Security is not a product, but a process.

learn more… | top users | synonyms (1)

8
votes
3answers
14k views

Why won't automatic login through ssh with authorized_keys work?

I have created a private/public dsa-keypair. I've put the public key on the server in ~/.ssh/authorized_keys Everything is set up like my other server, but it seems like the server is just ...
8
votes
9answers
4k views

What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?

Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
8
votes
9answers
4k views

Who can eavesdrop on a user's HTTP traffic?

I have heard many times that HTTPS should be used for transferring private data, since HTTP is vulnerable to eavesdroppers. But in practical terms, just who is capable of eavesdropping on a given ...
8
votes
6answers
585 views

First time opening an SSH server to internet, what to check

I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it). ...
8
votes
13answers
7k views

How do I stop Ubuntu from starting daemons I've not explicitly asked to run?

One of the basic principles of computer security is never to run anything you don't need. I was pgrepping for a process today when I noticed that my Ubuntu 9.04 (desktop) machine was running a git ...
8
votes
7answers
5k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
8
votes
4answers
612 views

How can I fake port 22 when I made sshd listen to another port?

Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what ...
8
votes
3answers
615 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
8
votes
8answers
427 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
3answers
4k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
8
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
8
votes
2answers
4k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...
8
votes
5answers
388 views

Is setting a very strong password enough to secure an SSH on port 22?

Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols ...
8
votes
5answers
628 views

Is open id secure?

Is open ID secure, for example can you use it to log into bank accounts?
8
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
8
votes
5answers
1k views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
8
votes
5answers
24k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
8
votes
5answers
1k views

Using gmail as your primary mail server

I have read that there is an option of using Gmail as your primary mail server. In the sense that you can add mx records etc and you do not have to do it on your own server. Do you think this is a ...
8
votes
6answers
8k views

Is it possible to create your own root DNS server?

I'm curious. I keep reading about how our ISPs and internet middle men record and keep track of all DNS requests basically leaving a trail of breadcrumbs in many logs, and also allowing DNS hijacking ...
8
votes
5answers
287 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
8
votes
5answers
395 views

How good/safe are disk to disk backups?

In the good old days, backups went to tapes, some of which were often offline if not offsite. This made it difficult to destroy all backups (accidentally or maliciously), especially if the ...
8
votes
3answers
12k views

Failed to generate a user instance of SQL Server

I'm using Windows 7 Beta and trying to install a web application locally. This web site uses Microsoft SQL Server 2005 Express (SQLEXPRESS) and a MDB file in the web site's ~/App_Data folder. I was ...
8
votes
8answers
460 views

What do you do to protect company-confidential data on laptops?

There usually is a lot to do about the security of servers since a lot of sensitive information is stored there but I think it's more important to make sure the company-laptops (and USB-Sticks) are ...
8
votes
1answer
3k views

How do I check that a user password is locked?

I used: usermod -L myUser to disable the password for this account. Assuming that I don't know the password how do I check that it has been disabled. According to the man page it places ! in ...
8
votes
1answer
2k views

Only allow password authentication to SSH server from internal network

I have an OpenSSH 5.9p1 server running on Ubuntu Precise 12.04 which accepts connections from both the internal network and the Internet. I'd like to require public key authentication for connections ...
8
votes
1answer
7k views

What should be the persmissions of apache ssl folder

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: 1) /etc/apache2/ssl folder 2) /etc/apache2/ssl/cert.pem file 3) ...
8
votes
5answers
1k views

Is it risky to have a database server and a web server on the same machine?

It seems like life would be simple to run the database server on the same machine as the web server, but are we taking a big secuirty risk by doing this? The environment will be Windows 2008 server, ...
8
votes
6answers
484 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
8
votes
5answers
309 views

Modern security awareness campaigns

I'm looking for different ways to do security awareness for 'normal' users. As they usually have not much attention span and not a single bit of interest on the subject, they usual formal means of ...
8
votes
3answers
4k views

Configure SSH to allow port forwarding but no commands for particular key?

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?
8
votes
4answers
339 views

Paranoid Sysadmin -vs- Out-of-Date PHP version

How can a paranoid sysadmin confidently stay up-to-date with the latest stable PHP versions? (security fixes have been coming in pretty regularly). This is a Production server, and so "breaking ...
8
votes
4answers
713 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
5answers
6k views

OSX - Full Disk Encryption [closed]

What options are available for OSX full disk encryption? Which of them is the best?
8
votes
2answers
623 views

What the heck is really going on in these Lion LDAP vulnerability reports?

Just read a Slashdot thread on LDAP brokenness on OSX. Can anyone explain exactly what is being secured by OpenLDAP and why anything other than data stored on a Lion machine might be at risk? A quote ...
8
votes
4answers
345 views

Who gets root access?

I'm working on a web application which handles some sensitive data. We're getting pretty tight on security, and laying out policies to lock down access to machines, and log everything for technical ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
8
votes
2answers
19k views

HOWTO: Disable complex password policy on Hyper-V Server 2008?

How do you disable the password complexity requirements on a Microsoft Hyper-V Server 2008 R2? Keep in mind that when you log into the server, the only UI you have is: And you cannot run ...
8
votes
3answers
5k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
8
votes
4answers
4k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
8
votes
4answers
4k views

Use standard USB flash disk as security token

We want our users in company to login their computers by using their USB Flash Disks or something else. Is there a way to achieve this without buying a USB token from a company ?
8
votes
1answer
183 views

Restricted shell for managing files and git repositories

Think about a web hosting company that wants to let users manage files and git repositories via ssh. This includes: secure copy (scp) creating, copying, moving/renaming and deleting files executing ...
8
votes
2answers
1k views

Can the msdeploy agent service open up an attack vector on our servers?

we're evaluating the usage of the msdeploy Web Deployment Agent Service for automatic deployments to our production servers. One thing we can't find out about are potential security impacts. For one ...
8
votes
1answer
12k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS ...
8
votes
4answers
6k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
8
votes
4answers
2k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
8
votes
1answer
397 views

Who do I report a hacked server to?

This server http://62.193.248.163/ is used to hack Trixbox 2.6 PBX's. I can't tell if this server is a customers of http://www.amenworld.com/, or is it is actually one of theirs? Who should I report ...
8
votes
2answers
2k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
2answers
2k views

When should I create a new user account to run software on a server?

In general, when should one create a new user account to run a piece of internet-facing software on a server? For instance, suppose I'm using a shared Debian server (e.g. via Dreamhost) and I want to ...
8
votes
3answers
2k views

Should I create a new private ssh key on each system?

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the ...
8
votes
2answers
320 views

Dealing with SMTP invalid command attack

One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands. In the past two days: incoming smtp ...