Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
1answer
491 views

Is Exchange protected from/allow back dated emails?

Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
1
vote
3answers
3k views

Java process eating CPU; Why?

I have a Linux server which I have installed Java on. Sometimes, and only sometimes when a large number of visitors visit my website, the site hangs. When I open the terminal and enter the "top" ...
6
votes
2answers
196 views

Securing a local server physically

We are an online business. We have a very powerful server with hard disk mirroring in our office that we are using for a variety of internal business-critical functions. We want to keep that machine ...
0
votes
1answer
107 views

Are there any default security settings I should be worried about in windows Server 2008 R2

I'm running Windows Server 2008 R2 (via Rackspacecloud) and now that I'm going live I'm just curious if there are any security settings I should "turn on" or other settings I should tinker with to ...
1
vote
3answers
186 views

most simple way to get files on a server

I am on windows and my server is linux. I would like to grab files from the server automatically with a script. Maybe execute a bash script remotely as well but maybe i dont need that. I need to ...
-3
votes
1answer
2k views

PuTTY - Server Unexpectedly Closed Network Connection

I have two servers that I have been able to connect fine as s1.website.com and s2.website.com I connected to s1.website.com earlier today without any issues, however, when I connected to ...
2
votes
2answers
239 views

General guide for securing windows server 2008

Is there a guide for securing windows server 2008? I seem to remember reading a MS doc on how to harden a Win2k server, but I can not find a publication for win2k8.
2
votes
5answers
1k views

SFTP: How to keep data out of the DMZ

We are investigating solutions to the following problem: We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
1
vote
2answers
733 views

Hide port in URL when 80/433 already in use

I need to add another secure instance of Tomcat in a server that already uses port 80 and port 433. Is there any way to hide the port number of the new instance, since I'll need to use one which is ...
1
vote
1answer
1k views

rhel configure: limit root direct login to systems except through system consoles

I have to configure to limit root direct access except system consoles. That is, the ways of telnet, ftp, SSH are all prohibited. Root can only login through console. I understand that will require me ...
5
votes
3answers
480 views

Should I host my entire web application using https?

Actually my only requirement for using SSL encryption is that when a user logs in, the password is transferred encrypted. However after reading a bit about protocol switching, that an HTTPS session ...
4
votes
1answer
1k views

Securing NTP: which method to use?

Can someone good at NTP configuration please share which method is the best/easiest to implement a secure, tamper-proof version of NTP? Here are some difficulties... I don't have the luxury of ...
1
vote
1answer
201 views

RSA fingerprint [closed]

what is the benefits of SSH RSA Fingerprint? and how does it different from PGP ? also how can i use it? are there any tool to do this? regards
0
votes
2answers
2k views

Best client and server antivirus for 5 user office? [closed]

I'm setting up an Active Directory environment for 5 users (very small) and I'm wondering what is the best antivirus for clients (Windows 7) and servers (Server 2008 R2 x64)? I use Symantec Corp at ...
0
votes
1answer
85 views

Running Radius on a Novell Backbone

I am a rookie network engineer and I've been asked to create a secure wireless system intergrated with an existing network. So far I'd decided to use 802.1x secuity with a Radius enabled server over a ...
0
votes
2answers
283 views

Windows Server 2003/2008: Please recommend security software and practices [duplicate]

Possible Duplicate: What do I have to configure on my server to increase security from default? Hello, I am a "returning" MS Windows Server admin, I haven't been in in MS server business ...
0
votes
1answer
899 views

A non interactive alternative to makecert

I have a need to create a self signed certificate non interactively. Unfortunately, the only tool that I know of (makecert) is interactive - it uses GUI to ask for a password. My OS is Windows (from ...
1
vote
1answer
229 views

phpmyadmin login should not expire on ubuntu 10.04

On ubuntu 10.04 the phpmyadmin config is a little bit scattered. I want to set the loginexpiration time to zero, should never expire, this is a secured setup behind a firewall. I think it is 3600 by ...
0
votes
4answers
3k views

how to protect telnet access to smtp port 25?

Please consider the following: 192-168-1-106:~ michael$ telnet <remote_server_ip> 25 Trying <remote_server_ip>... Connected to li*****.linode.com. Escape character is '^]'. 220 ...
5
votes
9answers
3k views

How can I test the security of my server?

How can I test the security of my server ? Please I know it is too general question. But I was wondering if there is a tester software or web service checking all ports of your server, or possibly ...
7
votes
5answers
4k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
2
votes
2answers
162 views

Personally identifiable information (PII) on shared web hosting

Hey folks, I am providing web hosting services (shared and dedicated) and have had one of my shared hosting clients mention needing an SSL cert for their site where they are collecting insurance ...
1
vote
1answer
464 views

Difference between SetEnvIf and RewriteCond?

