51 views

What is the difference between setting permissions with these two methods?

Method 1: Via apache2.conf (or httpd.conf): <Directory "/var/www/html"> Options Indexes FollowSymLinks -MultiViews AllowOverrides None Order allow,deny Allow from all </Directory> ...
0
votes
4answers
1k views

Thoughts on MPM-ITK?

I have several sites on my server set up as virtual hosts. What are your thoughts on MPM-ITK? Are the tradeoffs and the potential root exploit vulnerability worth the security of internal system ...
0
votes
3answers
171 views

Apache Request IP Based Security

I run an Apache server on my home system that I've made available over the internet as I'm not always at my home system. Naturally I don't want all my home server files public, so until now I've ...
0
votes
2answers
726 views

win2008 r2 IIS7.5 - setting up a custom user for an application pool, and trust issues

Scenario: blank win2008 r2 install the goal was to have a couple of sites running with isolated pool and dedicated users A new folder for a new website - c:\web\siteA\wwwroot, with the app (asp.net) ...
0
votes
3answers
64 views

Does apache/PHP has overflow problem if the developer doesn't tweak it at all?

Is apache/PHP self secured so that developers don't need to care about it?
0
votes
3answers
610 views

How to avoid apache2 revealing hidden directory and/or file structure

When someone fetches a denied URL that exists, he gets: Forbidden You don't have permission to access /admin/admin.php on this server. Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch ...
0
votes
1answer
103 views

Junos custom-attack signature pattern syntax

I am stuck at a point with the configuration of a custom-attack signature in Junos. According to the Junos Custom Attack Definition documentation page, I can set up a custom attack based upon a ...
0
votes
3answers
1k views

Deny directory browsing in a Proftpd / Ubuntu Installation

I used this guide to set up a Proftpd installation an Ubuntu 8.04 server... Works well, but the generic user ( userftp ) can run ls and is able to change to any Directory and browse freely on the ...
0
votes
4answers
149 views

Collect private information online and store on intranet?

I have to collect private info and store it. What I'd like to do is collect the info and have it get stored on an intranet server. The data collected is for user in the United States, and would be ...
0
votes
1answer
951 views

copSHH how to restrict user from going back from there main root

I have installed SFTP on a windows servers using copSSH and all is good and it works well however you can go back from the main root. For example when i use C:\copSSH\home{username} as that user i ...
0
votes
6answers
529 views

How to make sure my apache config is secure?

How can i make sure that my apache config is secure? i mean against attacks and so on...
0
votes
2answers
624 views

Securing access through specific ports on public IP address

We have public IP address hosted on FreeBSD router. We have also a lot of service running inside our LAN network, some of our services need to be accessible outside our home network trough public IP ...
0
votes
2answers
112 views

If I'm using Workgroup based Windows networking, do I need a login for all users on all PCs if I have a guest account with Admin Priv?

I administer our small office network. If I want PC's 1-5 (PC1, PC2, etc.) to all have access to our Server (using Windows Workgroup networking (not Domain networking) that I have to have the logon ...
0
votes
1answer
2k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
0
votes
2answers
198 views

SVN Server Security Scanning Tool

We plan to migrate our SVN server from LAN to Internet. We need to convince our management, that our setup is secure enough. Is there any SVN server security scanning tool, to check on the security ...
0
votes
3answers
141 views

MySQL security loophole with server,database and user name exposed

I have the following situation: Ona score of weakly secured machines a business critical application is installed. The application uses a MySQL 4 database where all the business critical data are ...
0
votes
2answers
187 views

How paranoid should I be with external IIS web servers accessing unauthenticated internal wcf services?

