Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
328 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN (http/...
1
vote
2answers
189 views

prevent files modification from users: is this method safe?

I was wondering today if there was a way to enforce a non root user to have a specific authorized_keys file (among other sensible files). I came up with this solution. Disable StrictModes in ...
1
vote
1answer
53 views

Exchange 2007: Which permissions required to change folder permissions for all mailboxes?

Which permission(s) are required to modify permissions on folders in all mailboxes in Exchange 2007? I'm looking a least-privilege setup. I've seen hints pointing towards that the role Organizational ...
1
vote
0answers
74 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
1
vote
3answers
862 views

Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user

What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications. The server ...
1
vote
1answer
95 views

How to securely control access to a backend key server?

I need to securely encrypt data in my database so that if the database is dumped, hackers are unable to decrypt the data. I'm planning on creating a simple key server on a different machine, and ...
1
vote
0answers
547 views

Ubuntu 12.04 Server snort 2.9.2.3 not logging NMAP Scans after first VTR Rules update

I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file. Out of the box installation snort worked. ...
1
vote
1answer
1k views

Protecting Apache and Nginx against slow read/write and similar attacks?

There are many articles explaining many ways to attack webservers (generic or specific) and even listing general rules for mitigating such attacks, e.g.: Do not accept connections with abnormally ...
1
vote
0answers
137 views

How to secure tomcat manager for multiple instances

I have multiple instances of Tomcat setup using the CATALINA_BASE method. I need to enable the tomcat manager application for each of them, and to secure them all separately based on groups of users. ...
1
vote
0answers
1k views

Only allow domain logins using TeamViewer

TLDR How do I setup TeamViewer to only allow logins that authenticate through Windows (domain controller), while disallowing any other login method? I recently started a system administrator job ...
1
vote
0answers
1k views

How to client authentication in SSL [closed]

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
1
vote
1answer
373 views

AWS EC2 security group source

I'm currently trying to configure a security group and allow MS SQL connections from my other instance. I want to be able to specify the security group's name as the source. But the connection is not ...
1
vote
0answers
75 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
1
vote
1answer
60 views

Enable usr account external hardisk? [closed]

I have a Windows 2008 installation on an external harddisk, it turns out that my account is disabled on this external harddisk. Can I enable this account again? For example by booting into my default ...
1
vote
0answers
34 views

Is it possible to secure MySQL admin password with digital certificate on windows [closed]

I'd like to know if it is possible: I searched google but couldn't find.
1
vote
0answers
163 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
149 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are missing....
1
vote
0answers
14 views

How to use SCW to produce XML of current settings

The Security Configuration Wizard allows you to create an xml of various recommended security settings for the current server, based on role. Is there any way of producing this xml based on the ...
1
vote
0answers
476 views

All local users set to “User must change password at next logon”

We had a weird problem occur on a production Windows 2003 R2 SP2 server which has about 50 local (the server is in a 2000 AD domain, but these accounts are local to the server) accounts defined. "...
1
vote
1answer
589 views

Mysterious login attempts to windows server

I have a Windows 2008R2 server that is reporting failed login attempts from a number of workstations on our network. Some event log details: Event ID 4625, Status: 0xc000006d, Sub Status: 0xc0000064 ...
1
vote
1answer
498 views

Security issues/risks connecting from IIS7.5 to SQL Server 2008+ using Machine Account (DOMAIN\MACHINENAME$)

I'm working with a group of engineers doing .NET 4 / MVC 3 development, using Windows 7 Enterprise and IIS 7.5 locally, and connecting to MSSQL 2008+ dev/testing databases. The databases are remote ...
1
vote
0answers
54 views

Securing internal sites on Windows Server

Background: I have limited server admin / networking knowledge, my background is non-network programming. What are some options for securing and hiding internal sites? I have a Windows VPS running ...
1
vote
2answers
527 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
1
vote
1answer
603 views

How can I edit web.config to have a different MIME type for a single XML file not others?

I am trying to set the MIME type for Flash's cross domain file in web.config. Since this file has an extension of .XML the following command will edit the MIME type of all XML documents in my site (...
1
vote
1answer
861 views

SQL injection security vulnerability in Plesk control pannel [closed]

I have plesk 10.3.1 and I received following email from the Plesk admin Parallels, the manufacturer and distributor of the Plesk Control Panel, has identified a SQL injection security ...
1
vote
2answers
191 views

FTP SITE CHMOD Error

When trying to edit file/folder permissions via FTP I am getting the error: 505 Security server forbids SITE commands. Contact admin. I am currently using VSFTPD with the config value chmod_enable=...
1
vote
1answer
99 views

Securing php webserver from exploits? [closed]

We are running a PHP application on a linux apache webserver. How can we secure the server, so if someone finds a hole in our application, they can only get access to the application (Files inside ...
1
vote
1answer
454 views

How to secure a Windows SBS Server against fraudulant login attempts?

