Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
6answers
475 views

Secure data transfer from a RHEL 5 box

I have been researching this for a while but cant find and conclusive answeres. FTP - Very insecure. FTP over SSl - Not fully supported everywhere, only a few clients support it? SFTP - This is the ...
0
votes
3answers
5k views

Better way to stop/start Webmin and SSH

it would be a good idea to not have webmin running all the time... just start it via ssh when I need it... so, I just stop webmin,and leaving SSH always running... when I need to access webmin, I ...
0
votes
1answer
81 views

Why are some big corporations still worried about cloud security? [closed]

My company sells an app subscription, which is hosted as SAAS on Amazon Cloud. I have had a few clients who weren't very keen on uploading their documents to my product because my product is hosted ...
0
votes
2answers
61 views

What IP address should I use for a device that I want to break network access to?

I have an IPMI server on a super micro motherboard that I am unable to disable. There is not even a jumper to disable this either. After seeing all of the security issues that the IPMI server they ...
0
votes
1answer
88 views

Are department-wide shares a bad idea?

Let's say an organization has a department with 10-15 users who sometimes need to share files between each other. They currently have an open share, where anyone read read / write to the share. If ...
0
votes
1answer
269 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
0
votes
2answers
554 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
0
votes
2answers
103 views

Can a datacenter read my passwords if I'm using KVM over IP? [closed]

Is it truth that datacenters can read my passwords over KVN over IP interface when I ask them to connect it and I'am forced to enter ssh pass/encryption pass (OS install,etc) ? I colocated the server ...
0
votes
2answers
186 views

Safely transfer files from pc with internet connection to lan without allowing any other form of communication

In the company that I work there are computers that are connected to the Internet and computers that are connected to a Local Area Network. The LAN is considered a "safe zone" and the files that ...
0
votes
3answers
602 views

Security best practice when running process as non-root user

So I'm trying to run Supervisor (http://supervisord.org/) as a non-root user. However the process outputs logs to the /var/log directory which is owned by root and has 755 permissions. Therefore ...
0
votes
1answer
246 views

How do I secure my SSH access?

I'm one of those guys who climbs up the ladder to the high dive and jumps off, then realizes he doesn't know how to swim. So I have a VPS, and I have no idea how to administer it. I understand one of ...
0
votes
4answers
949 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
3answers
247 views

Windows 2008 Critical Vulnerabilities in Remote Desktop Could Allow Remote Code Execution

A windows server 2008 web edition that hosts some personal blogs of mine have been hacked with all my php files injected whereas the blog wasn't even active. The password is very lengthy about 50 ...
0
votes
3answers
2k views

How to give user root access without giving him root password

The scenario is this: I have a development machine I want (need) to have root access to Our admin setups the machines using his own credentials for the root user. The explanation being that if ...
0
votes
2answers
1k views

How to use a shared key and certificate for all users with OpenVPN?

I have an OpenVPN server which authenticates to an Active Directory and asks therefore each user for a username and passphrase. On top of that it also requires each user to have a client certificate ...
0
votes
2answers
2k views

Encrypting an ODBC connection

Situation: We have a SQL Server 2008 R2 database sitting in a data centre We would like to allow analysts to connect to the database and query the data using desktop based tools (e.g. Tableau) via ...
0
votes
1answer
80 views

Web Server sercurity (used only for web services)

I am using a Virtual Private Server for accessing Web-Services used only on the Mobile devices, there are many entries in the access and error log, even there is nothing on the web server. I am ...
0
votes
1answer
100 views

Win Server 2003/Terminal Services Remote Access

Office users access a win2003 server from within the office using thin clients and terminal services. In reviewing the security settings it seems, by default, all users in the 'Remote Desktop Users' ...
0
votes
2answers
128 views

Is it possible to configure a service to run as a group and add users to that group on Windows XP?

Is it possible to configure a service to run as a group and add users to that group on Windows XP? I need the service to have the permissions of the users in that group so that they can logonn, ...
0
votes
3answers
2k views

Centos Dedicated Server Security [closed]

We have clean CentOS 5.6 setup and virtualmin on it, that's all. What type of security steps would you suggest are appropriate? http://www.wiredtree.com/supportservices/servershield.php this page ...
0
votes
1answer
182 views

Locking down a box on the Internet [closed]

I'm a developer who is looking to put a new service on the Internet. I am new to administering systems and frankly I seem a little lost at where I should start with putting something on the web. My ...
0
votes
2answers
130 views

Methods to ban bots, force attacks on my server

I've been getting some bots trying to get hold of my database by mass attacking /sertup/scripts.php of various database program. I wanna ban such activities. The closest I found was this: ...
0
votes
2answers
354 views

Security and Windows Login

I'm not entirely sure this is the right place for the is question but I cannot think of another so here goes. In order to login to the windows machines at my office one must press the almighty ...
0
votes
3answers
543 views

logwatch explanation

Could anyone please explain what the various parts of the following LogWatch mean: --------------------- IMAP Begin ------------------------ [IMAPd] Logout stats: ==================== User | ...
0
votes
3answers
278 views

What security precautions and configurations are needed for a production web server?

