Security is not a product, but a process.

learn more… | top users | synonyms (2)

7
votes
4answers
5k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
6
votes
5answers
298 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
13answers
2k views

Mysterious html inserted into my site's pages (hacked?)

Twice, I've found weird code the top of my index.php. The first time, it was this: <iframe src="http://ntwportal.com/" width="2" height="4"></iframe> Then this: <iframe ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
6
votes
2answers
2k views

Virtual host on LAN - VMs on DMZ, separate NICs - is this a bad idea?

Just kicking this idea around, and wanted to see if you'll be so kind as to point out the problems I don't see. If I set up this new HyperV host as a normal domain member, the benefits are obvious. ...
5
votes
2answers
948 views

Is it ok to leave the MySQL root password blank?

Does a root user without a password constitute a security breach if my MySQL server only accepts connections from localhost? I'm aware that the common wisdom says the root user should be protected by ...
5
votes
1answer
866 views

Possible to limit an EC2 key to just ec2-associate-address?

I have a regular EC2 instance with an elastic IP. The few times the instance has been stopped, I've just manually re-associated the IP with it via the AWS Management console. I'm now thinking about ...
5
votes
5answers
487 views

If I use ftp or telnet by accident, to what extent is my password unsafe?

if i use ftp or telnet by accident (usually on the bash shell), to what extend is my password visible? can my coworker see it? can my neighbor see it if i work at home (if not using wireless)? can ...
4
votes
7answers
522 views

Configure a “hardened” user account that an attacker would have a hard time abusing

Suppose you have a Windows Server machine running various sensitive services. Suppose that one of these services is pretty simple, maintaining a small amount of information in a text file, but as a ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
4
votes
1answer
595 views

Get SSH fingerprint from remote server securely?

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home. Is there any other ...
4
votes
2answers
4k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
4
votes
4answers
4k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
3answers
3k views

Hosting multiple repositories, each with differing access control

We will need to host a series of Mercurial repositories. For security, we will use SSL encryption in Apache and htpasswd access (required). I tested out a single repository and used hgwebdir.cgi and ...
3
votes
1answer
234 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
3
votes
2answers
894 views

Does adding an user to the apache group creates a security hole?

Beginner question. I saw this mentioned on a website, considered a bad practice,but can't remember where and why. So, if I have an user which has access to files that Apache shouldn't have access, and ...
3
votes
2answers
1k views

Securing PHP via open_basedir based on script path

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't ...
3
votes
5answers
3k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
3
votes
1answer
13k views

Best practices for hardening/locking down Windows Server 2008 R2 for use as web server?

What actions should be taken to 'lock-down'/harden/secure a windows server 2008 R2 machine, when used as a web server (with remote desktop access)? Are there any elements that are enabled as standard ...
3
votes
3answers
363 views

Looking for a way to audit/monitor removable media on a Mac

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her ...
3
votes
2answers
4k views

Plesk HTTPS setup and directory problems

We are trying to configure ssl for one of our domains hosted on a Red Hat server running Plesk. Plesk version: 9.5.2 Apache: 2.2.3 Redhat: 2.6.18-194.el5 We created a new SSL certificate entry ...
3
votes
2answers
13k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
3
votes
3answers
10k views

Domain User can RDP into Domain Controller?

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
3
votes
3answers
2k views

How to encrypt traffic between two Amazon EC2 instances?

We are building a web app using Amazon EC2 instances running Linux. All the traffic to the client browser is encrypted with SSL. What should be used to encrypt the traffic between the instances. The ...
3
votes
1answer
749 views

Will you allow NetBIOS into your DMZ?

Is it secure for a firewall to allow NetBIOS connections from the internal network to the DMZ? If not secure, what are the risks? If secure, what is the FUD about and what are the counterarguments? ...
3
votes
7answers
291 views

Secure Formatting Disks

I heard about people that used tools to recover deleted data and found a lot of unusual data, that after discovered that the their brand new pc in truth was used... When discarding HD's, as sysadmin, ...
2
votes
1answer
147 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
2
votes
1answer
660 views

Removing port forwardings programmatically on a ControlMaster SSH session

Quite a while ago I got an answer telling me how to add a port-forwarding on a running SSH ControlMaster process. To know that helps a lot, but I'm still missing a way to remove such a port forwarding ...
2
votes
3answers
874 views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL ...
2
votes
1answer
1k views

Is there an easy way to check SSL cipher preference from the command-line?

CentOS 5.x I want to confirm which SSL ciphers are supported and preferred on my web server. Is there an easy way to do this WITHOUT using third-party audit software/equipment? I was hoping for ...
2
votes
2answers
6k views

How does the Task Scheduler save passwords on Windows 7?

If I save a password for a scheduled task, or in a service's logon credentials, is it safe? It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
1answer
149 views

Why restricting Apache users from executing scripts?

When Apache users are allowed to executes bash scripts via PHP - why it's considered dangerous? I understand that the users can traverse the whole file system and even see which additional users are ...
2
votes
4answers
4k views

How can I run a process as “NT Authority\NetworkService”?

I'm toying with an idea for a script that would update a computer's details in Active directory with its make and model information. Ideally, I'd like this script to access AD via its computer ...
2
votes
3answers
1k views

when to use IPSec in Windows AD domain?

As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords). Now, I read (in non-English ...
2
votes
2answers
4k views

Is adding users to the group www-data safe on Debian?

Many PHP applications do self-configuration and self-updating. This requires apache to have write access to the PHP files. While chgrp'ing them all to www-data appears like a good practice to avoid ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
2
votes
1answer
167 views

Pass parameters to a script securely

What is the best way to pass parameters to a forked script securely? E. g. passing parameters through command line operands is not secure, since someone who has an account on the host can run ps and ...
2
votes
1answer
2k views

How do I login to SQL Server without having to use “Run as Administrator” when starting Management Studio, in Windows 7?

When I start Management Studio, unless I use the "Run as Administrator" selection, I cannot login to my local SQL Server. Is this normal? I am a normal developer and don't believe I have a need for ...
2
votes
2answers
192 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...
2
votes
6answers
1k views

Would you install phpmyadmin on a production web server?

I have been playing around with phpMyAdmin and I do think that it is a good tool, but I have read a lot on the internet about security holes. Would you recomend installing/using phpMyAdmin on a ...
2
votes
4answers
16k views

SSL - how to make both http and https work

I have set up a Drupal 6 site on a dedicated server, and enabled SSL through the "Matrix" control panel which was installed on it. The problem is now, the site ONLY loads pages from https. Most of ...
2
votes
1answer
6k views

How to mount external vfat drive as user?

I have a mountpoint /mnt/v1 and a user bak in group bak. I did this: sudo chown bak:bak /mnt/v1 sudo chmod 775 /mnt/v1 Now I want to mount an external fat32 drive with partition /dev/sdb1 to this ...
2
votes
5answers
10k views

Is IPSec the only way to encrypt Microsoft SMB (CIFS) traffic?

I'm looking for ways to encrypt Microsoft SMB data traffic between a client and Windows server or filer appliance. This is not about encrypting the authentication but the actual data transfer. Is ...
2
votes
3answers
453 views

Do I need to deploy antivirus and anti-spyware software to all the PCs on my network?

I am already using antivirus on all our PCs, and, of course, we're behind a firewall. Does anti-spyware software like adaware still provide an additional benefit, or does modern antivirus/firewall ...
1
vote
2answers
410 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
1
vote
1answer
666 views

AWS: network ACL blocks outbound traffic

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using ...
1
vote
3answers
193 views

What consequences to take from what i read in logfiles?

Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs. Where can i get information on when i have to act ...