Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
75 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
1
vote
1answer
60 views

Enable usr account external hardisk? [closed]

I have a Windows 2008 installation on an external harddisk, it turns out that my account is disabled on this external harddisk. Can I enable this account again? For example by booting into my default ...
1
vote
0answers
34 views

Is it possible to secure MySQL admin password with digital certificate on windows [closed]

I'd like to know if it is possible: I searched google but couldn't find.
1
vote
0answers
161 views

Client Address is not showing correct in Event Log

I had enable the Advance Audit Policy Configuration on my Domain Controller. Server OS - Window Server 2008 R2 Standard. Client OS - Window XP Whenever the Domain User enter wrong password for ...
1
vote
0answers
149 views

The description for Event ID (560) in Source (security) cannot be found. with users in specified group

I have some users in a group that look at the audits. They are in a group I created. This group should have permissions to view the security audits. They can see them, but the descriptions are missing....
1
vote
0answers
14 views

How to use SCW to produce XML of current settings

The Security Configuration Wizard allows you to create an xml of various recommended security settings for the current server, based on role. Is there any way of producing this xml based on the ...
1
vote
0answers
473 views

All local users set to “User must change password at next logon”

We had a weird problem occur on a production Windows 2003 R2 SP2 server which has about 50 local (the server is in a 2000 AD domain, but these accounts are local to the server) accounts defined. "...
1
vote
1answer
584 views

Mysterious login attempts to windows server

I have a Windows 2008R2 server that is reporting failed login attempts from a number of workstations on our network. Some event log details: Event ID 4625, Status: 0xc000006d, Sub Status: 0xc0000064 ...
1
vote
1answer
497 views

Security issues/risks connecting from IIS7.5 to SQL Server 2008+ using Machine Account (DOMAIN\MACHINENAME$)

I'm working with a group of engineers doing .NET 4 / MVC 3 development, using Windows 7 Enterprise and IIS 7.5 locally, and connecting to MSSQL 2008+ dev/testing databases. The databases are remote ...
1
vote
0answers
54 views

Securing internal sites on Windows Server

Background: I have limited server admin / networking knowledge, my background is non-network programming. What are some options for securing and hiding internal sites? I have a Windows VPS running ...
1
vote
2answers
520 views

Relabeling of filesystems (SELinux) fails

After compiling the policy modules and re-compiling my core packages (Gentoo 32bit) I wanted to relabel the filesystems (via rlpkg -a -r) and packages but I get these error messages: Relabeling ...
1
vote
1answer
593 views

How can I edit web.config to have a different MIME type for a single XML file not others?

I am trying to set the MIME type for Flash's cross domain file in web.config. Since this file has an extension of .XML the following command will edit the MIME type of all XML documents in my site (...
1
vote
1answer
857 views

SQL injection security vulnerability in Plesk control pannel [closed]

I have plesk 10.3.1 and I received following email from the Plesk admin Parallels, the manufacturer and distributor of the Plesk Control Panel, has identified a SQL injection security ...
1
vote
2answers
189 views

FTP SITE CHMOD Error

When trying to edit file/folder permissions via FTP I am getting the error: 505 Security server forbids SITE commands. Contact admin. I am currently using VSFTPD with the config value chmod_enable=...
1
vote
1answer
96 views

Securing php webserver from exploits? [closed]

We are running a PHP application on a linux apache webserver. How can we secure the server, so if someone finds a hole in our application, they can only get access to the application (Files inside ...
1
vote
1answer
451 views

How to secure a Windows SBS Server against fraudulant login attempts?

I administer a Windows Small Business Server 2003 R2 server for a small business. The only ports that this server has exposed to the internet are SSL and the RDP tunnelling port used by the SBS remote ...
1
vote
2answers
457 views

Finding source of directory traversal attack originating from my server

Two weeks ago, I was notified by my VPS provider that my server (CentOS 5.5, yum is up to date) had originated "NULL byte/Directory Traversal" attacks agains some servers at DreamHost. I spent a few ...
1
vote
1answer
420 views

openVAS scan against new instance fails test (possible false positive) How to debug plug-in

I have openVAS installed from the atomic corp YUM repo, and it all seems to be functioning wonderfully, however I am seeing a single "Security Hole" which is that OpenVAS detects that "arora" is ...
1
vote
2answers
467 views

OpenSSH 5.9p1 on Ubuntu 11.10

I want to build a deb package with the latest version of openssh from source. Then I want to install it on my machine. I am running: Linux Ubuntu-1110-oneiric-64-minimal 3.0.0-12-server #20-Ubuntu ...
1
vote
0answers
263 views

ejabberd changing ports?

I changed the ports in the listen section (just added a 1 in front of them) in the /etc/ejabberd/ejabberd.cfg, but after a /etc/init.d/ejabberd restart The server still listens on the original ...
1
vote
0answers
1k views

Why is my access being denied when I am an adminstrator on my Windows Server 2003 Installation?

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to ...
1
vote
1answer
122 views

Do Mac OS X servers have a security mechanism that blocks a user if they log in from two different IPs?

