Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
2answers
60 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
0
votes
3answers
190 views

Reporting Penetration Attempts to My Server

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. ...
0
votes
2answers
1k views

How can I stop SMB on Windows 7 null authenticating?

This is a nasty question to be asking but we're really desperate. By which I mean we have about four hours to fix this or dire consequences will follow. We have a PC for card processing in our office ...
0
votes
2answers
375 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
0
votes
2answers
1k views

Only allow ssh connections to a specific domain

I have a server setup with several domains and subdomains. I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured. Connecting ...
0
votes
4answers
2k views

Alternative to IBM WebSphere DataPower XML Security Gateway XS40

Is there any alternative to this IBM solution for a SOAP security gateway? Maybe open source software or hardware from other vendors?
0
votes
4answers
2k views

What firewall rules should be used for a home based system [closed]

I'm just setting up a home wireless network with connection to the internet. The router has settings to configure the firewall rules. Currently it's set to INBOUND ALL ANY and OUTBOUND ALL ANY. ...
-1
votes
3answers
285 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
11
votes
1answer
3k views

Enable blowfish-based hash support for crypt

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server? I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH. As far as ...
8
votes
4answers
1k views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
8
votes
4answers
5k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
6
votes
5answers
301 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
2answers
6k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
6
votes
13answers
2k views

Mysterious html inserted into my site's pages (hacked?)

Twice, I've found weird code the top of my index.php. The first time, it was this: <iframe src="http://ntwportal.com/" width="2" height="4"></iframe> Then this: <iframe ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
6
votes
2answers
2k views

Virtual host on LAN - VMs on DMZ, separate NICs - is this a bad idea?

Just kicking this idea around, and wanted to see if you'll be so kind as to point out the problems I don't see. If I set up this new HyperV host as a normal domain member, the benefits are obvious. ...
5
votes
2answers
1k views

Is it ok to leave the MySQL root password blank?

Does a root user without a password constitute a security breach if my MySQL server only accepts connections from localhost? I'm aware that the common wisdom says the root user should be protected by ...
5
votes
1answer
1k views

Possible to limit an EC2 key to just ec2-associate-address?

I have a regular EC2 instance with an elastic IP. The few times the instance has been stopped, I've just manually re-associated the IP with it via the AWS Management console. I'm now thinking about ...
5
votes
5answers
492 views

If I use ftp or telnet by accident, to what extent is my password unsafe?

if i use ftp or telnet by accident (usually on the bash shell), to what extend is my password visible? can my coworker see it? can my neighbor see it if i work at home (if not using wireless)? can ...
4
votes
7answers
534 views

Configure a “hardened” user account that an attacker would have a hard time abusing

Suppose you have a Windows Server machine running various sensitive services. Suppose that one of these services is pretty simple, maintaining a small amount of information in a text file, but as a ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
4
votes
1answer
608 views

Get SSH fingerprint from remote server securely?

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home. Is there any other ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
4
votes
2answers
14k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
4
votes
4answers
4k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
3answers
3k views

Hosting multiple repositories, each with differing access control

We will need to host a series of Mercurial repositories. For security, we will use SSL encryption in Apache and htpasswd access (required). I tested out a single repository and used hgwebdir.cgi and ...
3
votes
1answer
280 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
3
votes
2answers
977 views

Does adding an user to the apache group creates a security hole?

Beginner question. I saw this mentioned on a website, considered a bad practice,but can't remember where and why. So, if I have an user which has access to files that Apache shouldn't have access, and ...
3
votes
2answers
1k views

Securing PHP via open_basedir based on script path

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't ...
3
votes
3answers
958 views

CentOS PCI Compliance assessment

We are currently working our way through a PCI compliance assessment on our server running CentOS. We are getting a lot of 'severe' issues with suggested fixes. The suggestions to rectify the issues ...
3
votes
5answers
3k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
3
votes
1answer
14k views

Best practices for hardening/locking down Windows Server 2008 R2 for use as web server?

What actions should be taken to 'lock-down'/harden/secure a windows server 2008 R2 machine, when used as a web server (with remote desktop access)? Are there any elements that are enabled as standard ...
3
votes
3answers
379 views

Looking for a way to audit/monitor removable media on a Mac

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her ...
3
votes
2answers
5k views

Plesk HTTPS setup and directory problems

We are trying to configure ssl for one of our domains hosted on a Red Hat server running Plesk. Plesk version: 9.5.2 Apache: 2.2.3 Redhat: 2.6.18-194.el5 We created a new SSL certificate entry ...
3
votes
3answers
10k views

Domain User can RDP into Domain Controller?

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
3
votes
3answers
2k views

How to encrypt traffic between two Amazon EC2 instances?

We are building a web app using Amazon EC2 instances running Linux. All the traffic to the client browser is encrypted with SSL. What should be used to encrypt the traffic between the instances. The ...
3
votes
1answer
768 views

Will you allow NetBIOS into your DMZ?

Is it secure for a firewall to allow NetBIOS connections from the internal network to the DMZ? If not secure, what are the risks? If secure, what is the FUD about and what are the counterarguments? ...
2
votes
1answer
168 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
2
votes
1answer
2k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
2
votes
1answer
788 views

Removing port forwardings programmatically on a ControlMaster SSH session

Quite a while ago I got an answer telling me how to add a port-forwarding on a running SSH ControlMaster process. To know that helps a lot, but I'm still missing a way to remove such a port forwarding ...
2
votes
3answers
984 views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL ...
2
votes
1answer
2k views

Is there an easy way to check SSL cipher preference from the command-line?

CentOS 5.x I want to confirm which SSL ciphers are supported and preferred on my web server. Is there an easy way to do this WITHOUT using third-party audit software/equipment? I was hoping for ...
2
votes
2answers
7k views

How does the Task Scheduler save passwords on Windows 7?

If I save a password for a scheduled task, or in a service's logon credentials, is it safe? It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
1answer
150 views

Why restricting Apache users from executing scripts?

When Apache users are allowed to executes bash scripts via PHP - why it's considered dangerous? I understand that the users can traverse the whole file system and even see which additional users are ...
2
votes
4answers
4k views

How can I run a process as “NT Authority\NetworkService”?

I'm toying with an idea for a script that would update a computer's details in Active directory with its make and model information. Ideally, I'd like this script to access AD via its computer ...
2
votes
3answers
2k views

when to use IPSec in Windows AD domain?

As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords). Now, I read (in non-English ...
2
votes
2answers
4k views

Is adding users to the group www-data safe on Debian?

Many PHP applications do self-configuration and self-updating. This requires apache to have write access to the PHP files. While chgrp'ing them all to www-data appears like a good practice to avoid ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?