Security is not a product, but a process.

learn more… | top users | synonyms (2)

8
votes
1answer
11k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
8
votes
6answers
630 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
8
votes
3answers
4k views

Configure SSH to allow port forwarding but no commands for particular key?

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?
8
votes
4answers
673 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
5answers
5k views

OSX - Full Disk Encryption [closed]

What options are available for OSX full disk encryption? Which of them is the best?
8
votes
2answers
616 views

What the heck is really going on in these Lion LDAP vulnerability reports?

Just read a Slashdot thread on LDAP brokenness on OSX. Can anyone explain exactly what is being secured by OpenLDAP and why anything other than data stored on a Lion machine might be at risk? A quote ...
8
votes
4answers
344 views

Who gets root access?

I'm working on a web application which handles some sensitive data. We're getting pretty tight on security, and laying out policies to lock down access to machines, and log everything for technical ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
8
votes
3answers
1k views

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...). None is reachable from outside specific ...
8
votes
4answers
3k views

Use standard USB flash disk as security token

We want our users in company to login their computers by using their USB Flash Disks or something else. Is there a way to achieve this without buying a USB token from a company ?
8
votes
1answer
122 views

Restricted shell for managing files and git repositories

Think about a web hosting company that wants to let users manage files and git repositories via ssh. This includes: secure copy (scp) creating, copying, moving/renaming and deleting files executing ...
8
votes
4answers
4k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
8
votes
3answers
948 views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
8
votes
4answers
5k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
8
votes
4answers
1k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
8
votes
1answer
388 views

Who do I report a hacked server to?

This server http://62.193.248.163/ is used to hack Trixbox 2.6 PBX's. I can't tell if this server is a customers of http://www.amenworld.com/, or is it is actually one of theirs? Who should I report ...
8
votes
3answers
1k views

Should I create a new private ssh key on each system?

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the ...
8
votes
2answers
1k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
2answers
2k views

How safe are Unattended Upgrades/Automatic Updates for Ubuntu

I'm in the process of trying to keep several ubuntu box's up to date and patched (10.4.2 LTS), one suggestion I've been getting is setting up unattended upgrades ...
8
votes
2answers
263 views

Dealing with SMTP invalid command attack

One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands. In the past two days: incoming smtp ...
8
votes
1answer
2k views

Is LXC secure enough for VPS hosting?

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ ...
8
votes
2answers
4k views

How secure is Remote Desktop Connection?

When using Remote Desktop Connection, is the information being sent back and forth securely, as in SSL? Are usernames and passwords secure? When connecting to a remote server through Remote Desktop ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
8
votes
3answers
1k views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
8
votes
3answers
5k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
8
votes
2answers
991 views

Is there a way to force all cPanel users to change their passwords one time?

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password ...
7
votes
5answers
2k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
7
votes
9answers
5k views

How To Disable Responses To PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to ping, how do I do that?
7
votes
7answers
590 views

Securing WordPress Blog Installation

Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?
7
votes
2answers
984 views

Linux 'runas' equivalent

my company has multiple domains and I log into my local machine with one set of credentials, but often when accessing certain network resources I need to use a different set of credentials. In Windows ...
7
votes
7answers
4k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
7
votes
6answers
287 views

Are Anonymized Usernames necessary?

Our security manager insists that we should use anonymized usernames. E.g. for a user named John Doe his username would be 'g74h19' instead of something like 'jdoe'. We already have a policy that ...
7
votes
6answers
596 views

Why are we advised to not log into SSH as Root [duplicate]

Possible Duplicate: Why shouldn't root be allowed to login via ssh? Hi, Why is it safer to not log in as root via SSH? Since the login is SSH protected the root password is not in plain ...
7
votes
8answers
3k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
7
votes
4answers
263 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
7
votes
3answers
7k views

How to disabled password authentication for specific users in SSHD

I have read several posts regarding restricting ALL users to Key authentication ONLY, however I want to force only a single user (svn) onto Key auth only, the rest can be key or password. I read How ...
7
votes
3answers
18k views

Enable downloads and disable IE ESC on Windows Server 2008 (and R2)?

How can I enable downloads for Windows Server 2008? By default when I try to download something with internet explorer the download is blocked.
7
votes
6answers
1k views

Securing Active Directory domains on a potentially hostile network

Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network. In an environment with externally facing ...
7
votes
3answers
2k views

Running a webserver behind a firewall, is it secure?

Currently we have a Linux-based firewall which NAT-ing our public IP address to give internet access to our staff's PCs and a Windows Server 2003 for internal filesharing. I want to host Redmine/SVN ...
7
votes
6answers
4k views

Monitor the shell activity of a user on your Unix system?

Trust, but verify. Let's say I want to hire someone a sysadmin, and give them root access to my Unix system. I want to disable X windows for them, only allow shell usage (through SSH, maybe), so that ...
7
votes
6answers
3k views

Truecrypt: File vs Device hosted encryption

TrueCrypt allows the user to create an encryption volume on a file or a device hosted encryption on a drive or partition.What is advantage or disadvantage of one over the other?
7
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
7
votes
4answers
19k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
7
votes
2answers
607 views

/dev/shm & /proc hardening

I've seen mention of securing /dev/shm and /proc and I was wondering how you do that and what it consists of doing? I assume this involves /etc/sysctl.conf editing of some kind right. Like these? ...
7
votes
3answers
3k views

Where do I store sensitive data within Active Directory?

I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory. My question is, what attribute is secure by default and makes sense to keep private data ...
7
votes
4answers
1k views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
7
votes
4answers
291 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
7
votes
5answers
852 views

Why would sshd allow root logins by default?

I'm currently working on hardening my servers against hacking- amongst other things, i'm getting a load of attempts to log on as root over ssh. While i've implemented fail2ban, i'm wondering, why root ...