Security is not a product, but a process.

learn more… | top users | synonyms (1)

5
votes
5answers
118k views

Windows Security (In windows 7) keeps asking for my credentials, and won't “Remember my credentials”

I'm not the network admin, but my network admin is having trouble solving this as well. My issue is exactly as the title says... Windows Security (In windows 7) keeps asking for my credentials, and ...
5
votes
4answers
677 views

iptables: change policy or use catch-all rule?

What do you do when setting up iptables: change the default policy (iptables -P INPUT DROP, for example) or add a catch-all rule at the end of the ruleset (iptables -A INPUT DROP)? If you do prefer ...
5
votes
4answers
10k views

How to thwart PHPMyAdmin attacks?

We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
5
votes
6answers
794 views

Advice a good hardware firewall [closed]

Which firewall would you advice to use to meet following 1Gb line and most anti hacking modules. Price range 10k-15k$. 3 years warranty on site, full support online. About modules, i don't know what ...
5
votes
12answers
4k views

nmap shows opened port but netstat doesn't

If I scan my server with nmap, it shows that 21 port is opened. But when I login into this server and run netstat, I see nothing. $ nmap -sT server Starting Nmap 4.76 ( http://nmap.org ) at ...
5
votes
7answers
2k views

Importance of default windows shares

I have to set up some shares on a windows server (2003), but I really don't like those default shares (C$, ADMIN$, IPC$). I seem to remember that you shouldn't remove those shares, but when the ...
5
votes
4answers
316 views

How to prevent a security breach from taking your online backups with it?

What techniques do you recommend for securing a online backups (to a third party service like Mozy) a backup that has the advantages of online backup but cannot be tampered with just by compromising ...
4
votes
1answer
5k views

Apache - disable range requests - disadvantages?

As there is a working exploit against Apache's byte range implementation (CVE-2011-3192, see here), I'd like to disable it until official patches are shipped with my distros (Debian, Ubuntu). The ...
4
votes
2answers
3k views

Understanding IUSR_<machine> account

Namely how is setting read/write permission for this account different from giving read/write access in the IIS (Windows 2003, so it should be IIS6 if I am not mistaken). Here is the issue: It looks ...
4
votes
2answers
5k views

Why is using ntrights.exe in Windows Server 2008 R2 giving error openpolicy -1073741790

I am local admin on a windows server 2003 R2 machine in our domain. This machine was built about 3 years back and I am not sure what privilges I might have. If I use ntrights.exe (from resource kit ...
4
votes
6answers
14k views

SQL Server 2008 login problem with ASP.NET application: Failed to open the explicitly specified database

I am running SQL Server 2008 Express Edition on Windows Server 2008 with an ASP.NET application which must access the server. The ASP.NET application is associated with an application pool that runs ...
3
votes
4answers
689 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
3
votes
2answers
2k views

Weird MySQL Users Been Created (eg. bug115166_10073) and not by me

Have just been looking at my MySQL user permissions during a security audit and have noticed about 20 MySQL users have been created with random names such as 'bug115166_10073'. They don't have any ...
3
votes
2answers
5k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
3
votes
3answers
8k views

Nesting Distribution Group within Security Group

Quick sanity check - If I nest an Active Directory distribution group within an Active Directory Security group, will permissions assigned to the AD Security group cascade to the members of the ...
3
votes
1answer
813 views

What are the security implications of using allow.sysvipc in a FreeBSD jail

The man page for jail says that allow.sysvipc enables "System V primitives [to] share a single namespace across the host and jail environments..." thus "... processes within a jail would be able to ...
3
votes
6answers
3k views

Do proxies really provide anonymity?

Do web proxies really provide anonymity? I mean, without someone asking for logs in a web proxy server for who/when connected, is it impossible to know who was behind that IP address? I'm asking ...
3
votes
6answers
12k views

Why does everybody recommend Dban over more fundamental methods?

When people ask on how to wipe a drive, it almost seems as if the default answer is DBAN and I am not really sure why. Especially when doing commands like dd if=/dev/zero of=/dev/sda dd ...
3
votes
3answers
274 views

Linux Extended Permissions

What "beyond POSIX" file permissions are you using in your production/home Linux setups? I am using SELinux through FC11. Don't really notice it apart from the violations applet in Gnome. Does ...
3
votes
6answers
7k views

Why can't I drag/drop a file for editing in notepad in Windows Server 2008?

When notepad is run, I can drag/drop a file to open it, but then it can't save the file. When I run notepad elevated to save the file, I can no longer drag/drop to open the file. I understand its a ...
3
votes
5answers
229 views

What Security Suite to choose?

What security suite would you recommend in an environment consisting of roughly 120 PC's and some 30 servers? Environment is MS only, so Exchange and ISA must also be supported.
3
votes
6answers
2k views

Preventing users from running certain programs

Is it possible to prevent users from running certain programs on their Linux computers? Is there a whitelist method? A blacklist?
2
votes
1answer
331 views

Security concerns in Ubuntu and CentOS

In my company we are dealing with an interesting decision: which Operating System should we choose as the default one? This does not mean that every installation will be based on the chosen Operating ...
2
votes
2answers
4k views

Listing Users using RDP

Windows Server 2008 R2 I'm trying to use PowerShell to get me a list of users who have logged into Remote Desktop Services (formerly known as Terminal Services) during the past day. With little ...
2
votes
2answers
189 views

Is there a password agent for the mysql command-line client?

