Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
3answers
181 views

Securing HTTP traffic between data-logger and website, options

Got some IP data-loggers (that measure temp., humidity, light-level) sitting inside bunch of warehouses / stores with each warehouse / store being a different customer from my standpoint. These ...
1
vote
1answer
110 views

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
1k views

File permissions on web server

I have just read this useful article on files permissions, and I am about to implement a as-strict-as-possible file permissions policy on our webserver. Our situation: we have a web server accessed ...
1
vote
1answer
119 views

Where I can get the SQL-Server 2005 C2 Audit Event List

I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
1
vote
1answer
48 views

Securing access to a website on IIS

I've got a website running on IIS7.5. I want to ask for credentials (fixed user/password) on access to the website. I don't need to do anything with those credentials - just to make sure the user ...
1
vote
3answers
124 views

Virtual users on Solaris

Is it possible to recreate the functionality of pam_userdb.so to make an application authenticate virtual users (valid for one specific service only) on Solaris? Situation is: higher-ups have ...
1
vote
2answers
113 views

Protecting PHP packages on server

I am a php developer and have recently decided to make one of my Magento extensions commercial. I have downloaded and configured MageParts CEM Server and that is all working perfectly in regard to ...
1
vote
1answer
444 views

Exchange 2003 default permissions for ANONYMOUS LOGON and Everyone

ANONYMOUS LOGON and Everyone have the following top level permissions in our Exchange 2003 Server: Read Execute Read permissions List contents Read properties List objects Create public folder ...
1
vote
1answer
383 views

Apache and fastcgi - How to secure an Apache server with fastcgi enabled?

I am running a headless server on Ubuntu 10.x. I am running Apache 2.2. I am writing a fastcgi application for deployment on the server. I remember reading a while back (I could be wrong) that ...
1
vote
1answer
247 views

Apache2 Virtual Host Restrict to Localhost

So here's the deal. I have multiple virtual host. Each virtual is a separate domain. Each domain is for separate applications. Lets say I have virtual hosts for: http://.abc.com http://.def.com ...
1
vote
1answer
256 views

ESX Firewall Command Troubles

I am working on creating some firewall rules to stop some of the SSH brute-force attacks that we have seen recently on our ESX server hosts. I have tried the following rules from the CLI to first ...
1
vote
1answer
159 views

Searching for a lfd tutorial [closed]

I just got me a new centos server, and fould out it's running lfd. It looks nice, but I need to configure it. It keeps warning me about mysql running, or myself logging in via ssh, and so on. I ...
1
vote
1answer
178 views

Locking down a server for shared internet hosting

Basically I control several servers and I only host either static websites or scripts which I have designed, so I trust them up to a point. However, I have a few customers who want to start using ...
1
vote
2answers
314 views

Why would a php file return 404 while in the bin directory on IIS7?

I'm running IIS7 and I have fastCGI installed and php code works just fine normally. Today I added a php file that contained only code an no html to the bin directory. And when I try to access it via ...
1
vote
1answer
702 views

exploit.so dmesg errors

A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
1
vote
1answer
2k views

IIS 6.0 PCI Compliance - “Information Disclosure Vulnerability”

We're trying to pass PCI compliance on a few of our websites. After an outside scan, we still have this vulnerability: Synopsis : The remote web server is affected by an information disclosure ...
1
vote
1answer
598 views

PGP encryption key with split-knowledge and dual control

An auditor recommends: We recommend that PGP environment be re-keyed using the industry required (ISO x9.8 and x9.24) standards of “split-knowledge and dual control” Is there something that we're ...
1
vote
1answer
1k views

What is the default management state on Netscreen firewall interfaces?

in other words, is the command: unset interface ethernet1/1 ip manageable redundant? I was thinking that for security purposes, it would probably make sense for Netscreens to only enable management ...
1
vote
1answer
882 views

How can I monitor user access to a shared folder on Windows SBS 2008

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
1
vote
1answer
724 views

windows 2003 server security audit -logging computer IP

We have a network with 1 primary domain controller and 3 additional domain controllers. We're trying to identify a user who attempted to use someone else's credentials to access some resources in our ...
1
vote
0answers
61 views

how can I prevent system changes w/o Group Policy Object (GPO)?

I'm getting started with running a terminal server on a virtual private hosted site. The host operator disallows many security systems including access to the group policy editor (GPO). The problem ...
1
vote
2answers
5k views

How to use max_post_size and upload_max_filesize in an Apache <Location> directive?

My users want to upload large files (50-100MB) in the CMS backend of a PHP web application. I could adjust the upload_max_filesize and post_max_size settings for PHP globally in this virtual host, but ...
1
vote
1answer
104 views

NAP solutions for windows network

I am looking for a NAP solution for a network. Either an Appliance or software to run on a windows server. I have played with windows server 2008 r2 NAP but i dont think this is going to be a good ...
1
vote
2answers
828 views

What risks are associated with allowing anonymous access from the LAN to the internet?

I have a network of around 60 users who have access to the internet through ISA Server 2004 and a hardware firewall. As a matter of course I've always blocked anonymous requests to the outside world. ...
1
vote
1answer
164 views

closing ssh ControlPath

I found the instructions on kerneltrap's mail archive: "scp batch mode?" to be insightful an useful, however when I issue the command to close the connection # Bring the connection down. ssh -S ...
1
vote
1answer
129 views

Security Restrictions Downloading From the Internet

For some reason since we rolled out IE7 to the estate users are unable to download from the Internet, they get an error message "the operation could not be completed due to restrictions on the ...
1
vote
0answers
30 views

How to track when full access rights were issued in Exchange 2007?

