Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
2answers
214 views

apache: restricting access by network

Im working on a (linux based) device that has 4 network interfaces: two wired, one wireless and a VPN. The device has a web 'control panel' of sorts that I want to restrict access to. Ideally it ...
0
votes
3answers
3k views

How to disable SSL/TLS compression in Apache 2.2.16?

I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt ...
0
votes
1answer
56 views

How to update/maintain a patched kernel?

If I patch my linux kernel with grsecurity, will I still be able to update my system with yum (or apt-get)? Won't the updates available via yum be incompatible with my patched "non standard" version ...
0
votes
2answers
235 views

-bash: www.mydomain.com.pem: Permission denied

I have these three files in /etc/nginx/ssl folder: www.mydomain.com.csr www.mydomain.com.key www.midomain.com.key.nopass I bought and downloaded the positive ssl certs in ...
0
votes
1answer
29 views

Limit access to an EC2 instance from different instances

I have an EC2 instance set up called Machine1. I specified the security group to be Group1. How can I allow access in Group1 to any machine that comes from an internal EC2 request? Do I have the ...
0
votes
1answer
258 views

Cisco asa 5500 series - Logging VPN connections to easily search connection history

We have a fresh requirement to log information to do with vpn connections. The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / ...
0
votes
1answer
3k views

Windows: disable remote access of local drive, even by domain admin

We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In ...
0
votes
2answers
435 views

Securing dnsmasq - interface(s)?

Im preparing to deploy about a thousand fanless machines running Debian. Each machine has 3 interfaces (eth0, eth1 and uap0). In many cases these machines will sit between a cable modem and a home ...
0
votes
1answer
68 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
0
votes
3answers
169 views

Is it bad to store server SSH keys in version control?

We are writing scripts to automatically redeploy our servers. These scripts are stored in version control. Some of the servers require access to private Git repositories with access restricted by ...
0
votes
1answer
115 views

Is the connection from PHP to a different MySQL server 100% secure?

I tried to find this information but was not able to. How is working the connection from PHP to MySQL server. As the password is sored plain, is it also sent plain to MySQL if it is stored on a ...
0
votes
2answers
243 views

Windows Security: can user read local files with only 'Log on as a batch job'?

A Windows Scheduled Task runs as serviceAccount@domain.tld on a 2008R2 server. The server's local disk has some files that Joe Blow should not see. Joe Blow knows the serviceAccount password. As far ...
0
votes
1answer
126 views

Possible causes of high download activity on network [closed]

We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between ...
0
votes
2answers
745 views

Can you lock down Cpanel/WHM access to certain IP's?

Is it possible to only allow access to Cpanel/WHM to certain IP's? I know how to do it for standard folders, but I don't believe that will work for this purpose as they are on different ports or ...
0
votes
1answer
81 views

Securing a switch

I have switch (HP ProCurve 1810-24G to be exact) and it's placed in a datacenter. To secure the switch, there's a lenghty password on it. But, there's one great downside: anyone with the IP address ...
0
votes
1answer
65 views

How to provide IIS Basic authentication access without a general user account

I want to provide access to my website through IIS Basic auth (already working) but I don't want to give out OS level logins, to my testers/previewers. Is this possible? How can I do this? I ...
0
votes
1answer
146 views

Is there a way to allow specific permissions to a non-root user?

I have a program that, at some point, create/destroys tun/tap virtual adapters. Obviously, for these specific operations this program requires root privileges. According to the program ...
0
votes
3answers
174 views

Ubuntu Server: Attack on blocked ports leads to Ping timeout [duplicate]

I was searching for a solution a long time but cant find anything useful. My webserver is secured by a firewall (iptables with ufw userinterface). Default is deny all and only some ports are open. ...
0
votes
1answer
257 views

Multiple users, one public_html directory

New to creating users with linux. Trying to add users in a secure manner, limiting damage a user can do give all members of the webadmins group access to the public_html folder as projects are often ...
0
votes
1answer
43 views

Blocking Access to Certain Sites

I have a weird setup on a server we host: the site hosts both live and test versions of its sites, set up in two different folders, D:\Live Sites, and D:\Test Sites. What would be the best way to ...
0
votes
1answer
4k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
0
votes
1answer
41 views

Stop certain users accessing C:\Source by security group

We have a security group called SourceCode which allows certain users access to the SVN / GIT repository. This allows them to get the latest repo and store it in C:\Source. This works fine but the ...
0
votes
1answer
35 views

Automated mails from a documentation on a closed network through adsl to user emails

I have a closed network that has a documentation system that sends automated emails to users using smtp. The users are all on the same exchange server. We have an adsl connection. Are there security ...
0
votes
1answer
39 views

is webmail db acessable through ftp

Recently we've had several attempts to access our ftp account from an outside source, (we've since locked the account). I was wandering if we use hosted webmail, such a open xchange, horde or atmail ...
0
votes
1answer
1k views

Site2Site tunnel via SSL VPN?

i have tried convincing my opposite office of the tunnel in question to get site-2-site ipsec up and running. However they are not really into that and run everything via SSL VPN.. Is it possible to ...
0
votes
1answer
253 views

What is the reasoning behind how Active Directory group nesting works? [closed]

For a long time, I've had trouble understanding how group nesting is supposed to work in a multi-forest AD environment. It seems like there are arbitrary limitations placed on group types, with ...
0
votes
1answer
1k views

Where to put OpenVPN server - DMZ or LAN?

