Security is not a product, but a process.

learn more… | top users | synonyms (1)

9
votes
15answers
4k views

How to manage rack keys?

As a result of a security audit there's the need to lock the racks and manage the keys: Keep the keys safe Record key usage Complying with these two requirements has many challenges as there are a ...
9
votes
7answers
16k views

Will a reverse proxy in front of web server improve security?

Third-party security professional is recommending we run a reverse proxy in front of the web server (all hosted in the DMZ) as a best practice security measure. I know this is a typical recommended ...
9
votes
3answers
6k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
9
votes
3answers
5k views

What is HTTP COOK request method in my logs?

I'm seeing entries in my Apache logs like the following 178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; ...
9
votes
3answers
513 views

Why does a web server's public key certificate have to be signed by a certificate authority?

In other words, what would be the security risk of not signing public key certificates by certificate authorites (from a user perspective)? I mean, the data is still encrypted... What could a man in ...
9
votes
4answers
2k views

When is it appropriate / prudent to use chroot?

I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs ...
9
votes
8answers
17k views

How to prevent a LOIC (DDOS) attack? [duplicate]

The program LOIC (in the news a lot the last days) causes a lot of damage. What can I do on my server to prevent this kind of attacks? Auto-block ip when receive a strange connection? Because mostly ...
9
votes
3answers
342 views

“Template” for handing out user & passwords for employees

Within this relatively small company I work for, I have been handing out usernames and passwords written very simply in a word document. I wish for this process to be more professional now that we ...
9
votes
5answers
5k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
9
votes
4answers
47k views

How can I know when a file was last read or accessed on Windows?

I need to determine if a particular file was accessed in the last, say, 2 days. Is this possible on Windows Server 2008 R2?
9
votes
6answers
701 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
9
votes
4answers
51k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
9
votes
2answers
312 views

Method to deprecate SSH key Pair locally

I've using my ssh-keys for a while. I'm thinking about to upgrade my ssh key pair to a stronger encryption and i dont know all devices where my keys are registered. Is it posible to "deprecate" a SSH ...
9
votes
6answers
965 views

When/why to use a web proxy/gateway?

Right now we have about a 25-30 PC network, connected to the internet with a run-of-the-mill SonicWall Firewall/Router device. There isn't much filtering / blocking other than outgoing SMTP (for ...
9
votes
1answer
5k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
9
votes
1answer
756 views

Is it possible to hide a malicious alias in Bash on Linux?

Is it possible to conceal the existence of a malicious alias in Bash on a Linux system and have it executed by the user without their knowledge?
9
votes
2answers
21k views

HOWTO: Disable complex password policy on Hyper-V Server 2008?

How do you disable the password complexity requirements on a Microsoft Hyper-V Server 2008 R2? Keep in mind that when you log into the server, the only UI you have is: And you cannot run ...
9
votes
6answers
6k views

How can I log users' bash commands?

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?
9
votes
1answer
15k views

Explanation of nodev and nosuid in fstab

I see those two options constantly suggested on the web when someone describes how to mount a tmpfs or ramfs. Often also with noexec but I'm specifically interested in nodev and nosuid. I basically ...
9
votes
2answers
4k views

How to Protect Sensitive (HIPAA) SQL Server Standard Data and Log Files

I am dealing with electronic protected health information (ePHI or PHI) and HIPAA regulations require that only authorized users can access ePHI. Column-level encryption may be of value for some of ...
9
votes
4answers
7k views

How do you manage service account credentials (passwords)? [closed]

In a Windows environment how do you address the following issues with service accounts? Regular Password changes - with single service accounts used on multiple machines how do you regularly change ...
9
votes
2answers
2k views

Can the msdeploy agent service open up an attack vector on our servers?

we're evaluating the usage of the msdeploy Web Deployment Agent Service for automatic deployments to our production servers. One thing we can't find out about are potential security impacts. For one ...
9
votes
3answers
1k views

Real life SELinux security example?

Can anyone give a real life example of where SELinux saved their security bacon? (or AppArmour if you wish). If not your own, a pointer to someone with a credible experience? Not a lab test, not a ...
9
votes
2answers
5k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
9
votes
1answer
183 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
9
votes
2answers
2k views

When should I create a new user account to run software on a server?

In general, when should one create a new user account to run a piece of internet-facing software on a server? For instance, suppose I'm using a shared Debian server (e.g. via Dreamhost) and I want to ...
9
votes
3answers
2k views

Should I create a new private ssh key on each system?

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the ...
9
votes
3answers
5k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
9
votes
1answer
251 views

Where can I embed proprietary information in a layer 2 or layer 3 packet?

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
9
votes
1answer
1k views

Configuring WPA2-Enterprise with Freeradius

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc. The problem is Windows clients need to uncheck the "Automatically ...
9
votes
2answers
16k views

Whats the difference between local and remote addresses in 2008 firewall address

In the firewall advanced security manager/Inbound rules/rule property/scope tab you have two sections to specify local ip addresses and remote ip addresses. What makes an address qualify as a local ...
8
votes
13answers
2k views

Locking Desktop USB Ports

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops. I should clarify that these are Windows XP desktops. We should also assume that like most ...
8
votes
9answers
5k views

What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?

Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
8
votes
6answers
612 views

First time opening an SSH server to internet, what to check

I've been running a few servers for a relatively long time, but I always only rented them, so I don't have much experience securing the actual server (as opposed to the application I'm running on it). ...
8
votes
13answers
7k views

How do I stop Ubuntu from starting daemons I've not explicitly asked to run?

One of the basic principles of computer security is never to run anything you don't need. I was pgrepping for a process today when I noticed that my Ubuntu 9.04 (desktop) machine was running a git ...
8
votes
5answers
3k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
8
votes
7answers
5k views

Is there anyway to determine who dropped a table?

A table in the production database has 'mysteriously' disappeared. Does anybody know of any way to diagnose what the heck happened to it? And who did it? Edit 1: This is an internal app, with weak ...
8
votes
4answers
687 views

How can I fake port 22 when I made sshd listen to another port?

Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what ...
8
votes
3answers
645 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
8
votes
8answers
428 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
8
votes
5answers
637 views

Is open id secure?

Is open ID secure, for example can you use it to log into bank accounts?
8
votes
3answers
30k views

Enable downloads and disable IE ESC on Windows Server 2008 (and R2)?

How can I enable downloads for Windows Server 2008? By default when I try to download something with internet explorer the download is blocked.
8
votes
2answers
4k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...
8
votes
5answers
411 views

Is setting a very strong password enough to secure an SSH on port 22?

Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols ...
8
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...
8
votes
5answers
1k views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
8
votes
5answers
1k views

Using gmail as your primary mail server

I have read that there is an option of using Gmail as your primary mail server. In the sense that you can add mx records etc and you do not have to do it on your own server. Do you think this is a ...
8
votes
2answers
4k views

Is it possible to have a 100% secure virtual private server?

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS. Obviously there are some things that you could do to ...
8
votes
6answers
9k views

Is it possible to create your own root DNS server?

I'm curious. I keep reading about how our ISPs and internet middle men record and keep track of all DNS requests basically leaving a trail of breadcrumbs in many logs, and also allowing DNS hijacking ...
8
votes
5answers
290 views

Securing Acrobat Reader to mitigate viruses

Aside from patch updates, is there any way to mitigate the risks with adobe reader exploits? Frankly, I don't know how most reader exploits work. However, is there any functionality that I can ...