I use the mysql command line client frequently. Sometimes I wind up typing in my password dozens of times per day, and I'm getting really tired of it. SSH has a neat utility called ssh-agent which ...
2
votes
2answers
2k views

Low entropy on CentOS 5 after new mount

I recently mounted a new partition and moved /home and /var/lib/mysql to the new drive and did a symlink to them. Now I've noticed that the entropy (using munin) has dropped from around 3000 to ...
2
votes
3answers
314 views

How do I go about securing my rsync backups?

Right now I backup my website/server daily using rsync with cron. What I'm worried about is someone hacking into my server and then gaining access to my rsync account and deleting everything. How do I ...
2
votes
5answers
3k views

How to log commands/logins in linux?

I'm feeling that some people are using the root, how i can log all commands and connections times including ips made to the server (ssh) from all users? history command is not enough
2
votes
2answers
20k views

troubling anonymous Logon events in Windows Security event log

I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ...
2
votes
5answers
2k views

How can I learn Linux from hacking or security point of view [closed]

I was interested in entering the security Field and then I studied various posts about that. Someone told that I had to first know the unix system inside out form security perspective and then I can ...
2
votes
2answers
6k views

ntrights equivalent/replacement for Server 2008

Does anyone know what or if there exists a replacement utility for the Server 2000/Server 2003 command line tool ntrights on Server 2008? More info on this utility (for those that don't know what it ...
1
vote
4answers
2k views

Securing a guest VM to give it internet access, but block access to host LAN

I have a Linux guest VM running under a Windows host. If I set the networking mode to NAT, the guest can get internet access (which I want), but can also access the hosts LAN (which I dont). For ...
1
vote
1answer
2k views

what would be a better practice instead of chmod g+r /etc/shadow so I can use Unix user/group database for Jenkins authentication?

I don't want to run Jenkins as root, nor giving public access (or even group access) to /etc/shadow seems to a good idea. as suggested by "Manage Jenkins" when selecting Linux user/group database: ...
1
vote
3answers
1k views

Spam in Apache access logs

I just booted a new, mint Debian Squeeze x64 server from my cloud hosting provider. I received by root password by email, logged in and ran the following commands: apt-get update apt-get upgrade ...
1
vote
2answers
6k views

How to fix “TCP/IP Sequence Prediction Blind Reset Spoofing DoS”

Just finished a Nessus scan and the only thing that came back was "TCP/IP Sequence Prediction Blind Reset Spoofing DoS" - It may be possible to send spoofed RST packets to the remote system. ...
1
vote
3answers
363 views

Reporting Penetration Attempts to My Server

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. ...
1
vote
2answers
91 views

Using a package manager vs compiling from source for latest updates

I run a Ubuntu 11.10 server at my house and in the past I have been using apt-get to keep all my packages up to date. Recently I noticed that when I run apt-get update/upgrade the version of some ...
1
vote
2answers
2k views

Logwatch: Ignore certain IPs for SSH & PAM checks?

I have a CentOS 5.6 system, which runs Logwatch. If I perform a security scan (Nessus) against this host, it produces unnecessary noise in the Logwatch output. I'd like to run these security scans ...
1
vote
1answer
1k views

Linux-KVM / iptables: prevent guest spoofing by matching ip+mac address on bridge?

I have my KVM guests on a standard br0 bridge setup: auto br0 iface br0 inet static address 192.168.1.117 netmask 255.255.255.0 network 192.168.1.1 broadcast 192.168.1.225 gateway ...
1
vote
1answer
1k views

SQL Server 2005 Accidentally removed a user from public role, can't add user back into role

I'm trying to crearte a DB user account that only has access to a specific database, and can't read or change other databases, and can't alter credentials for any other accounts. I accidentally ...
1
vote
1answer
192 views

What do I need to do to prevent exploitation of my postfix server?

I have a a web server that needs to send emails, but not recieve them. I have installed postfix (it came with nagios, also installed on this server) and now I need to make sure that my server does ...
1
vote
2answers
1k views

Best way to use large IP blacklist to deny access to a Windows 2008 web server?

Basically, I'm looking for a solution similar to the ones mentioned in a similar (but Linux-focussed thread) located here so that I can deny access to blacklisted IPs. I am specifically focussed on ...
1
vote
2answers
171 views

How to generate keys for clients whilst keeping ca.key safe

I'm setting up a small vpn service for 10 - 100 expats so they can access normally blocked sites. I would like them to be able to sign up via my website, which upon payment the site will generate ...
1
vote
8answers
1k views

Turning off FTP

I'm setting up a new debian server and I don't need FTP so I want to remove it. According to netstat -tap, ftp isn't listening on anything. However when I do a port scan (nmap) externally it says the ...
0
votes
1answer
2k views

Securing MySQL debian-sys-maint

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password. This bothered me as the default situation, ...
0
votes
2answers
95 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
0
votes
2answers
1k views

How can I stop SMB on Windows 7 null authenticating?

This is a nasty question to be asking but we're really desperate. By which I mean we have about four hours to fix this or dire consequences will follow. We have a PC for card processing in our office ...
0
votes
2answers
451 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
0
votes
2answers
2k views

Only allow ssh connections to a specific domain

I have a server setup with several domains and subdomains. I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured. Connecting ...
0
votes
4answers
3k views

Alternative to IBM WebSphere DataPower XML Security Gateway XS40 [closed]

Is there any alternative to this IBM solution for a SOAP security gateway? Maybe open source software or hardware from other vendors?