A trusted friend and I had ssh'ed into a Mac OS X Web Server (either 10.6.8 Snow Leopard or 10.7 Lion) from two different locations. Then my password stopped working when trying to log in. I can ...
1
vote
2answers
46 views

Security Policy based on Subnet [closed]

We are implementing a security policy and Firewall access rules based on the subnet using static dhcp bindings. There is one scenario where some one can manually assign ip address from a subnet with ...
1
vote
2answers
170 views

Securing shared Apache2 + PHP

We want to setup a shared webserver running Apache2 and PHP5. Our need is to host some PHP apps like Wordpress, Zend framework applications... Some of the sites may be controlled by external ...
1
vote
0answers
460 views

Can ApacheDS LDAP change root user name?

ApacheDS 1.5 has the following account by default. Bind dn or user: uid=admin,ou=system Bind password: secret i would like to change it to the following to avoid making changes in my code Bind dn ...
1
vote
1answer
70 views

multi-purpose server - security

running ubuntu server 10.04. This box is both a web (apache2) and vpn (openvpn) server. Here is how the network is currently configured. router 192.168.1.1 | | LAN | | ubuntu server 192.168.1.2 NAS ...
1
vote
3answers
91 views

How to give web users access to server securely?

I'm building an application that will enable users to write code from the browser. Once the code is written I save the contents to my webserver in a user-specific folder. I'd also like to add a ...
1
vote
0answers
612 views

Where can I find information about inbuilt registry keys for Windows Server 2008 R2?

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances. ...
1
vote
1answer
138 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
1
vote
0answers
41 views

Access error with administrator accounts

Problem: I have access denied on system files and folders, using accounts that are in the local\administrators group. system is W7 Ultimate 64 bit that is joined to a domain. the users that login to ...
1
vote
1answer
3k views

How to set a network interface as 'trusted' on Centos 6 (with multiple interfaces)

I have a box with two wired network interfaces. On Centos 5 I could run the setup command in console and set which interface is trusted and which not in the firewall configuration (e.g. eth1 trusted, ...
1
vote
2answers
264 views

Concerns about a Dedicated (Windows Server 2008) + DDoS [duplicate]

I am have today a dedicated server with these specs: Intel Core i5 750, 2x120GB (ssd + raid), Windows Server 2008 Web, 200Mbps Network, 24 Gb DD3 And I would like to know what are the best ...
1
vote
1answer
246 views

Security risk of JIRA standalone installation running JRE version 1.6.0_26 vs 1.6.0_29 (latest)

Atlassian recently introduced a standalone installer that installs JIRA, along with its own JRE. Unfortunately the JRE Atlassian bundles with this installer is 1.6.0_26, whereas the current version of ...
1
vote
1answer
106 views

SelfSSL in IIS 6.0

I am using IIS 6.0 and selfSSL to create a self signed certificate, but it only lasts one week. How do I prolong the time of this?
1
vote
1answer
55 views

Application hosted in IIS7 does not provide credentials to Web Service on another server

At the moment we identified that the error is due to security issues. The old server ServerA managed to communicate with WebServerC without problems, now the new server ServerB can connect but the ...
1
vote
1answer
557 views

Windows EC2 instances in same security group cannot communicate

I have 2 instances (windows machine) in the same security group. I create a network drive on instance machine(A) for share a folder to other instance machine(B). But when I map a network path on ...
1
vote
2answers
514 views

Accessing Citrix XenDesktop from outside the domain / firewall

My understanding of accessing a Citrix XenDesktop from a home PC is: Download the Citrix plugin. Go to the Citrix XenDesktop server in a web browser. Type in information, including PIN and number ...
1
vote
0answers
106 views

subdomain security IIS doesn't have authentication

I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are ...
1
vote
1answer
249 views

ASA 5520, I cannot communicate to the DMZ

Well im having some serious issue here. My internal PCs cannot communicate to the DMZ to access the www plus the mail server- Im a bit new to the game and therefore im n not tchat good at all.. ...
1
vote
0answers
57 views

Oracle SGD 4.61.915 not closing Windows 2003 application sessions

I'm using a Windows 2003 Application Server and I have followed this article: http://download.oracle.com/docs/cd/E19351-01/821-1926/z40000df1311155.html#bbjiefec but still.. when i close a application ...
1
vote
1answer
289 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
1
vote
1answer
165 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
40 views

Hiding admin panel on separate domain?

I have a large site, I was thinking of the safest way to hold an admin panel for a site and was wondering what if I put the admin panel on a separate site? Would google find my admin panel site just ...
1
vote
0answers
34 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
0answers
240 views

can SECEDIT.exe be used to only add 1 group to 1 security policy? example?

I am assuming based on my research for using SECEDIT.exe -- that a template would be added to the exisitng security .SDB file. That this template would be very tiny... only naming the security policy ...
1
vote
0answers
373 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
1
vote
1answer
214 views

PolicyKit vs polkit

What is the difference between PolicyKit and polkit? They seem to do the same thing in different ways and seem to be referred to interchangeably, but also seem to be two different things. Which one ...
1
vote
1answer
285 views

Which is more secure - windows authentication or encrypted config sections?

I recently had this discussion with a colleague. We need to secure the connection strings that are in our .config files (for SOX compliance) and found two options: Encrypt the connection string ...
1
vote
1answer
165 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...
1
vote
1answer
162 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...