Security is not a product, but a process.

learn more… | top users | synonyms (1)

2
votes
1answer
698 views

How to change the content ownership of an external HDD under Windows 7 for backup (all folders at once)?

Summary I'm currently trying to pickup the data of a HDD which PC is now dead (the M/B). I connected the HDD to my PC using an External IDE->USB Enclosure and can navigate thoughout some of the alien ...
-2
votes
3answers
118 views

Making a shell server

I am planning to make a public shell server. What things should I modify to secure my server. Please tell me general things to check
1
vote
2answers
558 views

Domain Security Advice: Backup Operators Group

Greetings I've been tasked with creating an automatic backup system that will backup a users home drive to their respective network drive that we have on a file server. After much hassle of actually ...
1
vote
1answer
289 views

Linux kernel SCTP vulnerability

Linux kernel is hit with 2 remote dos vulnerabilities and like all good admins the kernel should be upgraded. But is there any immediate steps we can take (eg: disable SCTP) which can mitigate the ...
0
votes
1answer
91 views

Is the data in SQL Azure safe?

I am new to cloud computing. I don't know whether my question is correct. I have an application which has sensitive data. Suppose I had to move the database to the cloud. Is the data in the database ...
3
votes
3answers
264 views

How to secure a vps based website?

If I have a vps hosting with linux, what should I do to be sure it has platform security ? I install a server (let's say tomcat), a database server (mysql) and then I deploy my application. Should I ...
0
votes
3answers
66 views

One of my VPSes is very sluggish usually past midnight ( 1-5AMish )

I've noticed that on one of my VPSes ( debian 5 lenny ) ( not my linode ones but a host I used prior to linode ), the filesystem is very, very sluggish past midnight. If I try to use the command ...
0
votes
3answers
196 views

How would you set up a one-way VPN?

I would like to set up a VPN between my LAN: Windows 7 Ultimate Desktop workstation OpenSuse 9.3 server and my co-located web server: Windows 2008 R2 Web Edition server (with just one NIC!) ...
1
vote
4answers
127 views

Security and Protection for Win Server 2003

Is there any Security software recommendation for Windows Server 2003 as a Web Application/Website server? Or any particular settings I should adjust before making a website to be Live.
5
votes
3answers
926 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
1
vote
4answers
832 views

blocking port scans on server

I see following attempts in /var/log/auth.log which I was told by some one could be port scanning attempts.(Not sure though) Nov 18 23:50:19 server sshd[21716]: Did not receive identification string ...
0
votes
5answers
465 views

TCP attack invisible to netstat

we are hit by a strange attack, the attacker even emailed to challenge us. The output of "netstat -n" is just a few "ESTABLISHED" and "TIME_WAIT" typically, yet the server's website cannot be reached ...
1
vote
2answers
1k views

My server appears to have been hacked+ scanssh run by zabbix is it normal?

I'm running a few EC2/Scalr instances with zabbix monitoring. I received complaints about one of my servers port scanning other servers. the logs show it is accessing port 22 on consecutive IP ...
4
votes
3answers
691 views

With regards to Windows Updates, just how screwed are we?

We have a small "secured network" in our office. And by small I mean it's a Windows 7 PC connected to a firewall which connects to an internet connection. It's for processing card transactions in ...
1
vote
3answers
5k views

phpMyAdmin setup not password protected; getting hit a lot by hackers

The phpMyAdmin (version 2.11.9.5) setup screen of my server is not password protected. I have noticed a lot of attempts at accessing the screen in my log files, especially from automated requests ...
0
votes
1answer
2k views

How to access files over a network using local accounts?

I have setup a small (wireless) home network comprising of 3 computers. Two with Vista and one Windows 7. There is no domain controller for this network and all accounts on all machines are locally ...
0
votes
2answers
1k views

How can I stop SMB on Windows 7 null authenticating?

This is a nasty question to be asking but we're really desperate. By which I mean we have about four hours to fix this or dire consequences will follow. We have a PC for card processing in our office ...
2
votes
5answers
418 views

Mitigating risks of HTTP session hijacking on open WiFi networks with VPS

The new Firefox extension Firesheep highlights the fact that HTTP login sessions can be easily hijacked if the data can be sniffed, which is trivial on an open WiFi network. I would like to set up ...
5
votes
2answers
353 views

When routers communicate with HTTPS, how is their identity confirmed?

There's something I don't understand. Possibly I have some misunderstanding about how HTTPS works. I heard that some wireless routers allow the user to access the administration page with HTTPS ...
2
votes
2answers
489 views

CHMOD in web hosting

my Hosting is use Apache and PHP i understand what it's mean 777 in CHMOD or drwxrwxrwx or Owner, Group, Public => read, write, execute. i understand with the RW CHMOD command but what about the X, ...
27
votes
2answers
781 views

Why is it bad to have root writing files to a directory not owned by root?

This came up in a comment to another question and I'd love it if someone could explain the reasons for this to me. I suggested having Apache log the errors for a given VHost to a user's home ...
0
votes
4answers
1k views

Unexpected requests from an IP in San Antonio.. should I worry?

I've noticed on my server log that I receive unexpected requests from an IP in San Antonio. Is this spam ? They visit phpMyAdmin, admin.. etc is this spam ? 184.106.130.137 184.106.149.110 - ...
1
vote
2answers
74 views

Starting an application that can't touch existing files

I have an application that I would like to start in a "visualized environment". I don't want this application to be able to write/read any files on my local file system. A bonus would be to be able to ...
1
vote
2answers
576 views

How to find security-leak after a skynet intrusion?

Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...
1
vote
1answer
215 views

How to block users from seeing others processes?

