Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
66 views

How to autoban IPs that request URLs with a .php extension?

I've noticed in my linux/apache server logs that bot computers running muieblackcat are periodically trying to access all forms of phpmyadmin.php on my server. It's interesting, because I have a ...
0
votes
1answer
28 views

Linux package management and security flaws

Is there a mechanism built into rpm or apt that will warn (or prevent) a user from installing a package contains a known security threat? I'm thinking of an RPM like ...
0
votes
2answers
36 views

Security Help? Is this a safe way of doing things?

I am running Apache with Debian. At the moment to share my site I am just setting up my router to foward my local ip on port 80. So anyone who wanted to look at my site can just type in my router's ...
0
votes
1answer
35 views

In apache how do you validate that the logged in username matches the directory name?

Sometimes you want to setup a directory structure in apache such that logged in users can only see their own directory. (i.e. the directory name and the username match.) What do you put in the ...
0
votes
1answer
69 views

DDoS Attack Mitigation Techniques [duplicate]

Our hosting is set up on Amazon EC2 servers, which have been performing great. The problem we run into are spikes in requests for invalid URLs from scripts/bots looking for security holes. When ...
0
votes
1answer
116 views

Configure Apache to allow the access for the specific URL under VPN [closed]

Here is the case, I want to configure the Apache server so that some of the URLs can be accessed under VPN and some of them should be accessible with/without VPN. Here is my scenario Without VPN ...
0
votes
1answer
75 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
0
votes
1answer
50 views

Is a VPN right for restricting server access?

I would like to set up a Few QA servers for a web application, under the app domain, however I would not like these servers to be accessible to just everyone from the Internet. Ideally, the QA team ...
0
votes
1answer
47 views

removing process (and child process) access to file systems? [closed]

is there a unix-type free OS that allows me to remove all disk access for a specific process and any of its children? #!/usr/bin/perl -w use strict; use Perl6::Slurp; my $infile= ...
0
votes
2answers
80 views

Control IP to access a server , which use iptables

I would like to use linux command iptables to control to only allow the same subnet IP to access a server , what I would like to do is to allow any services from 10.168.1.0 to this server , could ...
0
votes
1answer
499 views

Why is OpenVZ less secure than KVM and XEN [closed]

I've read many forums and blogs and articles comparing OpenVZ, KVM and XEN. And I have seen many times that one of the negatives of OpenVZ is that its less secure. However, I have yet to see an ...
0
votes
1answer
63 views

Mount a Symlink Directory to Document Root for Deployment

Trying to establish a secure multiuser environment with limited user permissions and automated deployment. The example has been made simple to express the idea. Docroot: ...
0
votes
1answer
1k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
0
votes
1answer
139 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
0
votes
1answer
94 views

Verify PHP 5.3.27 has been patched for CVE-2013-4248

Server setup: CentOS release 5.10 (Final) WHM 11.40.0 (26) EasyApache 3.22.24 rev9999 compiled apache 2.2.26 and PHP 5.3.27 w/ SuHosin 0.9.33 I already had PHP 5.3.27 installed (since before most ...
0
votes
2answers
770 views

Granting access to Java Logger with java.policy file not working in Domino 9.0.1

After I upgraded our 32bit dedicated Windows 2003 server from 9.0 to 9.0.1 this part in java.policy file stopped working: permission java.util.logging.LoggingPermission "control"; which means I'm ...
0
votes
1answer
31 views

IIS6 Server compromised, pages being served which don't exist as asp files?

Started a new job recently which involves some work with an IIS server. We recently found that the server had been compromised as a few websites had pages appearing on Google Webmaster tools which ...
0
votes
2answers
373 views

Solaris non-global zone knowing its global zone

It's my understanding that it is not possible for a non-global zone to determine its global zone, however running this on the global zone creates a file called /etc/global-zone-name in all running ...
0
votes
1answer
252 views

How do I enable WebDAV write access in WebSphere Portal 8.0?

As an administrator in WebSphere Portal 8.0, I can access and modify theme-related files with a WebDAV client connected to http://servername:10040/wps/mycontenthandler/dav/fs-type1. I now want to ...
0
votes
3answers
147 views

What compatibility trade-offs do we need to make in order to use a hardened SSL config for Nginx?

I found some hardened SSL settings in github.com/ioerror/duraconf. Here is the header from the config: This is an example of a high security, somewhat compatible SSLv3 and TLSv1 enabled HTTPS ...
0
votes
1answer
87 views

RDP over VPN only

I know this question has been asked many a times here. But i want to gain certain perspective here. I have enabled VPN on certain systems and then can access remote system using rdp. However they can ...
0
votes
1answer
106 views

How to expose securely a Node.js/Express server into the real world?

Essentially I would like to know what the title suggests. Node.js/Express is nice. However, node is a fairly recent thing and hence there may be security risks by exposing the server to the real ...
0
votes
1answer
43 views

Conditional authentication in IIS?

