Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
92 views

How can I connect these 3 environments with SSO?

In my org today, we use the following: W2K8 R2 - Active Directory Google Apps for Enterprise Salesforce Enterprise version Each of these has it's abilities for SSO connectivity. I would like to ...
0
votes
2answers
187 views

USB key to pass password in Centos 6 [closed]

I had a room mate that put a livecd in my desktop and looked around on my machine. I caught him in the act and threw him out. I haven't had a room mate for a while now and so as to avoid the livecd ...
0
votes
1answer
76 views

How should I set up a new local user for IIS to run under?

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2). (The long and boring rationale has to do with System.IO.Packaging's use of ...
0
votes
1answer
62 views

SQL Server on the internet

I've got a desktop application connecting to SQL Server directly, I see a lot of posts saying you shouldn't expose SQL Server directly to the internet but none say why. Some background: Scalability, ...
0
votes
1answer
338 views

the right way to do deployment with capistrano

I look for good practices for deploying with capistrano. I would like to start out with a short description how I used to do deployment. capistrano is installed locally on a developer's computer. I ...
0
votes
1answer
1k views

Constant Errors on SQL server, Event ID 28005 and 4625

We have been getting the following errors on our SQL 2008 R2 server several times a second. I have searched the internet to its ends and I cannot find a solution that will work in our situation. I ...
0
votes
1answer
64 views

Is it possible to create an FTP user that can only access certain directories?

Suppose I have the following directories inside my www folder: private_info_1 public_info_1 private_info_2 public_info_2 Is it possible to create an FTP user (I'm using cPanel) that could access ...
0
votes
1answer
72 views

In an iptables log, can I get rid of IN, LEN, TOS etc?

In my iptables log, I get very repetitive and hard to read data like that: MAC, IN, LEN, TOS, PREC, TTL, ID, WINDOW, RES, URGP I am using my Ubuntu machine as a web server. Which one of these can ...
0
votes
1answer
333 views

What is wrong with my Watcher (incron-like) daemon?

I have installed Watcher this way: both watcher.py and watcher.ini are located in /etc I also installed pyinotify and it does work when I use python -m pyinotify -v /var/www However, I want to use ...
0
votes
1answer
179 views

Is there a ready-made inotify program to monitor changes on a directory?

I am trying to understand how inotify works and it seems that you need to program stuff in C for it to work. Since I don't know C, I was wondering if there is a program or script already made to ...
0
votes
1answer
242 views

How secure is a subnet?

I have an unfortunate complication in my network - some users/computers are attached to a completely private and firewalled office network that we administer (10.n.n.x/24 intranet), but others are ...
0
votes
2answers
223 views

How to defend agains botnet http requests

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot. This means that the domains they have are constantly receiving requests to certain destinations. I tried to use ...
0
votes
1answer
100 views

LEAP vs EAP/TLS?

I am given a choice between: LEAP Wireless Client ID 802.1x (EAP/TLS) Wireless Client ID (Digital Certificates) To connect to a wireless network. What are the differences? Which one would you ...
0
votes
1answer
531 views

PAM Errors in auth.log [Debian Squeeze]

Based on the the Securing Debian article on debian.org, I added the following to /etc/pam.d/other. auth required pam_securetty.so auth required pam_unix_auth.so auth required ...
0
votes
1answer
99 views

Is special software necessary (apart from card reader drivers) to use a smartcard for authentication on websites?

Our company now begins to use SmartCards as the online portal for tax administration that we use requires authentication. I have never before worked with SmartCards. The device drivers are installed ...
0
votes
1answer
174 views

Provide Internet access for different VLAN

I have several managed switches at work that connect all computer within our office to the ADSL modem. However I would like enforce a VLAN policy to isolate traffic within the network. Through my ...
0
votes
1answer
2k views

How to disable LOCAL INFILE in MySql 5.5 Ubuntu 12.04

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf [client] port ...
0
votes
1answer
163 views

Should the webserver user have write permission on the uploads/ directory?

I always gave to the webserver user full permissions on these dirs: cache/ logs/ web/uploads/ But now I am wondering if the uploads part is 0K. I was thinking that maybe it would be better if I use ...
0
votes
1answer
205 views

Deny URLs with a parent .. in the path in apache

I was wondering if there was a simple way to make apache httpd deny (403) any URLs which contain a parent .. in the path. So far I have tried (ignoring the flase positives for simplicity) ...
0
votes
1answer
251 views

sshd_config versus authorized_keys command parameter

Background: I added OTP token authentication to my web server. I modified the /etc/ssh/sshd_config file with the ForceCommand /token/script command. Problem: I have a local Jenkins instance ...
0
votes
1answer
222 views

Should we migrate our VPN from MSCHAP V2 to something else?

We bought a new Firewall a couple months back, a Netgear UTM9S, and one of the features we enabled is the PPTP VPN to enable access to SQL, Web and File servers for remote users. But now, after ...
0
votes
1answer
51 views

gather information about packet from malicious ip

I have a glassfish server running some webservice and I noticed that there is an abnormal traffic from japan (150.70.x.x) in my iptables log file and I dont have any user in this country . Until now ...
0
votes
1answer
80 views

Is it safe/secure to use NIS for user and group info (no password hashes)?

