Security is not a product, but a process.

learn more… | top users | synonyms (1)

10
votes
3answers
780 views

piping a password and security

I sometimes do echo "secret" | mysql -u root -p .... Now I'm concerend about security here: can someone listing all processes see the password? To check I tried with echo "test" | sleep 1000 and the ...
10
votes
2answers
261 views

Should the virtualization host be allowed to run any service?

I recently setup a virtualization server for the small company I'm running. This server runs few virtual machines that are used for development, testing, etc... My business partner works from a ...
10
votes
6answers
721 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
10
votes
1answer
7k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
10
votes
4answers
610 views

Common PHP setup insecurity?

I work with the systems administration at a university and just stumbled across something which is probably common, but was quite a shock to me. All public_html directories and web areas are stored ...
10
votes
5answers
10k views

What steps should I take to secure Tomcat 6.x?

I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible. I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory ...
10
votes
3answers
3k views

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...). None is reachable from outside specific ...
10
votes
1answer
16k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
10
votes
6answers
422 views

What are the attack vectors for passwords sent over http?

I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
10
votes
2answers
4k views

Why is “AcceptEnv *” considered insecure?

In /etc/ssh/sshd_config, there is an option called AcceptEnv that allows the ssh client to send environment variables. I need to be able to send a large number of environment variables. These change ...
10
votes
2answers
14k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
10
votes
2answers
2k views

Can the msdeploy agent service open up an attack vector on our servers?

we're evaluating the usage of the msdeploy Web Deployment Agent Service for automatic deployments to our production servers. One thing we can't find out about are potential security impacts. For one ...
10
votes
2answers
4k views

How to Protect Sensitive (HIPAA) SQL Server Standard Data and Log Files

I am dealing with electronic protected health information (ePHI or PHI) and HIPAA regulations require that only authorized users can access ePHI. Column-level encryption may be of value for some of ...
10
votes
3answers
1k views

Website defaced, what can I do?

My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong? I mean what to look out for among all those ...
10
votes
2answers
6k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory (...
10
votes
2answers
5k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
10
votes
5answers
291 views

My site was recently attacked. What do I do?

This is a first for me. One of the sites I run was recently attacked. Not at all an intelligent attack - pure brute force - hit every page and every non-page with every extension possible. Posted ...
10
votes
1answer
314 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
10
votes
5answers
5k views

Why is /dev/urandom only readable by root since Ubuntu 12.04 and how can I “fix” it?

I used to work with Ubuntu 10.04 templates on a lot of servers. Since changing to 12.04 I have problems that I've now isolated. The /dev/urandom device is only accessible to root. This caused SSL ...
10
votes
6answers
1k views

How to choose a cloud service for backups

I am thinking of using a cloud service to backup one of my client's website. My (clients) main concerns are (in decreasing order of importance) Protection of IP (trade secrets, source code), user ...
10
votes
2answers
3k views

How did spammer spoof emails with my google apps domain (it even has DKIM!)

I have been getting a lot of bounce-backs lately. I thought my google apps account has been compromised, but there is no activity on my apps account, and there is certainly no malicious user that I ...
10
votes
3answers
645 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
10
votes
1answer
635 views

How do I audit user's mailbox actions performed via IMAP in Exchange 2010?

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access. I perform the following cmdlet to enable auditing of the owner: > Set-Mailbox -Identity "Mr....
9
votes
28answers
12k views

What is the most reliable way to send a zip file via email? [closed]

I often have clients email zip files to me only to find out that their corporate firewall has stripped the attached file. What is the most straight-forward way to send a compressed file through email ...
9
votes
7answers
7k views

How to disable responses to PING [closed]

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
9
votes
12answers
726 views

When I have to administrate an existing Linux server what's the best way to check if it is secure?

There are many tutorials on how to set up a new secured server. But what if I have to administrate a server someone else had set up some time ago and I don't know much about its configuration yet? ...
9
votes
8answers
9k views

How to secure phpmyadmin?

I checked out my apache logs, and, whooooaaa, there are a lot of bots trying to exploit phpmyadmin. The first thing i did was to change the directory name to something more obscure. But, are there ...
9
votes
6answers
517 views

Security Admins toolkit? What's in yours? [closed]

Resource question :- I need to collate a list of security admin tools For: Web Network Wifi Server unix/Linux/windows/macosx SQL Xss Please state -links/version/os used/free v buy
9
votes
15answers
4k views

How to manage rack keys?

As a result of a security audit there's the need to lock the racks and manage the keys: Keep the keys safe Record key usage Complying with these two requirements has many challenges as there are a ...
9
votes
10answers
13k views

Relatively easy way to block all traffic from a specific country?

I have a web app that has no users in the Philippines, but is constantly bombarded by spammers, carders testing cards, and other undesirable activity from there. I can see in the logs that they have ...
9
votes
3answers
7k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
9
votes
3answers
5k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
9
votes
3answers
516 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
4answers
2k views

When is it appropriate / prudent to use chroot?

I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
9
votes
8answers
18k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
9
votes
2answers
5k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...
9
votes
3answers
346 views

“Template” for handing out user & passwords for employees

Within this relatively small company I work for, I have been handing out usernames and passwords written very simply in a word document. I wish for this process to be more professional now that we ...
9
votes
2answers
22k views

HOWTO: Disable complex password policy on Hyper-V Server 2008?

How do you disable the password complexity requirements on a Microsoft Hyper-V Server 2008 R2? Keep in mind that when you log into the server, the only UI you have is: And you cannot run gpedit....
9
votes
2answers
316 views

Method to deprecate SSH key Pair locally

I've using my ssh-keys for a while. I'm thinking about to upgrade my ssh key pair to a stronger encryption and i dont know all devices where my keys are registered. Is it posible to "deprecate" a SSH ...
9
votes
1answer
17k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: https://...
9
votes
6answers
973 views

When/why to use a web proxy/gateway?

Right now we have about a 25-30 PC network, connected to the internet with a run-of-the-mill SonicWall Firewall/Router device. There isn't much filtering / blocking other than outgoing SMTP (for ...
9
votes
1answer
798 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
9
votes
6answers
6k views

How can I log users' bash commands?

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
9
votes
4answers
6k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
9
votes
4answers
7k views

How do you manage service account credentials (passwords)? [closed]

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
9
votes
1answer
112 views

Where and how is the password stored for the account associated with a Windows service?

In HKLM\SYSTEM\CurrentControlSet\Services\MY-SERVICE-NAME there is the Object Name key which contains the name of the user, but I can not find the password. I am trying to understand how DP API ...
9
votes
2answers
31k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
9
votes
1answer
7k views

How to install multiple Intermediate CA Certificate files on Apache?

I just bought a SSL certificate, and here are all the certificate files i got: Root CA Certificate - xxCARoot.crt Intermediate CA Certificate - x1.crt Intermediate CA Certificate - x2.crt ...
9
votes
2answers
564 views

Managing IAM security credentials for multiple docker containers

Within plain EC2 environment, managing access to other AWS resources is fairly straightforward with IAM roles and credentials (automatically fetched from instance metadata). Even easier with ...