Generally it's one of the functionalities of (For example) grsecurity - user sees only his own processes, and not all others. But - I'd prefer to avoid installing grsecurity - perhaps something like ...
0
votes
3answers
172 views

Apache Request IP Based Security

I run an Apache server on my home system that I've made available over the internet as I'm not always at my home system. Naturally I don't want all my home server files public, so until now I've ...
4
votes
6answers
646 views

Networking security and TCP/IP internals books/sites

I am searching for good books and articles about TCP/IP, mainly the security aspects of TCP/IP protocols. I have TCP/IP Illustrated and the TCP Guide, but they kinda lack on description of 'classic' ...
0
votes
1answer
577 views

CISCO: ARP Poisoning Countermeasures

How can I prevent the Cisco Catalysts 2950/2960/3550/3750 from being vulnerable to ARP Poisoning? Can this be avoided with the ARP INSPECTION? Thanks
9
votes
4answers
29k views

Account to read AD, join machine to domain, delete computer accounts and move computers to OUs

I want to create an account that will perform the following: Join computers to a domain (not restricted to 10, like a normal user) Check for computer accounts in AD Delete computers from AD Move ...
1
vote
2answers
488 views

Do I need to worry about suexec and suphp on my VPS?

I'm about to setup a VPS that will host multiple websites of my companies that only I will have access to. These websites are our own sites and, therefor, it's my own code that will be running on the ...
1
vote
1answer
84 views

Host projects safely on linux server?

I'd like to host php projects and perhaps asp.net prjs on my server. Theres two main issues i have. 1) The php files scanning my filesystem. I dont want it to visit /var/www/majorapp/config.xml and ...
1
vote
1answer
120 views

Biometric scanner that scans the blood veins pattern in the palm

Is there some kind of a biometric scanner that can scan the pattern of blood veins in our palm? Related questions: Reputable Biometric Fingerprint Scanner & Access/Attendance Solutions? ...
0
votes
2answers
600 views

AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?

(See update below) I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump: Original report: Destination IPs: ...
0
votes
4answers
166 views

Find something out about a former process

Yesterday my vServer was shut down by my provider cause of some unusual load. They told me there were multiple processes running with the name dtdfs. I also see in the log that there was some some ...
22
votes
10answers
4k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
1
vote
1answer
758 views

Using arpwatch to backtrack proxy access ip to eap-tls certificate

In my network I am using eap-tls authentication (machine certificates) for clients. Those clients are using a squid proxy to access the internet. The proxy is logging the request to the access.log. ...
1
vote
3answers
350 views

What is this script that's been injected into our website?

This morning I discovered that a script has appeared in multiple locations on two of our websites. Needless to say I'm recovering the sites from backups, changing our passwords and trawling the FTP ...
1
vote
2answers
208 views

MAC spoofing - keeping the connection alive

Is it possible to keep a connection alive, while spoofing/changing the MAC address of your own network adapter (especially wlan adapter), without needing to re-authenticate against 802.1X ...
2
votes
1answer
122 views

Non-trusted users on terminal services

We're considering to enable our >10 suppliers (mainly from China) to input/edit/view data via an unified interface. The preferred way is to use the same windows-based .NET/MSSQL application as used ...
0
votes
3answers
466 views

logwatch explanation

Could anyone please explain what the various parts of the following LogWatch mean: --------------------- IMAP Begin ------------------------ [IMAPd] Logout stats: ==================== User | ...
5
votes
4answers
2k views

Should / Can I use DNS Records to list “Private Hosts in Private LANs”?

This is a theoretical Question: Given I have several Serves that both have a Public IP Address as well as a private IP Adress (192.xxx Range). Both Addesses are used for different Services. I do not ...
7
votes
5answers
1k views

Web Server Security Overkill?

I've been doing "extensive" research on securing a linux web server. On top of what is considered the "basics" (removing unused services, hardening ssh, iptables, etc.) is it wise to include ...
2
votes
1answer
2k views

How to disable Ad Hoc Distributed Queries on SQL Server 2000

We juste had a security audit that found that, if you get access to our database (SQLInjection for example), you can easily send all the content of the database to a remote SQL Server. The ...
2
votes
1answer
6k views

Why is allowing the guest account network access considered insecure?

I was recently interested in allowing the guest account network access as related to a research project I was doing. This was on a Windows Server OS. The outcry was amazing....people freaking out ...
7
votes
8answers
4k views

How to detect a hidden process in linux?

We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was brought onto the team to resolve the situation and I am curious where ...
0
votes
2answers
504 views

Website needs to only be accessible from two specific iPad's and no other devices or IP's (PHP)

The business I work for has a website for employees to clock in and out of their work shifts. This website needs to be only accessible from our two in-house iPads. I tried doing a simple .htaccess ...
2
votes
3answers
594 views

Why are Wireless Networks more vulnerable to ARP Poisoning?

I have heard a lot of people mention that wireless networks are far more vulnerable to ARP poisoning attacks. Why would this be so? Why could you not employ similar protections as for a switched ...
4
votes
3answers
6k views

Does anyone have real-life examples of e-mail being intercepted?

As anyone will tell you, e-mail is not secure. It travels around the Internet in plain text and we should not use it for sending passwords and other sensitive details. For years I've been designing ...
0
votes
2answers
186 views

.htaccess regular expressions for optimal performance?

In my .htaccess file I'm trying to block some bots using: RewriteCond %{HTTP_USER_AGENT} ^badbot [NC] But, I want to change these conditions to something more inclusive like: Method #1: ...
1
vote
2answers
2k views

TCPDUMP = How to detect and analyse “Suspicious” Traffic to 192.xxx Addresses?

I just played a little bit with tcpdump (as I wanted to check why my mails are not getting send) and thereby discovered very strange and a lot of traffic to the "Private IPs". Please See examples ...