We have a Smoothwall firewall with both a "green" network (LAN) and an "orange" network (DMZ), and we would like to use OpenVPN access server as our VPN server. The question is: Should the VPN server ...
0
votes
2answers
258 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
0
votes
4answers
110 views

How to I start with a remote IP address connected to my computer to the process that has opened the connection?

If I type "netstat", I can see a list of IP addresses that my PC is connected to. If I start with an IP address, how do I find the process that has opened the connection to said IP address?
0
votes
1answer
89 views

Ubuntu, How to prevent listing sub-directory if parent-directory is protected

I remember last time when I am on some Linux OS ( cannot remember ), when I change the mod of a directory to 711, that folder together with all of its sub-directories cannot be listed (ls -al) by any ...
0
votes
2answers
330 views

selinux permissive and type targeted

i am running centos 6.2 recently i noticed that apache was running with selinux enabled # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # ...
0
votes
1answer
146 views

Securing GoDaddy Shared Hosting Account Hosting Multiple Sites

How secure is it having multiple sites on same godaddy shared hosting account? If I give client their own ftp access to their directory - theoretically they can upload any php script they want and ...
0
votes
1answer
53 views

Cryptography to protect remote access [closed]

In our office (and in our home too) we have some security equipment connected to the Internet, like ip cameras. However, we are not satisfied by their level of security: the only protection the DVR ...
0
votes
1answer
98 views

How can I connect these 3 environments with SSO?

In my org today, we use the following: W2K8 R2 - Active Directory Google Apps for Enterprise Salesforce Enterprise version Each of these has it's abilities for SSO connectivity. I would like to ...
0
votes
2answers
195 views

USB key to pass password in Centos 6 [closed]

I had a room mate that put a livecd in my desktop and looked around on my machine. I caught him in the act and threw him out. I haven't had a room mate for a while now and so as to avoid the livecd ...
0
votes
1answer
87 views

How should I set up a new local user for IIS to run under?

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2). (The long and boring rationale has to do with System.IO.Packaging's use of ...
0
votes
1answer
64 views

SQL Server on the internet

I've got a desktop application connecting to SQL Server directly, I see a lot of posts saying you shouldn't expose SQL Server directly to the internet but none say why. Some background: Scalability, ...
0
votes
1answer
370 views

the right way to do deployment with capistrano

I look for good practices for deploying with capistrano. I would like to start out with a short description how I used to do deployment. capistrano is installed locally on a developer's computer. I ...
0
votes
1answer
2k views

Constant Errors on SQL server, Event ID 28005 and 4625

We have been getting the following errors on our SQL 2008 R2 server several times a second. I have searched the internet to its ends and I cannot find a solution that will work in our situation. I ...
0
votes
1answer
68 views

Is it possible to create an FTP user that can only access certain directories?

Suppose I have the following directories inside my www folder: private_info_1 public_info_1 private_info_2 public_info_2 Is it possible to create an FTP user (I'm using cPanel) that could access ...
0
votes
1answer
72 views

In an iptables log, can I get rid of IN, LEN, TOS etc?

In my iptables log, I get very repetitive and hard to read data like that: MAC, IN, LEN, TOS, PREC, TTL, ID, WINDOW, RES, URGP I am using my Ubuntu machine as a web server. Which one of these can ...
0
votes
1answer
432 views

What is wrong with my Watcher (incron-like) daemon?

I have installed Watcher this way: both watcher.py and watcher.ini are located in /etc I also installed pyinotify and it does work when I use python -m pyinotify -v /var/www However, I want to use ...
0
votes
1answer
188 views

Is there a ready-made inotify program to monitor changes on a directory?

I am trying to understand how inotify works and it seems that you need to program stuff in C for it to work. Since I don't know C, I was wondering if there is a program or script already made to ...
0
votes
1answer
247 views

How secure is a subnet?

I have an unfortunate complication in my network - some users/computers are attached to a completely private and firewalled office network that we administer (10.n.n.x/24 intranet), but others are ...
0
votes
2answers
274 views

How to defend agains botnet http requests

I have a server with WHM + CPanel and 5 of my costumer got infected with zbot. This means that the domains they have are constantly receiving requests to certain destinations. I tried to use ...
0
votes
1answer
112 views

LEAP vs EAP/TLS?

I am given a choice between: LEAP Wireless Client ID 802.1x (EAP/TLS) Wireless Client ID (Digital Certificates) To connect to a wireless network. What are the differences? Which one would you ...
0
votes
1answer
714 views

PAM Errors in auth.log [Debian Squeeze]

Based on the the Securing Debian article on debian.org, I added the following to /etc/pam.d/other. auth required pam_securetty.so auth required pam_unix_auth.so auth required ...
0
votes
1answer
105 views

Is special software necessary (apart from card reader drivers) to use a smartcard for authentication on websites?

Our company now begins to use SmartCards as the online portal for tax administration that we use requires authentication. I have never before worked with SmartCards. The device drivers are installed ...
0
votes
1answer
194 views

Provide Internet access for different VLAN

I have several managed switches at work that connect all computer within our office to the ADSL modem. However I would like enforce a VLAN policy to isolate traffic within the network. Through my ...
0
votes
1answer
2k views

How to disable LOCAL INFILE in MySql 5.5 Ubuntu 12.04

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf [client] port ...