Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
14 votes
2 answers
11k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the designation ...
Jason Owen's user avatar
14 votes
3 answers
42k views

The difference between /etc/pam.d/login and /etc/pam.d/system-auth?

I want to configure securetty to limit root directly access. Now I am clear if I add: auth required pam_securetty.so into /etc/pam.d/system-auth, and keep only "console" in /etc/...
zhaojing's user avatar
  • 195
14 votes
1 answer
3k views

AD Administrator account logon mystery - last logon timestamp

We've found the domain Administrator account - which we do not use except in the event of a disaster recovery scenario - has a recent date in the LastLogonTimeStamp attribute. As far as I am aware, no-...
LeeM's user avatar
  • 1,423
14 votes
1 answer
30k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS 7....
Nicolas Dorier's user avatar
14 votes
3 answers
3k views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
Brandon Moore's user avatar
14 votes
2 answers
16k views

Why is "AcceptEnv *" considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
TheDauthi's user avatar
  • 143
14 votes
2 answers
5k views

How safe are Unattended Upgrades/Automatic Updates for Ubuntu

I'm in the process of trying to keep several ubuntu box's up to date and patched (10.4.2 LTS), one suggestion I've been getting is setting up unattended upgrades (https://help.ubuntu.com/community/...
Pratik Amin's user avatar
  • 3,313
14 votes
5 answers
16k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
gpo1278's user avatar
  • 141
14 votes
1 answer
16k views

How to install multiple Intermediate CA Certificate files on Apache?

I just bought a SSL certificate, and here are all the certificate files i got: Root CA Certificate - xxCARoot.crt Intermediate CA Certificate - x1.crt Intermediate CA Certificate - x2.crt ...
pdeva's user avatar
  • 2,517
14 votes
1 answer
14k views

WEP/WPA/WPA2 and wifi sniffing

I know that WEP traffic can be "sniffed" by any user of the WIFI. I know that WPA/WPA2 traffic is encrypted using a different link key for each user, so they can't sniff traffic... unless they ...
jcea's user avatar
  • 263
14 votes
1 answer
6k views

Enable blowfish-based hash support for crypt

How do I enable crypt_blowfish support for shadowed passwords and PHP on a Linux (Debian) server? I'm referring to the OpenBSD-style Blowfish-based bcrypt, known in PHP as CRYPT_BLOWFISH. As far as ...
Jacco's user avatar
  • 377
14 votes
2 answers
8k views

SELinux vs. AppArmor vs. grsecurity [closed]

I have to set up a server that should be as secure as possible. Which security enhancement would you use and why, SELinux, AppArmor or grsecurity? Can you give me some tips, hints, pros/cons for those ...
user avatar
14 votes
4 answers
35k views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my syslog....
aef's user avatar
  • 1,755
13 votes
17 answers
3k views

What are the arguments for and against a network policy where the sys admin knows users passwords? [closed]

I'd like to know pros and cons.. reasons for and against the idea of sys admin’s maintaining user account lists with passwords.. and additionally not allowing those users to change their passwords. I ...
cottsak's user avatar
  • 515
13 votes
5 answers
4k views

Does Linux really need Anti-Virus (other than hosted file scanning)

A large company is doing a review of our software before they will use the web software built by our start-up company. We are using Linux to host, which is properly secured and hardened. The ...
romaninsh's user avatar
  • 438
13 votes
23 answers
2k views

Is being paranoid a required 'quality' for Sys/Net administrators?

Is being Paranoid considered an (unspoken) 'requirement' for a Sys/Net admin to have (obviously for security reasons)? Is there such a thing as being overly paranoid?, or should we be trustful of ...
13 votes
7 answers
19k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
Leo's user avatar
  • 1,048
13 votes
7 answers
3k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
giomanda's user avatar
  • 1,824
13 votes
3 answers
8k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
Sergey Serov's user avatar
13 votes
11 answers
7k views

questionable timeservers in pool.ntp.org?

I've noticed that, after changing the reg settings outlined in Episode 52 of the Stack Overflow podcast to pool.ntp.org, my box keeps requesting time from gordo.foofus.net. The web site hosted on that ...
John's user avatar
  • 139
13 votes
4 answers
14k views

Can a virtual machine (VM) "hack" another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
Totor's user avatar
  • 2,996
13 votes
6 answers
21k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
artifex's user avatar
  • 1,644
13 votes
13 answers
4k views

Password expiration policies [closed]

Having just received an email from a supplier informing us that they would be forcing us to change our password every six months, I'm curious to see what password expiration policies people use and ...
David Pashley's user avatar
13 votes
14 answers
145k views

How to securely join two networks together over the Internet?

Let's say there are two locations. Both locations have their own fast Internet connections. How do you join these two networks together such that every computer can see every other computer? Do you ...
Pyrolistical's user avatar
13 votes
3 answers
13k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
AtomicPorkchop's user avatar
13 votes
3 answers
4k views

Should you encrypt data between 2 servers in the cloud?

