Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
57 views

Oracle SGD 4.61.915 not closing Windows 2003 application sessions

I'm using a Windows 2003 Application Server and I have followed this article: http://download.oracle.com/docs/cd/E19351-01/821-1926/z40000df1311155.html#bbjiefec but still.. when i close a application ...
1
vote
1answer
290 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
1
vote
1answer
166 views

Detecting a host doing a port sweep across multiple interfaces/networks

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces. As an illustration, if I could set up a box with eth1, eth2 and eth3. ...
1
vote
1answer
40 views

Hiding admin panel on separate domain?

I have a large site, I was thinking of the safest way to hold an admin panel for a site and was wondering what if I put the admin panel on a separate site? Would google find my admin panel site just ...
1
vote
0answers
34 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
0answers
240 views

can SECEDIT.exe be used to only add 1 group to 1 security policy? example?

I am assuming based on my research for using SECEDIT.exe -- that a template would be added to the exisitng security .SDB file. That this template would be very tiny... only naming the security policy ...
1
vote
0answers
373 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
1
vote
1answer
216 views

PolicyKit vs polkit

What is the difference between PolicyKit and polkit? They seem to do the same thing in different ways and seem to be referred to interchangeably, but also seem to be two different things. Which one ...
1
vote
1answer
285 views

Which is more secure - windows authentication or encrypted config sections?

I recently had this discussion with a colleague. We need to secure the connection strings that are in our .config files (for SOX compliance) and found two options: Encrypt the connection string ...
1
vote
1answer
166 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...
1
vote
1answer
162 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
2k views

Help needed accessing the %UserProfile%\AppData\Roaming\Microsoft\Crypto folder

Z:\Users\markk\AppData\Roaming\Microsoft>whoami shunranet\markk Z:\Users\markk\AppData\Roaming\Microsoft>cacls Crypto Z:\Users\markk\AppData\Roaming\Microsoft\Crypto NT AUTHORITY\SYSTEM:(OI)(CI)...
1
vote
1answer
223 views

Scripting access permission to Mac OS X 10.6 managed services

On Snow Leopard, I can give access to services like SSH only to specific users by using the "only these users:" option in the sharing tab of the System preferences. This is bothersome to use when ...
1
vote
1answer
98 views

Does MS SQL 2005 encryption protect data in the case of physical server access?

I am looking into MS SQL 2005 encryption (not 2008, so TDE is out), and I believe I understand the concept of how a column is encrypted. The OS uses the service credentials to encrypt the service ...
1
vote
1answer
104 views

Restrict access to network location from Windows Explorer

We have a legacy application which has data and PDF files available on a network share, and a locally-installed EXE to run it. The EXE uses a UNC path to access the data and PDFs. The customer is ...
1
vote
1answer
157 views

Create Mobile Device Management Server for iPhone Management on Windows Server

I need to create Mobile Device Management server to manage my enterprise's iPhone devices. I need to configuration it on Windows 2008 server. What are the steps to configure Mobile Device Management ...
1
vote
0answers
111 views

Client certificate based encryption

I have a question about security of a file on a webserver. I have a file on my webserver which is used by my webapplication. It's a bitcoin wallet. Essentially it's a file with a private key in it ...
1
vote
1answer
1k views

Reset Security on Win7 Windows folder

Is there a way to reset the security settings on the c:\windows folder of Win7. I have found this approach here, but formatting an copying back seems a little complex. Any ideas?
1
vote
2answers
218 views

IIS IP Adress Restriction - can I rely on it online?

I have an idea I'd like to float to the smart people of serverFault to pick holes in it. I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login ...
1
vote
0answers
682 views

Dell PowerConnect 6224F ACL Not Performing as Expected

What I'm trying to achieve is as follows: Allow full access to the device on 10.58.9.32 (our VoIP server), from anywhere on our network. Allow ICMP to flow in all directions to/from any device. ...
1
vote
1answer
256 views

How do I configure a server to stop blocking unzipped files

I have an application running on Windows2008 server. The automated deployment process drops a zipped package onto a folder, and then another script unzips this and copies the executables. The problem ...
1
vote
1answer
123 views

secure L2 connection

Due to some rapid changes I need to also provide vlan(s) in a new location. The topology looks like this: (main location, vlans:id=6(workstations),id=8(phones)) | my_switch01 \ \ ...
1
vote
1answer
946 views

Changing TCP/IP IPID sequence generation algorithm on Windows Server

a recent security review on a customers webserver yielded the following results: "[...] The system under test is using incremental ip ids. This means that every outgoing ip packet has an ...
1
vote
1answer
960 views

LSASS.exe trying to communicate over port 80

We are running a standalone web server (Windows 2008 + IIS 7), and our antivirus is blocking LSASS.exe (C:\Windows\system32\lsass.exe) from making outbound connections over port 80. Why is LSASS ...
1
vote
1answer
1k views

FTP virtual hosting proxy

I'm setting up OpenVZ to divide several of my sites from each other. I have one external ip address which I use to serve my sites. I'm using nginx to proxy http requests to nginx in each container ...
1
vote
0answers
571 views

