Security is not a product, but a process.

learn more… | top users | synonyms (2)

8
votes
1answer
1k views

Why is “AcceptEnv *” considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
8
votes
4answers
3k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
8
votes
4answers
5k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
8
votes
4answers
1k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
8
votes
1answer
382 views

Who do I report a hacked server to?

This server http://62.193.248.163/ is used to hack Trixbox 2.6 PBX's. I can't tell if this server is a customers of http://www.amenworld.com/, or is it is actually one of theirs? Who should I report ...
8
votes
3answers
1k views

Should I create a new private ssh key on each system?

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the ...
8
votes
2answers
886 views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
8
votes
2answers
1k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
2answers
2k views

How safe are Unattended Upgrades/Automatic Updates for Ubuntu

I'm in the process of trying to keep several ubuntu box's up to date and patched (10.4.2 LTS), one suggestion I've been getting is setting up unattended upgrades ...
8
votes
5answers
795 views

Web Based (and Encrypted) Password/License/Etc Database

Looking for a system to store the many credentials I use as a consultant/contract programmer. While I know I could use KeePass or similar for desktop use, or something like PassPack for web based ...
8
votes
2answers
245 views

Dealing with SMTP invalid command attack

One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands. In the past two days: incoming smtp ...
8
votes
1answer
2k views

Is LXC secure enough for VPS hosting?

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ ...
8
votes
2answers
4k views

How secure is Remote Desktop Connection?

When using Remote Desktop Connection, is the information being sent back and forth securely, as in SSL? Are usernames and passwords secure? When connecting to a remote server through Remote Desktop ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
8
votes
2answers
875 views

Automatically Applying Security Updates for AWS Elastic Beanstalk

I've been a fan of Heroku since it's earliest days. But I like the fact that AWS Elastic Beanstalk gives you more control over the characteristics of the instances. One thing I love about Heroku is ...
8
votes
3answers
891 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
8
votes
2answers
880 views

Is there a way to force all cPanel users to change their passwords one time?

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password ...
7
votes
3answers
10k views

Why won't automatic login through ssh with authorized_keys work?

I have created a private/public dsa-keypair. I've put the public key on the server in ~/.ssh/authorized_keys Everything is set up like my other server, but it seems like the server is just ...
7
votes
5answers
2k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
7
votes
9answers
4k views

How To Disable Responses To PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to ping, how do I do that?
7
votes
7answers
588 views

Securing WordPress Blog Installation

Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?
7
votes
2answers
907 views

Linux 'runas' equivalent

my company has multiple domains and I log into my local machine with one set of credentials, but often when accessing certain network resources I need to use a different set of credentials. In Windows ...
7
votes
7answers
4k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
7
votes
6answers
283 views

Are Anonymized Usernames necessary?

Our security manager insists that we should use anonymized usernames. E.g. for a user named John Doe his username would be 'g74h19' instead of something like 'jdoe'. We already have a policy that ...
7
votes
8answers
3k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
7
votes
7answers
591 views

Why are we advised to not log into SSH as Root [duplicate]

Possible Duplicate: Why shouldn't root be allowed to login via ssh? Hi, Why is it safer to not log in as root via SSH? Since the login is SSH protected the root password is not in plain ...
7
votes
4answers
260 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
7
votes
3answers
6k views

How to disabled password authentication for specific users in SSHD

I have read several posts regarding restricting ALL users to Key authentication ONLY, however I want to force only a single user (svn) onto Key auth only, the rest can be key or password. I read How ...
7
votes
3answers
15k views

Enable downloads and disable IE ESC on Windows Server 2008 (and R2)?

How can I enable downloads for Windows Server 2008? By default when I try to download something with internet explorer the download is blocked.
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
3answers
1k views

Running a webserver behind a firewall, is it secure?

Currently we have a Linux-based firewall which NAT-ing our public IP address to give internet access to our staff's PCs and a Windows Server 2003 for internal filesharing. I want to host Redmine/SVN ...
7
votes
6answers
3k views

Truecrypt: File vs Device hosted encryption

TrueCrypt allows the user to create an encryption volume on a file or a device hosted encryption on a drive or partition.What is advantage or disadvantage of one over the other?
7
votes
7answers
485 views

Keeping up with security

After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the ...
7
votes
2answers
522 views

/dev/shm & /proc hardening

I've seen mention of securing /dev/shm and /proc and I was wondering how you do that and what it consists of doing? I assume this involves /etc/sysctl.conf editing of some kind right. Like these? ...
7
votes
3answers
3k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
4answers
16k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
7
votes
4answers
1k views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
7
votes
4answers
284 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
7
votes
5answers
832 views

Why would sshd allow root logins by default?

I'm currently working on hardening my servers against hacking- amongst other things, i'm getting a load of attempts to log on as root over ssh. While i've implemented fail2ban, i'm wondering, why root ...
7
votes
5answers
1k views

Web Server Security Overkill?

I've been doing "extensive" research on securing a linux web server. On top of what is considered the "basics" (removing unused services, hardening ssh, iptables, etc.) is it wise to include ...
7
votes
4answers
3k views

Does using SSL cause a significant performance hit?

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also ...
7
votes
5answers
405 views

I have about 20 servers…how do I manage the SSH keys and permissions of each?

I have database servers, web servers, SVN servers, etc. Often times I ssh among them...or they auto-ssh. How do I manage what server gets to log into which others?
7
votes
2answers
13k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
7
votes
5answers
277 views

Modern security awareness campaigns

I'm looking for different ways to do security awareness for 'normal' users. As they usually have not much attention span and not a single bit of interest on the subject, they usual formal means of ...
7
votes
3answers
373 views

Searching nearly free Security-Solution for School-Computer-Network

I am currently searching a (if possible completely free security-solution for a Computer-Network of a really small private School in the USA. The Infrastructure: Currently the school has one Server ...
7
votes
3answers
417 views

We are transitioning from shared root password to using sudo. How do I audit usage of sudo?

When I came on board, all our SAs had to memorize the root password to the systems. I felt that this was cumbersome (when someone separates from the company, we had to touch every server and change ...
7
votes
2answers
680 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
4answers
5k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...