Security is not a product, but a process.

learn more… | top users | synonyms (1)

8
votes
3answers
585 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
8
votes
8answers
426 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
3answers
2k views

How to tell if a public SSH key has a passphrase

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not? We have a situation where I am not generating the SSH keys for users, but I ...
8
votes
2answers
4k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...
8
votes
5answers
383 views

Is setting a very strong password enough to secure an SSH on port 22?

Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols ...
8
votes
5answers
627 views

Is open id secure?

Is open ID secure, for example can you use it to log into bank accounts?
8
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
8
votes
5answers
970 views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
8
votes
6answers
7k views

Is it possible to create your own root DNS server?

I'm curious. I keep reading about how our ISPs and internet middle men record and keep track of all DNS requests basically leaving a trail of breadcrumbs in many logs, and also allowing DNS hijacking ...
8
votes
5answers
1k views

Using gmail as your primary mail server

I have read that there is an option of using Gmail as your primary mail server. In the sense that you can add mx records etc and you do not have to do it on your own server. Do you think this is a ...
8
votes
4answers
22k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
8
votes
5answers
285 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...
8
votes
5answers
394 views

How good/safe are disk to disk backups?

In the good old days, backups went to tapes, some of which were often offline if not offsite. This made it difficult to destroy all backups (accidentally or maliciously), especially if the ...
8
votes
4answers
2k views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
8
votes
3answers
12k views

Failed to generate a user instance of SQL Server

I'm using Windows 7 Beta and trying to install a web application locally. This web site uses Microsoft SQL Server 2005 Express (SQLEXPRESS) and a MDB file in the web site's ~/App_Data folder. I was ...
8
votes
8answers
459 views

What do you do to protect company-confidential data on laptops?

There usually is a lot to do about the security of servers since a lot of sensitive information is stored there but I think it's more important to make sure the company-laptops (and USB-Sticks) are ...
8
votes
1answer
3k views

How do I check that a user password is locked?

I used: usermod -L myUser to disable the password for this account. Assuming that I don't know the password how do I check that it has been disabled. According to the man page it places ! in ...
8
votes
1answer
13k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
8
votes
5answers
1k views

Is it risky to have a database server and a web server on the same machine?

It seems like life would be simple to run the database server on the same machine as the web server, but are we taking a big secuirty risk by doing this? The environment will be Windows 2008 server, ...
8
votes
6answers
464 views

Why shouldn't root be allowed to login via ssh?

why should root access be disabled for ssh? I always hear that's for security reasons. But I don't get it. What's different to login as non-root and then sudo su -? What's the preferred way to handle ...
8
votes
3answers
4k views

Configure SSH to allow port forwarding but no commands for particular key?

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?
8
votes
4answers
334 views

Paranoid Sysadmin -vs- Out-of-Date PHP version

How can a paranoid sysadmin confidently stay up-to-date with the latest stable PHP versions? (security fixes have been coming in pretty regularly). This is a Production server, and so "breaking ...
8
votes
4answers
699 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
8
votes
5answers
5k views

OSX - Full Disk Encryption [closed]

What options are available for OSX full disk encryption? Which of them is the best?
8
votes
2answers
623 views

What the heck is really going on in these Lion LDAP vulnerability reports?

Just read a Slashdot thread on LDAP brokenness on OSX. Can anyone explain exactly what is being secured by OpenLDAP and why anything other than data stored on a Lion machine might be at risk? A quote ...
8
votes
4answers
345 views

Who gets root access?

I'm working on a web application which handles some sensitive data. We're getting pretty tight on security, and laying out policies to lock down access to machines, and log everything for technical ...
8
votes
4answers
5k views

Add a user to the “Team Foundation Service Accounts” group in TFS

I need to add a user to the "Team Foundation Service Accounts" group in TFS to be able to run the TFS Integration Tool. I am an administrator on both the machine running TFS and the TFS Install (ie I ...
8
votes
1answer
2k views

SSH passphrase remembered in MacOSX Snow Leopard

I am facing a very strange situation with Snow Leopard. I have a Linux server, configured to accept an ssh connection authenticated only through RSA key. No password. On my laptop I correctly deployed ...
8
votes
4answers
4k views

Use standard USB flash disk as security token

We want our users in company to login their computers by using their USB Flash Disks or something else. Is there a way to achieve this without buying a USB token from a company ?
8
votes
1answer
168 views

Restricted shell for managing files and git repositories

Think about a web hosting company that wants to let users manage files and git repositories via ssh. This includes: secure copy (scp) creating, copying, moving/renaming and deleting files executing ...
8
votes
4answers
4k views

Is there a difference between a self-signed certificate and one signed by your own CA?

We need to use SSL on our internal network for a few sensitive applications, and I need to know if there is a difference between a self signed certificate and one signed by a Windows Server CA that we ...
8
votes
4answers
6k views

How do you manage service account credentials (passwords)?

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
8
votes
4answers
2k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
8
votes
1answer
394 views

Who do I report a hacked server to?

This server http://62.193.248.163/ is used to hack Trixbox 2.6 PBX's. I can't tell if this server is a customers of http://www.amenworld.com/, or is it is actually one of theirs? Who should I report ...
8
votes
3answers
1k views

Should I create a new private ssh key on each system?

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the ...
8
votes
2answers
2k views

What is the best way to allow a domain user to start and stop services on the machine?

What is the best way to allow a domain user to start and stop services on the machine? The domains user cannot be made admin.
8
votes
2answers
1k views

When should I create a new user account to run software on a server?

In general, when should one create a new user account to run a piece of internet-facing software on a server? For instance, suppose I'm using a shared Debian server (e.g. via Dreamhost) and I want to ...
8
votes
2answers
300 views

Dealing with SMTP invalid command attack

One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands. In the past two days: incoming smtp ...
8
votes
2answers
2k views

Is LXC secure enough for VPS hosting?

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ ...
8
votes
2answers
5k views

How secure is Remote Desktop Connection?

When using Remote Desktop Connection, is the information being sent back and forth securely, as in SSL? Are usernames and passwords secure? When connecting to a remote server through Remote Desktop ...
8
votes
2answers
4k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
8
votes
3answers
1k views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
8
votes
4answers
1k views

Stopping a DOS attack

One of the sites I work with has recently started to get DoS'd. It started out at 30k RPS and now it's at 50k/min. The IP's are pretty much all unique, not in the same subnet, and are in multiple ...
8
votes
2answers
1k views

Is there a way to force all cPanel users to change their passwords one time? [closed]

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password ...
8
votes
2answers
9k views

Whats the difference between local and remote addresses in 2008 firewall address

In the firewall advanced security manager/Inbound rules/rule property/scope tab you have two sections to specify local ip addresses and remote ip addresses. What makes an address qualify as a local ...
8
votes
2answers
271 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
7
votes
5answers
3k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
7
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
7
votes
7answers
599 views

Securing WordPress Blog Installation

Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?
7
votes
2answers
1k views

Linux 'runas' equivalent

my company has multiple domains and I log into my local machine with one set of credentials, but often when accessing certain network resources I need to use a different set of credentials. In Windows ...