VPN Error 619: Behind Cisco Router WRT310N

I've researched a lot on all the forums and this error is too generic for any of the proposed solutions to work. I'll try to give as much detail and tried solutions. I'm running a CentOS PPTP server ...
1
vote
1answer
1k views

Apache: disable directory listings

I'm using Apache 2.2. In the var/www directory I've created a .htaccess file that contains this: Options -indexes When I reach my site and want to see the directories and files like this: www....
1
vote
1answer
128 views

IIS and PHP restrict IO permissions

I have php installed trough a fastCGI module. Is there a way to restrict the module (php.exe) read / write permissions to only the directory (+ subdirs) of the IIS site that is calling it? I need ...
1
vote
1answer
272 views

Need advice in setting up server. fastCGI, suExec, speed, security, etc

I am running my own dedicated server with centOS 5 and WHM/cPanel. I would like to configure my server to meet my needs but I need a little help. It will only be my own websites being run on this ...
1
vote
1answer
134 views

How do I apply a security baseline to 2008 R2?

I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
1
vote
1answer
303 views

How to forbid postfix to send to external domains

I have a local postfix server, and i want it to only relay emails to the only local domain (localdomain.be): myhostname = localdomain.be mydomain = localdomain.be alias_maps = hash:/etc/aliases ...
1
vote
3answers
183 views

Securing HTTP traffic between data-logger and website, options

Got some IP data-loggers (that measure temp., humidity, light-level) sitting inside bunch of warehouses / stores with each warehouse / store being a different customer from my standpoint. These data-...
1
vote
1answer
111 views

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
1
vote
1answer
1k views

File permissions on web server

I have just read this useful article on files permissions, and I am about to implement a as-strict-as-possible file permissions policy on our webserver. Our situation: we have a web server accessed ...
1
vote
1answer
120 views

Where I can get the SQL-Server 2005 C2 Audit Event List

I couldn't found the list of SQL-Server 2005 C2 Audit Events on google! Any suggestion?
1
vote
1answer
48 views

Securing access to a website on IIS

I've got a website running on IIS7.5. I want to ask for credentials (fixed user/password) on access to the website. I don't need to do anything with those credentials - just to make sure the user ...
1
vote
3answers
124 views

Virtual users on Solaris

Is it possible to recreate the functionality of pam_userdb.so to make an application authenticate virtual users (valid for one specific service only) on Solaris? Situation is: higher-ups have ...
1
vote
2answers
113 views

Protecting PHP packages on server

I am a php developer and have recently decided to make one of my Magento extensions commercial. I have downloaded and configured MageParts CEM Server and that is all working perfectly in regard to ...
1
vote
1answer
450 views

Exchange 2003 default permissions for ANONYMOUS LOGON and Everyone

ANONYMOUS LOGON and Everyone have the following top level permissions in our Exchange 2003 Server: Read Execute Read permissions List contents Read properties List objects Create public folder ...
1
vote
1answer
401 views

Apache and fastcgi - How to secure an Apache server with fastcgi enabled?

I am running a headless server on Ubuntu 10.x. I am running Apache 2.2. I am writing a fastcgi application for deployment on the server. I remember reading a while back (I could be wrong) that ...
1
vote
1answer
249 views

Apache2 Virtual Host Restrict to Localhost

So here's the deal. I have multiple virtual host. Each virtual is a separate domain. Each domain is for separate applications. Lets say I have virtual hosts for: http://.abc.com http://.def.com http:...
1
vote
1answer
258 views

ESX Firewall Command Troubles

I am working on creating some firewall rules to stop some of the SSH brute-force attacks that we have seen recently on our ESX server hosts. I have tried the following rules from the CLI to first ...
1
vote
1answer
159 views

Searching for a lfd tutorial [closed]

I just got me a new centos server, and fould out it's running lfd. It looks nice, but I need to configure it. It keeps warning me about mysql running, or myself logging in via ssh, and so on. I couldn'...
1
vote
1answer
179 views

Locking down a server for shared internet hosting

Basically I control several servers and I only host either static websites or scripts which I have designed, so I trust them up to a point. However, I have a few customers who want to start using ...
1
vote
2answers
320 views

Why would a php file return 404 while in the bin directory on IIS7?

I'm running IIS7 and I have fastCGI installed and php code works just fine normally. Today I added a php file that contained only code an no html to the bin directory. And when I try to access it via ...
1
vote
1answer
707 views

exploit.so dmesg errors

A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
1
vote
1answer
2k views

IIS 6.0 PCI Compliance - “Information Disclosure Vulnerability”

We're trying to pass PCI compliance on a few of our websites. After an outside scan, we still have this vulnerability: Synopsis : The remote web server is affected by an information disclosure ...
1
vote
1answer
613 views

PGP encryption key with split-knowledge and dual control

An auditor recommends: We recommend that PGP environment be re-keyed using the industry required (ISO x9.8 and x9.24) standards of “split-knowledge and dual control” Is there something that we're ...
1
vote
1answer
1k views

What is the default management state on Netscreen firewall interfaces?

in other words, is the command: unset interface ethernet1/1 ip manageable redundant? I was thinking that for security purposes, it would probably make sense for Netscreens to only enable management ...