I have some systems which currently use Likewise Open to integrate into an AD environment, but this creates UIDs/GIDs which are not compatible with the Unix UIDs/GIDs which some other systems use. ...
0
votes
2answers
926 views

IPTABLES for block sync flood over udp

I'm a victim of a sync flood attack over UDP port. This came from a lot of different IPs. The machine, a dedicated server, is an hlds game server, and the attacker overload the UDP ports, this cause a ...
0
votes
2answers
58 views

Not enough priviliges to edit files on his/her home dirve

Just wondering if anyone could help me out on why a user is unable to edit anything on its mapped Home Drive. This is what I currently did. (OS Windows 2008 Standard R2) In AD I setup a home ...
0
votes
1answer
521 views

PureFTPd and symlinks

I'm running Pure-FTPD on centos 5 with cPanel installed. When somebody upload a symlink file called 1.txt and it's a symlink to /partition for example, He can browse all /partition contents from this ...
0
votes
1answer
80 views

Certificate showing up as invalid even though the domain name matches

We just bought a certificate for files.website.com. We have installed it to the file transfer software we are using (Globalscape EFT) but are still getting an error message saying "The site's security ...
0
votes
2answers
181 views

tunneling VNC port and port forwording

I have two machine say A and B. machine A is a public gateway. machine B is in my network and running VNC server on port 6000. I want people should connect on machine A on VNC port say 5900 ...
0
votes
1answer
92 views

iptables trafic limitation not working properly with http

I'm using those rules to limit/stop port scan. iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds ...
0
votes
1answer
119 views

securing a ruby on rails installation

I successfully used this tutorial: http://techbot.me/2010/08/deployment-recipes-deploying-monitoring-and-securing-your-rails-application-to-a-clean-ubuntu-10-04-install-using-nginx-and-unicorn/ for ...
0
votes
2answers
148 views

way to restrict FTPS ports on both sides of connection?

Is there a way to restrict FTPS ports on both the server & client side of the connection? I've already read this answer and I have vsftpd set to restrict passive port usage to a narrow range on ...
0
votes
2answers
401 views

Apache2 ssl with ecc

Is it possible to configure Apache2 to use elliptic curve crypto (ecc) with SSL? This bug https://issues.apache.org/bugzilla/show_bug.cgi?id=40132 appears (to me) to indicate that this is supported, ...
0
votes
2answers
49 views

Safely Execute Stored Procedure Via DMZ Server

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a ...
0
votes
2answers
88 views

Disable Server Login upon Updates Reboot

I have a co-located Dedicated Server running Windows 2008 R2. It is a Live server running my sites (wordpress, joomla, etc) I administer it via Remote Desktop. Everytime I do the Microsoft OS ...
0
votes
1answer
608 views

How to alter inf file to add policies to the Local Security Policy on Windows Vista/7

My research has led to me this point -> open "Security Configuration and Analysis" msc snapin, export template into .inf, open .inf in "Security templates" mmc snapin, but here is where I have slowed ...
0
votes
1answer
166 views

Is it possible to block specific outbound hostnames for SSH SOCKS users?

Is it possible to block connections to specific hostnames for users accessing the web via an SSH SOCKS proxy?
0
votes
3answers
685 views

Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)

In order to implement SSO, I have been working with some IdP and a Shibboleth SP install without being able to answer this question. On the IdP side I have a few metadata files that describes some ...
0
votes
2answers
209 views

What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]

I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
0
votes
1answer
181 views

Windows Server 2008 R2 Security Log repeated Audit Failure Entries

We seem to be getting a huge load of entries in our security log with the following details: The Windows Filtering Platform has blocked a connection. The source IP address and port change for each ...
0
votes
4answers
591 views

Is it possible to sign email with digital signature on server side?

I have nice iRedMail server (postfix, dovecot, policyd). One of my client apps sends email via this server. And client want to sign it with digital signature on server side. Is it even possible to do ...
0
votes
1answer
1k views

Is a local-only MAMP installation secure?

I just installed a basic MAMP server (on a Macbook Air 11" running OSX Lion) with no settings changed except for some php.ini things like "memory", "file_upload", etc that are more script related. I ...
0
votes
1answer
2k views

socket: Connection refused on NGINX web server

I'm trying to connect NGINX web server using Passenger for a Rails project. I've checked my configuration file, and i gave connection to sites over port 883. This is my configuration file as ...
0
votes
1answer
4k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
0
votes
1answer
134 views

Best Practice for Remote Development

I posted on webmasters, but someone suggested I ask here... http://webmasters.stackexchange.com/questions/26517/securing-access-to-server We have developers who work remotely and servers at an ISP. ...
0
votes
1answer
436 views

Changing the Internet Explorer's setting Initialize and script ActiveX controls not marked as safe for scripting

We are currently facing a debate regarding the Internet Explorer's setting 'Initialize and script ActiveX controls not marked as safe for scripting'. I have been maintaining an in-house application ...
0
votes
1answer
71 views

Good resource for evaluting AV and anti Malware software?

I am looking for good resources to use to compare the effectiveness of various antivirus/antimalware software solutions. In particular, I am comparing Windows Security Essentials against Symantec ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
2answers
938 views

open_basedir and wordpress

Essentially i found out you can prevent one site which has a security hole from modifying/reading another site via "open_basedir". However when i upload media files using wordpress i got the error ...
0
votes
1answer
173 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
0
votes
1answer
187 views

Draytek Vigor 5510 pro blocking attachments un-necessarily

I have installed Draytek vigor pro 5510 which I may say is one of the hardest ones on the planet to configure but I have now gained success with it in blocking URL(s) successfully but when I implement ...