Does anyone know if there is a way to see when a user had been issued full mailbox rights in Exchange 2007. Or is there a way to check which commands were issued when and by whom? Thanks ashln
1
vote
0answers
211 views

Window 2003 Server - Logon Failure error message in Event Viewer

I received a lot of event logged in the event viewer with this message. I notice it is always the same user id which encounters this error. The user id is use by an application to access the ...
1
vote
1answer
2k views

XAMPP vs WAMP security and other on Windows XP

Not long ago I found WAMP and thought it was a God send because it had all the things I wanted/needed (Apache, PHP, MySQL, and phpMyAdmin) all built into one installer. One thing about WAMP has been ...
1
vote
2answers
82 views

Used SQL Svr 2008 Config Manager to Set Service Account to Local System: What Did It Change?

Direct shot to foot moment... While setting-up individual non-admin accts for MSSQLSERVER services, I temporarily set Server service login to Local System account. I remembered later that: SQL ...
1
vote
1answer
77 views

Files deleted. What could have happened?

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So ...
1
vote
4answers
393 views

PHP scripts owned by www-data

I use to have owned php scripts on a dedicated server by user "webroot". It would be easier for coding and administration if the scripts were owned by the apache2 user, "www-data" on my system. Also ...
1
vote
0answers
720 views

least privilege account for WinRM remote calls on Windows 2008 Server

ServerFault Windows experts: please consider the following use case: I have 2 Windows 2008 Server SP2 boxes let’s call them – SOURCE, CLIENT. On SOURCE: I create a new user called 'normal'. Just a ...
1
vote
0answers
625 views

Windows Server 2008 Web Edition can't change permissions

I'm used to using Windows Server 2003 but decided to get a Vista Web Edition for IIS7 and to run our MVC applications on. I have installed copSSH that I use for SFTP, and when I upload my files I am ...
1
vote
1answer
210 views

Oracle Ordcom and Wallet Coexistence Problem

We use Oracle's ORDCOM infrastructure on our 11.1.0.7 database to interact with a COM object. The COM object doesn't do anything with the database. This process has been working fine for several ...
1
vote
1answer
329 views

Tutorial on using Advanced Sharing (instead of Simple Sharing) on Windows XP and 7

We've always used Simple File Sharing. But I'm having some network difficulties with a new Windows 7 PC and I'm thinking we should be using Advanced Sharing. But as I got into it I realized it's far ...
1
vote
0answers
794 views

Securing portmap with multiple interfaces

I have an Ubuntu 9.10 server with a public and private interface. I'd like to run portmap only on the private interface for security, so in /etc/default/portmap I had set: OPTIONS="-i 192.168.122.1" ...
1
vote
2answers
415 views

Disable File Copy between VMs

When I access multiple virtual desktops via VMware View 4, I'm able to copy files between VMs. The VMs are located in different isolated networks. This is a security concern in my organization and how ...
1
vote
2answers
1k views

force security permission through the directory tree?

Currently, there is large directory tree with differnt security permissions. We need to add another Security permission for all of the folders, and files without changing all the inherited ...
1
vote
3answers
2k views

How useful is Bitlocker without a TPM?

When you install Bitlocker on a system without a TPM you need to put the startup key on a flash drive. Since you can hardly expect the user to store his notebook and flash drive separately, would ...
1
vote
1answer
482 views

XML Schema For MBSA Reports

I'm in the process of creating a script to run the command line version of Microsoft Baseline Security Analyzer (mbsacli.exe) against all of our servers. Since the MBSA reports are provided as XML ...
1
vote
2answers
391 views

.htaccess redirect - Is it secure?

This works; I'm not having trouble, but I want to be certain that this is bulletproof. I came up with a neat little .htaccess redirect, but I am not sure if it is secure; do you know? <IfModule ...
1
vote
1answer
254 views

IIS6, NETWORK SERVICE and IIS_WPG

Is it correct that IIS6, by default, runs under the NetworkService account (NETWORK SERVICE)? and that NetWorkService is a member of the IIS_WPG group? Reference: Microsoft TechNet page on IIS6 ...
1
vote
1answer
134 views

Script for checking the nologin accounts and then disable the account

"Could you please share the scripts which does the below ?" I have written a script that scans all the relevent logs daily, makes a list of people that have had any activity that day, and maintains ...
1
vote
2answers
2k views

Turn off “isolation mode” in Vista Task Scheduler?

In Windows Vista (and I assume Windows 7) Microsoft has improved the security of processes that are run through the Task Scheduler, namely http://technet.microsoft.com/en-us/appcompat/aa906020.aspx: ...
1
vote
1answer
125 views

Security issues with Web Services and SSRS

I have a developer who would like to interact with the web services on the SSRS server. The way I understand it is that they would like to populate a list of reports in a folder so that the user can ...
1
vote
1answer
420 views

What user should an application pool bound to a Wordpress site use in IIS? [duplicate]

I've installed a wordpress site in a dedicated server with Windows 2008 server running IIS7 but I'm a little confused on what's the most secure way to set the appropriate file settings. The thing is ...
1
vote
2answers
278 views

ModSecurity Error Entries

Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't ...
1
vote
2answers
91 views

Unknown Directory Shortcut File or Mount | VISTA [closed]

I have this weird mount icon after a trojan cleanup days ago for a client. The icon when clicked takes you to the My Computer guid. The file properties are Type: File, Location: C:\, Size: 6.76. If we ...
1
vote
1answer
512 views

Firewall UDP Flood Dos/DDoS

Recently I have been suffering from what appears to be a UDP query flood attack. I am looking for a way to block the attack using a software firewall such as iptables, this should be possible, as ...