Environment: web and app servers are Windows Server 2003 Enterprise / IIS 6 Web Server is behind a firewall - ports 80 and 443 are open to the world. Between the WebServer and the AppServer traffic ...
0
votes
2answers
539 views

Malicious Script on LAMP Server

We have recently noticed that a malicious script is inserting itself in a number of PHP and HTML files on our domain questoons.com and the various add-on domains hosted on this account. The script ...
0
votes
3answers
83 views

linux permission, when things go wrong, mishaps/ gotcha's for newbies

Are there any 'gotcha' permission issues that newbie sys admins might not take into consideration. Basically what I am looking for, is experienced linux admins to share some permission 'mishaps' that ...
0
votes
2answers
672 views

ini_set disabled functions

I'm working in a hosting company and I'm pretty new. One of the company's policies is disabling ini_set php function for security reasons. There are lots of clients that have shared hosting asking us ...
0
votes
3answers
1k views

Windows server: restrict user by ip?

As an extra layer of security I use "Integrated Windows authentication" in IIS to protecte our admin tool. To setup new user accounts I got to "Computer Management" -> "Local User and Groups" -> ...
0
votes
4answers
74 views

storing private data on a public site (but unlinked) OK?

I've occasionally had occasion when I needed to share some as-yet "private" data (i.e. unedited drafts of audio lectures) so it can be reviewed by authorized people before being made public. ...
0
votes
2answers
1k views

LAMP setup + FTP - problem with user privileges

I'm sorry for uber noobish question, I'm new to linux and trying to learn and practice secure LAMP administration for upcoming little project of mine. I've installed vsftpd but can't setup ...
0
votes
1answer
129 views

What strength should I use for my ISC BIND transfer key?

Currently I'm using 128, is this secure enough? dnssec-keygen -a hmac-md5 -b 128 -n host foobar.com Also I'm not sure if "host" is the correct value for -n arg. I believe that the last argument ...
0
votes
2answers
1k views

What tcp/ip ports should not be open on a windows webserver 2008?

I am wondering what ports can / should be closed down on a windows webserver 2008. Port 80 of course not, and 3389 not, too, because I need a remote desktop connection. netstat told me the server is ...
0
votes
3answers
588 views

Can access all users mailbox's in Outlook Web Access

Once i've logged into my work OWA, i've found i can access any other staff members mailbox simply by changing my username to theirs in the web address box! How do i turn off this scary 'feature'??? ...
0
votes
1answer
180 views

Barracuda Quarantine - Externally Accessible?

I manage several Barracuda Spam filters. When an e-mail is sent through the barracuda to somebody and it seems to have spammy charactertistics but is not clearly spam, the barracuda will place it in ...
0
votes
2answers
1k views

unhide brute reveals hidden process

i ran chkroot, rkhunter, and nothing was revealed. i ran unhide brute, and it reveals a hidden PID so i ps aux | grep ^PID but nothing shows up. i run unhide brute again, and theres nothing. i ...
0
votes
1answer
289 views

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a “turn-key” linux security distribution)?

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a "turn-key" linux security distribution)? Can anyone help me?
0
votes
2answers
94 views

Locking netfilter in linux

A few years ago when I was reading something about linux server security (maybe it was a book) I encountered a command or an application that prevented the netfilter (iptables) rules from being ...
0
votes
1answer
139 views

How can I secure CISCO Radius?

Cisco offers a WLAN system that allows admins to restrict WiFi access to authenticated users. However, the following statement bothers me: Use the secure https://1.1.1.1/login.html. .... ...
0
votes
4answers
941 views

Share permissions when accessed locally via UNC

I have a w2k3 server (terminal server) and a domain user. If the user accesses "\\TS\Folder" from another computer, that user can read\write without any problem. If I login to "TS" as the user, they ...
0
votes
1answer
809 views

Wireless guest access with HP ProCurve 420

We have a HP ProCurve 420 wireless access point hooked up to our LAN, which then connects to the internet though a gateway router. Is it possible to set up a guest SSID, which can access the internet ...
0
votes
1answer
789 views

Can't reset user account password in AD due to Policy's restriction

I am deep *** right now and I need your precious help! Yesterday, I change a user account password in AD (Srv2003). The password was 4 letters, no caps, no numbers. It was set to never expires and ...