Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
4answers
2k views

Alternative to IBM WebSphere DataPower XML Security Gateway XS40

Is there any alternative to this IBM solution for a SOAP security gateway? Maybe open source software or hardware from other vendors?
0
votes
4answers
2k views

What firewall rules should be used for a home based system [closed]

I'm just setting up a home wireless network with connection to the internet. The router has settings to configure the firewall rules. Currently it's set to INBOUND ALL ANY and OUTBOUND ALL ANY. ...
-1
votes
3answers
285 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
11
votes
1answer
3k views

Enable blowfish-based hash support for crypt

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server? I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH. As far as ...
8
votes
4answers
961 views

Why running named(bind) in chroot is so important for security? Or maybe it is not ?

I'm playing with bind and started wondering why this software is for example in CentOS running in chroot. Don't misunderstood me I know what bind is and what chroot (jail) is for. But my main wonder ...
7
votes
4answers
5k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
6
votes
5answers
300 views

Kids + older computers + our network at the office: Security risk?

On occasion, some of my coworkers feel compelled to bring their children to work with them. (I feel compelled to smack them, but that's probably a topic for Parenting.SE.) To ensure that the ...
6
votes
2answers
5k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
6
votes
13answers
2k views

Mysterious html inserted into my site's pages (hacked?)

Twice, I've found weird code the top of my index.php. The first time, it was this: <iframe src="http://ntwportal.com/" width="2" height="4"></iframe> Then this: <iframe ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
6
votes
2answers
2k views

Virtual host on LAN - VMs on DMZ, separate NICs - is this a bad idea?

Just kicking this idea around, and wanted to see if you'll be so kind as to point out the problems I don't see. If I set up this new HyperV host as a normal domain member, the benefits are obvious. ...
5
votes
2answers
1k views

Is it ok to leave the MySQL root password blank?

Does a root user without a password constitute a security breach if my MySQL server only accepts connections from localhost? I'm aware that the common wisdom says the root user should be protected by ...
5
votes
1answer
960 views

Possible to limit an EC2 key to just ec2-associate-address?

I have a regular EC2 instance with an elastic IP. The few times the instance has been stopped, I've just manually re-associated the IP with it via the AWS Management console. I'm now thinking about ...
5
votes
5answers
492 views

If I use ftp or telnet by accident, to what extent is my password unsafe?

if i use ftp or telnet by accident (usually on the bash shell), to what extend is my password visible? can my coworker see it? can my neighbor see it if i work at home (if not using wireless)? can ...
4
votes
7answers
533 views

Configure a “hardened” user account that an attacker would have a hard time abusing

Suppose you have a Windows Server machine running various sensitive services. Suppose that one of these services is pretty simple, maintaining a small amount of information in a text file, but as a ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
4
votes
1answer
604 views

Get SSH fingerprint from remote server securely?

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home. Is there any other ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
4
votes
2answers
14k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
4
votes
4answers
4k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
3answers
3k views

Hosting multiple repositories, each with differing access control

We will need to host a series of Mercurial repositories. For security, we will use SSL encryption in Apache and htpasswd access (required). I tested out a single repository and used hgwebdir.cgi and ...
3
votes
1answer
272 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
3
votes
2answers
957 views

Does adding an user to the apache group creates a security hole?

Beginner question. I saw this mentioned on a website, considered a bad practice,but can't remember where and why. So, if I have an user which has access to files that Apache shouldn't have access, and ...
3
votes
2answers
1k views

Securing PHP via open_basedir based on script path

I have several users running PHP scripts on a server and I'd like to lock it down so that their scripts can only access files in their www directory (it doesn't use linux user accounts, so there isn't ...
3
votes
3answers
945 views

CentOS PCI Compliance assessment

We are currently working our way through a PCI compliance assessment on our server running CentOS. We are getting a lot of 'severe' issues with suggested fixes. The suggestions to rectify the issues ...
3
votes
5answers
3k views

Apache DDoS Protection in router (pFsense) [duplicate]

I'm soon going to change my infrastructure when I buy a new server. I'm going to replace my D-Link DIR-655 router with an pFsense router (and probably use the 655 as an AP) using my old server ...
3
votes
1answer
13k views

Best practices for hardening/locking down Windows Server 2008 R2 for use as web server?