If I have several AWS EC2 and azure instances running on separate regions. I am using rabbitmq to exchange messages between them. Should I worry about adding TLS and encrypting those connections? In ...
Tono Nam's user avatar
  • 322
13 votes
7 answers
4k views

Write-only remote backup solutions to prevent backup deletion by hackers [closed]

Consider this scenario: I have linux server which is automatically backed up daily to some remote location via rsync or something like this. Everything is fine until some bad guy gains access to ...
Valentin Nemcev's user avatar
13 votes
4 answers
16k views

can localhost be spoofed?

Is it possible for a remote machine to access another machine's localhost data by spoofing the loopback ip? Say if I wanted a setup where if I'm connecting from somewhere outside my own network, I ...
bee.catt's user avatar
  • 235
13 votes
8 answers
52k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
Alex's user avatar
  • 237
13 votes
4 answers
534 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
lajuette's user avatar
  • 771
13 votes
4 answers
2k views

How do I deal with the removal/eradication of an unknown worm on our network?

TL;DR I'm pretty sure our small network has been infected by some sort of worm/virus. It seems to only be afflicting our Windows XP machines, however. Windows 7 machines and Linux (well, yea) ...
Mr. Shickadance's user avatar
13 votes
7 answers
39k views

Why would you use EAP-TTLS instead of PEAP?

As I understood EAP-TTLS and PEAP share same level of security when implemented in wireless networks. Both only provide server side authentication via certificate. The drawback of EAP-TTLS can be ...
Ivan Macek's user avatar
13 votes
7 answers
20k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% %...
poke's user avatar
  • 1,079
13 votes
11 answers
6k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
George's user avatar
  • 293
13 votes
4 answers
449 views

Suspected server or data vulnerability and reporting a fraud site

Two days ago someone created a website that has the exact same domain of the company I work for, but missing one letter, and sent a mail campaign to many people that there is a promotion on the ...
mpcabd's user avatar
  • 233
13 votes
1 answer
29k views

Security risks of PermitUserEnvironment in ssh

I've read quite a few posts regarding the use of PermitUserEnvironment and the file ~/.ssh/environment in order to pass env variables to an ssh shell. The official sshd docs and a few other resources ...
Rob Squires's user avatar
13 votes
3 answers
19k views

What is the rationale for a minimum password age?

I just had a user unable to change his password on a Windows 2008 domain. It was giving him a cryptic message about complexity requirements even though he was certain his chosen password was meeting ...
Deep Thought's user avatar
  • 1,628
13 votes
3 answers
6k views

How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?

When a virtual machine Linux host server is non-Internet facing and is used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off ...
ylluminate's user avatar
  • 1,197
13 votes
1 answer
16k views

Why use lxc instead of chroot?

One ubuntu server hosts 3 apps all on separate domains. Each app has its own developers. App developers belong to linux "sftp" group. chroot allows password sftp access for each app developer. /home/...
csi's user avatar
  • 1,575
13 votes
3 answers
19k views

Isolating Apache virtualhosts from the rest of the system

I am setting up a web server that will host a number of different web sites as Apache VirtualHosts, each of these will have the possibility to run scripts (primarily PHP, possiblu others). My ...
JesperB's user avatar
  • 233
13 votes
3 answers
12k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
makerofthings7's user avatar
13 votes
3 answers
4k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
kmarsh's user avatar
  • 3,123
13 votes
2 answers
28k views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
Blackclaws's user avatar
13 votes
1 answer
57k views

How can I query for all selinux rules/default file contexts/etc affecting a type

I need to know everything related to a selinux type on a running system's current rules: allow, allowaudit, dontaudit rules. files labeled with a context using the type. transitions. ...and any ...
Yanko Hernández Álvarez's user avatar
13 votes
1 answer
5k views

Windows secure file copy between servers

I have looked a bunch of questions on here somewhat related to what Im trying to do. Maybe windows has just not gotten on the security train yet. Im not trying to use sftp, or WinSCP or SSH ...
Anthony Fornito's user avatar
13 votes
1 answer
1k views

"Hostile" network in the company - please comment on a security setup

I have a little specific problem here that I want (need) to solve in a satisfactory way. My company has multiple (IPv4) networks that are controlled by our router sitting in the middle. Typical ...
TomTom's user avatar
  • 51.9k
13 votes
5 answers
86k views

How can I find all of the domain names owned by a company? [closed]

What tools or techniques can I use to find all of the domain names owned by a company? A paper or guide would also be beneficial. I don't think there is one solution to this problem, so I'm curious ...
Rook's user avatar
  • 2,695
13 votes
4 answers
16k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
Max Schmeling's user avatar
13 votes
3 answers
11k views

Are Amazon EC2 Private IPs reachable from any instance running in EC2?

After searching previous questions here, the general consensus seems to be if an instance that I own is assigned a private IP of 10.208.34.55, that only OTHER INSTANCES I OWN can reach it at that ...
jberryman's user avatar
  • 924
13 votes
2 answers
4k views

Can the msdeploy agent service open up an attack vector on our servers?

we're evaluating the usage of the msdeploy Web Deployment Agent Service for automatic deployments to our production servers. One thing we can't find out about are potential security impacts. For one ...
Sebastian P.R. Gingter's user avatar

1
5 6
7
8 9
139