I administer a Windows Small Business Server 2003 R2 server for a small business. The only ports that this server has exposed to the internet are SSL and the RDP tunnelling port used by the SBS remote ...
1
vote
2answers
463 views

Finding source of directory traversal attack originating from my server

Two weeks ago, I was notified by my VPS provider that my server (CentOS 5.5, yum is up to date) had originated "NULL byte/Directory Traversal" attacks agains some servers at DreamHost. I spent a few ...
1
vote
1answer
423 views

openVAS scan against new instance fails test (possible false positive) How to debug plug-in

I have openVAS installed from the atomic corp YUM repo, and it all seems to be functioning wonderfully, however I am seeing a single "Security Hole" which is that OpenVAS detects that "arora" is ...
1
vote
2answers
473 views

OpenSSH 5.9p1 on Ubuntu 11.10

I want to build a deb package with the latest version of openssh from source. Then I want to install it on my machine. I am running: Linux Ubuntu-1110-oneiric-64-minimal 3.0.0-12-server #20-Ubuntu ...
1
vote
0answers
264 views

ejabberd changing ports?

I changed the ports in the listen section (just added a 1 in front of them) in the /etc/ejabberd/ejabberd.cfg, but after a /etc/init.d/ejabberd restart The server still listens on the original ...
1
vote
0answers
1k views

Why is my access being denied when I am an adminstrator on my Windows Server 2003 Installation?

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to ...
1
vote
1answer
122 views

Do Mac OS X servers have a security mechanism that blocks a user if they log in from two different IPs?

A trusted friend and I had ssh'ed into a Mac OS X Web Server (either 10.6.8 Snow Leopard or 10.7 Lion) from two different locations. Then my password stopped working when trying to log in. I can ...
1
vote
2answers
46 views

Security Policy based on Subnet [closed]

We are implementing a security policy and Firewall access rules based on the subnet using static dhcp bindings. There is one scenario where some one can manually assign ip address from a subnet with ...
1
vote
2answers
170 views

Securing shared Apache2 + PHP

We want to setup a shared webserver running Apache2 and PHP5. Our need is to host some PHP apps like Wordpress, Zend framework applications... Some of the sites may be controlled by external ...
1
vote
0answers
467 views

Can ApacheDS LDAP change root user name?

ApacheDS 1.5 has the following account by default. Bind dn or user: uid=admin,ou=system Bind password: secret i would like to change it to the following to avoid making changes in my code Bind dn ...
1
vote
1answer
70 views

multi-purpose server - security

running ubuntu server 10.04. This box is both a web (apache2) and vpn (openvpn) server. Here is how the network is currently configured. router 192.168.1.1 | | LAN | | ubuntu server 192.168.1.2 NAS ...
1
vote
3answers
91 views

How to give web users access to server securely?

I'm building an application that will enable users to write code from the browser. Once the code is written I save the contents to my webserver in a user-specific folder. I'd also like to add a ...
1
vote
0answers
620 views

Where can I find information about inbuilt registry keys for Windows Server 2008 R2?

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances. ...
1
vote
1answer
138 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
1
vote
0answers
41 views

Access error with administrator accounts

Problem: I have access denied on system files and folders, using accounts that are in the local\administrators group. system is W7 Ultimate 64 bit that is joined to a domain. the users that login to ...
1
vote
1answer
3k views

How to set a network interface as 'trusted' on Centos 6 (with multiple interfaces)

I have a box with two wired network interfaces. On Centos 5 I could run the setup command in console and set which interface is trusted and which not in the firewall configuration (e.g. eth1 trusted, ...
1
vote
2answers
264 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
1
vote
1answer
249 views

Security risk of JIRA standalone installation running JRE version 1.6.0_26 vs 1.6.0_29 (latest)

Atlassian recently introduced a standalone installer that installs JIRA, along with its own JRE. Unfortunately the JRE Atlassian bundles with this installer is 1.6.0_26, whereas the current version of ...
1
vote
1answer
106 views

SelfSSL in IIS 6.0

I am using IIS 6.0 and selfSSL to create a self signed certificate, but it only lasts one week. How do I prolong the time of this?
1
vote
1answer
55 views

Application hosted in IIS7 does not provide credentials to Web Service on another server

At the moment we identified that the error is due to security issues. The old server ServerA managed to communicate with WebServerC without problems, now the new server ServerB can connect but the ...
1
vote
1answer
558 views

Windows EC2 instances in same security group cannot communicate

I have 2 instances (windows machine) in the same security group. I create a network drive on instance machine(A) for share a folder to other instance machine(B). But when I map a network path on ...
1
vote
2answers
520 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
1
vote
0answers
107 views

subdomain security IIS doesn't have authentication

I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are ...