What actions should be taken to 'lock-down'/harden/secure a windows server 2008 R2 machine, when used as a web server (with remote desktop access)? Are there any elements that are enabled as standard ...
3
votes
3answers
374 views

Looking for a way to audit/monitor removable media on a Mac

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her ...
3
votes
2answers
4k views

Plesk HTTPS setup and directory problems

We are trying to configure ssl for one of our domains hosted on a Red Hat server running Plesk. Plesk version: 9.5.2 Apache: 2.2.3 Redhat: 2.6.18-194.el5 We created a new SSL certificate entry ...
3
votes
3answers
10k views

Domain User can RDP into Domain Controller?

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
3
votes
3answers
2k views

How to encrypt traffic between two Amazon EC2 instances?

We are building a web app using Amazon EC2 instances running Linux. All the traffic to the client browser is encrypted with SSL. What should be used to encrypt the traffic between the instances. The ...
3
votes
1answer
766 views

Will you allow NetBIOS into your DMZ?

Is it secure for a firewall to allow NetBIOS connections from the internal network to the DMZ? If not secure, what are the risks? If secure, what is the FUD about and what are the counterarguments? ...
3
votes
7answers
291 views

Secure Formatting Disks

I heard about people that used tools to recover deleted data and found a lot of unusual data, that after discovered that the their brand new pc in truth was used... When discarding HD's, as sysadmin, ...
2
votes
1answer
159 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
2
votes
1answer
2k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
2
votes
1answer
742 views

Removing port forwardings programmatically on a ControlMaster SSH session

Quite a while ago I got an answer telling me how to add a port-forwarding on a running SSH ControlMaster process. To know that helps a lot, but I'm still missing a way to remove such a port forwarding ...
2
votes
3answers
945 views

Which services to disable on a CentOs 5.8 web/database server?

I have just setup my CentOS 5.8 64 [final] server as a webserver. Specs: 2x E5620 Intel CPU, DDR3 RAM, Hardware Adaptec RAID 10, 4x SAS drives. I have installed myself: Nginx PHP-FPM MySQL ...
2
votes
1answer
2k views

Is there an easy way to check SSL cipher preference from the command-line?

CentOS 5.x I want to confirm which SSL ciphers are supported and preferred on my web server. Is there an easy way to do this WITHOUT using third-party audit software/equipment? I was hoping for ...
2
votes
2answers
7k views

How does the Task Scheduler save passwords on Windows 7?

If I save a password for a scheduled task, or in a service's logon credentials, is it safe? It seems to me that Windows saves this password encrypted somehow, but since Windows has to decipher it, so ...
2
votes
1answer
1k views

Client-side certificates (Apache, Linux, OpenSSL)

My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works. Now I'm required to ...
2
votes
1answer
150 views

Why restricting Apache users from executing scripts?

When Apache users are allowed to executes bash scripts via PHP - why it's considered dangerous? I understand that the users can traverse the whole file system and even see which additional users are ...
2
votes
4answers
4k views

How can I run a process as “NT Authority\NetworkService”?

I'm toying with an idea for a script that would update a computer's details in Active directory with its make and model information. Ideally, I'd like this script to access AD via its computer ...
2
votes
3answers
2k views

when to use IPSec in Windows AD domain?

As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords). Now, I read (in non-English ...
2
votes
2answers
4k views

Is adding users to the group www-data safe on Debian?

Many PHP applications do self-configuration and self-updating. This requires apache to have write access to the PHP files. While chgrp'ing them all to www-data appears like a good practice to avoid ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
2
votes
1answer
171 views

Pass parameters to a script securely

What is the best way to pass parameters to a forked script securely? E. g. passing parameters through command line operands is not secure, since someone who has an account on the host can run ps and ...
2
votes
1answer
2k views

How do I login to SQL Server without having to use “Run as Administrator” when starting Management Studio, in Windows 7?

When I start Management Studio, unless I use the "Run as Administrator" selection, I cannot login to my local SQL Server. Is this normal? I am a normal developer and don't believe I have a need for ...
2
votes
2answers
193 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...
2
votes
6answers
2k views

Would you install phpmyadmin on a production web server?

I have been playing around with phpMyAdmin and I do think that it is a good tool, but I have read a lot on the internet about security holes. Would you recomend installing/using phpMyAdmin on a ...