I am standing up a win server 2008R2 x64 and will be hosting a few public facing websites with IIS 7.5. I am relatively new to administering a production web server and am curious as to what ...
0
votes
2answers
109 views

Prevent UID=0 to be assigned to any other user in Linux

I wanted to know if there is a way to prevent the assignment of UID=0 to any other account other than root.
0
votes
2answers
230 views

Make https the default

I have my domain and hosting setup to use https, and no normal http. The only thing I use this for is webmail, and so I don't even want to offer normal http. At the moment, I have to manually go to ...
0
votes
5answers
618 views

Capistrano security

We are using Capistrano in some systems as a deploy system. The new sysadmin we have says that our setup is really dangerous and I would like to know how to fix it. We have a deploy user called "foo" ...
0
votes
6answers
2k views

how to check for sniffers in Ubuntu?

Somebody is accusing me that my linux ubuntu machine could be the source for a server attack. Their technique was replacing the original ssh by this patched ssh and, as such eliminated all ...
0
votes
3answers
115 views

What % of IT shops (if any) disallow Flash on their corporate desktops?

My company is considering rolling out a desktop windows application with a dependency on Flash (swf.) The product manager is concerned that IT/IS/ops shops might have a policy of not allowing flash ...
0
votes
3answers
4k views

What is the best way to setup a public and private wireless access point on the same home network? [closed]

For my home network (with internet provided from a cable modem) I would like to setup a secure wireless access point that I use for all of my personal connections (home PC, iPhone, Xbox, etc) and also ...
0
votes
3answers
102 views

Is it generally a bad idea to have other types of virtual appliances installed along side a firewall appliance?

I want to run my Firewall/NAT software (pfsense) and an internal NAS (looking at freenas right now) for my SOHO on one machine. Right now I have them separated on two different machines, but I'd like ...
0
votes
2answers
5k views

nginx restrict directory access

I have a Wordpress site running on nginx. What is the best way to restrict access to /wp-admin using nginx? Thanks
0
votes
6answers
115 views

Combining IntrAnet and HTTPS, is it useful?

I have a web server which supports only the company's Intr*a*net, not the external Int*er*net. There will be about 100 different users who will connect to a web application on this server and they ...
0
votes
4answers
4k views

Securing Guest Wireless Network

I need to setup a guest wireless network at the office for visitors to connect to. What are your recommendations in terms of how to secure it without putting too much of a support burden on myself? ...
0
votes
3answers
22k views

How to automatically set IE settings for all users?

I need to alter some settings on Internet Explorer (version 7, but potentially some users may still have version 6). Doing this manually is fine, change settings, restart IE, done. However, we have ...
0
votes
3answers
115 views

Monitor communication to outside the network

I work at a place where they have access to very sensitive data and think a lot about security. I dont want to ask bc they may lie, is there software to monitor data such as email (pop/imap AND ...
0
votes
3answers
6k views

How to disable anonymous access on LDAP

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd). I notice that if I run: ldapsearch -x -W -b ...
0
votes
6answers
4k views

software version of the RSA SecurID?

Is there a software version of the securID fob below: I remember reading that the algorithm for the key generation had been broken & that there was a software utility available, where if you ...
0
votes
2answers
42 views

How to securely send logs from your application?

I am currently setting up logging with graylog for my system and have a problem, that the logs can potentially contain sensitive information. The standard behaviour is to send the logs unencrypted via ...
0
votes
1answer
69 views

Should I use amazon VPC or EC2 in this scenario?

My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word ...
0
votes
3answers
206 views

Security concerns with enabling PowerShell on a production server [closed]

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET). One of my colleagues said to me ...
0
votes
2answers
76 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
0
votes
2answers
745 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
2answers
97 views

Does the server SSL certificate need to be kept private?

I understand that private key definitely does, but what about the certificate file? I also understand that the server sends (part of?) the certificate to a connecting client, but does it send the ...
0
votes
2answers
44 views

How can I sync servers configurations

I'm looking for a way for 1 server lcoated in Switzerland (acting as a web/db server) to share/sync files like deny.hosts and iptables rules to my other server (dns/mail) located in North America in a ...
0
votes
3answers
256 views

Is it a good idea to only allows connections to be established in the LAN->DMZ direction?

I'm trying to setup the usual thing, with a DMZ containing servers that can be accessed from the internet, and a LAN that should be as secure as possible. I happen to also have total freedom on the ...
0
votes
2answers
1k views

Trying to set up virtual hosts to block access by IP, for three domains and when using SSL on one domain

So I want all this on one server: - 3 domains / websites - SSL on one of them - nothing to be accessed by an IP address (e.g. 'domain.com' is okay, but not by just typing '123.55.44.123' into the ...
0
votes
3answers
285 views

VPS security considerations when only accessing from one IP [duplicate]

I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
0
votes
2answers
215 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...