Is it possible to specify conditional authentication methods in IIS (6 or 7) based on http headers? So for example mobile browsers would use a guest account while desktop browsers would need ...
0
votes
2answers
77 views

Amazon EC2 security groups

I'm setting up my first instance on EC2, and trying to find clear information on the security group settings is a bit difficult for a newbie like me. Are there some suggested settings that give a ...
0
votes
2answers
54 views

Mac Encryption and Reporting

We have a requirement at my company to support Macs. The machines need to be encrypted and have some sort of way to check in with a management system to verify the encryption status. This can be ...
0
votes
1answer
33 views

Amazon RDS - Create a Security Group NOT in Virginia? [closed]

It seems as though the management console only allows security groups to be created while in the "Virginia" selection. Is there a way to create a security group for an Oregon (or other)-based ...
0
votes
1answer
73 views

OpenVPN and Performance [closed]

From my understanding RDP is encrypted and so is the OpenVPN connection so that is an encryption in an encryption. My Setup: LAPTOP <---> REMOTE SERVER <---> OFFICE SYSTEM Due to ...
0
votes
1answer
37 views

Is it secure to allow users to create “support tickets” via E-Mail?

We are using WHMCS as our support portal which supports the piping of E-Mails into tickets, however, I am wondering if this could become insecure in the event that a forged E-Mail was sent. This is ...
0
votes
1answer
113 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
0
votes
1answer
106 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
0
votes
2answers
790 views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
0
votes
1answer
87 views

xinetd service: OK to change user? (cvs pserver)

Legacy Source Control: CVS under xinetd We have a team that uses legacy source control: cvs. We run cvs pserver under xinetd (config file below). Audit Flag A security audit raised a flag: "make ...
0
votes
1answer
116 views

dmcrypt container on nfs

I'm setting up an encrypted file storage on a remote server and I want to be able to use it transparently on my system. I want to be able to de-/encrypt them locally so that the server hosting the ...
0
votes
2answers
164 views

How can we restrict access to a web service to specific client computers?

We have a web application (Apache/PHP) that currently uses username/password authentication and is currently accessible from anywhere. It has server-side SSL enabled. Our client program is a version ...
0
votes
1answer
162 views

Windows Server 2003 R2 - Who has shutdown this server?

I'm hoping somebody can help me out here. I have a server that has been shutdown on 3 separate occassions but I cannot definitively determine who. I'm hoping somebody can help me figure out the ...
0
votes
1answer
160 views

Sending two Content-Security-Policy headers

I current have an nginx server that is sending the Content-Security-Policy header, however I've read that apparently IE only supports "X-Content-Security-Policy". Would it be a good idea to send both ...
0
votes
1answer
708 views

How can I setup an IP whitelist for a subdirectory?

A client of mine complained of an attack. I checked the access log and found a massive number of requests for the admin login page from seemingly random IP addresses. I created an .htacces file in the ...
0
votes
1answer
67 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
1answer
83 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
0
votes
1answer
69 views

Amazon EC2 - Help setting up security based on how my software works [closed]

I'm currently developing on a project of mine where I need some guidance on securing my server. My server is Ubuntu Server 64bit hosted at Amazon AWS EC2. I have my own software running on it. My ...
0
votes
1answer
215 views

Remove “Act as part of the operating system” policy

On one of our servers we have enabled the "Act as part of the operating system" policy in the Local Security Policy. (Security Settings > Local Policies > User Rights Assignment). Now we would like ...
0
votes
1answer
334 views

phppath/php as URL has strange behaviour and seems to be an attack

Warning: The following requests might harm your server. I got some strange things in the apache log: "POST ...
0
votes
1answer
42 views

How to secure mount NFS folder for read & write access?

I have 4 load balanced apache servers, and all of them can add files to /project/media/ direcotry (different pictures). I want to store all media files in separate server and mount them on apache ...
0
votes
1answer
121 views

Allied Telesis AlliedWare gui http server accepted cipher suites

When configuring a AT-9924T switch running AlliedWare 2.9.2 to serve ssl encryption on the http server as described in the manual like this: create enco key=0 type=rsa length=2048 set system ...
0
votes
1answer
117 views

Is it worth to use chroot when running web applications?

My setup: In production I'm using one virtual server per one web application shard. Shards are behind load balancer. In backstage we run web application + DB on a single virtual server. The ...
0
votes
1answer
38 views

Referrer in access.log is a directory

It seems that the referrer on the following log is a folder. 112.200.208.5 - - [29/Jul/2013:20:43:14 +0800] "GET /sites/default/files/download/argie/pos-code.zip HTTP/1.1" 206 294677 ...
0
votes
1answer
154 views

hacking attempt or something else in IMAP - logwatch logs

In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts. IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 ...
0
votes
1answer
70 views

Securing nginx (user/file permissions)?

I'm just setting up nginx on my web server, and I created a user account for it to use (nginx). However, it runs its worker processes by default as www-data. Is there any disadvantage to using ...
0
votes
1answer
32 views

Setting up SSL at the server level on a VM [duplicate]

Forgive me if this is a trivial question, but I literally have zero experience in hardware administration. I build websites/web apps, but usually use a third party like GoDaddy or Arvixe to ...
0
votes
1answer
49 views

disallow file types (shell script wordpress security)

We recently got our servers into SVN which has been great, but this causes a lot of problems when using things like WP Filebase for CMS file management. It's also hard to keep the uploads folder ...