In my .htaccess file, I'm currently using RewriteCond to match the user agent of bad bots. I know that SetEnvIf can also be used to block bad bots too. The question is, what's the difference between ...
6
votes
1answer
6k views

What should be the persmissions of apache ssl folder

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: 1) /etc/apache2/ssl folder 2) /etc/apache2/ssl/cert.pem file 3) ...
1
vote
7answers
307 views

Secure Server Distro

I have a root-server (i7/24GB/1TB) running Ubuntu 10.04 LTS as my OS. After some security audits (OpenVAS, Retina etc) I see that Ubuntu isn't the most secure system for a semi-corporate environment. ...
1
vote
2answers
475 views

User wants PHP to be able to write files in his directory

The user wants to let PHP write files in his /home/ directory, he is advising me to do usermod -a -G www-data username where username is his username. I wasn't sure if this was a security issue or ...
1
vote
3answers
1k views

Tools to monitor users activity on Linux/Unix servers

Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ...
0
votes
2answers
114 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
0
votes
2answers
85 views

Information about recent code injection from http://superiot.ru

I manage the hosting for a few dozen websites. Since about a week I've been finding this code in 12 different websites in theindex.php files: <script type="text/javascript" ...
1
vote
2answers
267 views

Configuring linux server firewall to allow access from a certain range of IP addresses

I'm new to linux server. I'm currently trying to get an Ubuntu 10.10 server up and running for the first time and I'm using Webmin for administration. I'm stuck on the setting up the firewall. What I ...
4
votes
1answer
620 views

Get SSH fingerprint from remote server securely?

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home. Is there any other ...
2
votes
3answers
202 views

Disallow root to su on a user which is not listed in /etc/passwd

On Linux we authenticate users against AD. The AD users are not listed on /etc/passwd. We are about to deploy a NFS solution to mount some extra space for each group of users. If a user(A) with sudo ...
1
vote
4answers
1k views

Securing bash scripts

Does anybody know what is the best way to secure bash scripts. I have a script which creates database and source code backup and ftp it to other server. And login/password for destination ftp are ...
6
votes
2answers
683 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
1
vote
4answers
142 views

Do I need a hardware firewall for Win 2003?

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to ...
1
vote
2answers
205 views

Is SSL to the proxy good enough?

We are currently trying to decide on how best to do SSL traffic in our environment. We have an externally facing Apache proxy server that is responsible for directing all traffic into our environment. ...
3
votes
4answers
1k views

VPN - Man-in-the-middle when connecting to a https service?

Choosing an off-the-shelf VPN service, is it safe to access my Gmail, Paypal, ... accounts? The accounts are accessed via https, but I don't know if with a VPN there is one secure channel between my ...
1
vote
2answers
382 views

How to restrict file system when logged into terminal services

What I need to accomplish: With one login, when user is physically in the building I need them to see everything. When they are using terminal services with same login they should not be able to see ...
3
votes
2answers
173 views

Secure corporate document storage

One of the more interesting arguments currently rumbling around the office is the lack of backup for the HR person's laptop. This contains a copy of the contract and other HR type info on every member ...
1
vote
1answer
321 views

Security / Permissions when multiple sites accessing single directory : SuPHP

I am on a HostGator "Basic" Dedicated linux server. A current project calls for an image library that is accessible from multiple sites on the server. We are running SuPHP so each site has a ...
3
votes
3answers
390 views

Looking for a way to audit/monitor removable media on a Mac

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her ...
0
votes
4answers
222 views

Security holes in in PHP 5.2.5

My shared hosting provider uses PHP 5.2.5, which was released at the end of 2007. I would like to know the security holes of PHP 5.2.5. Where I can get them? phpinfo
0
votes
2answers
1k views

Setting up PGP FTP

I have a situation where I need to setup a FTP server with PGP encryption. Currently I use FileZilla w/ SSL, but in this case we are required to use PGP. Any recommended products/procedures from ...
0
votes
1answer
281 views

Moving file security from one server to another (asp.net sites, IIS)

I am running windows server with asp.net websites and sql server 2008 and IIS 6. It is working fine. Now I need to move my asp.net websites to another windows server and I have hard time setting ...
0
votes
3answers
138 views

Where would I go to learn to make a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS)

Where would I go to learn to set up a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS). Note that I am not looking for a favorite choice between ...
0
votes
1answer
251 views

Hosting shared full trust asp.net sites while limiting their access to the registry & file system

I am planning to host some asp.net apps which require full trust. The sites will be under different domain names and I am the admin of the server. They will be hosted in Windows 2008 R2 (IIS 7.5). I ...
2
votes
4answers
351 views

Unauthorized SSH coming from my linux server

My ISP has contacted me stating that unauthorized attacks are coming from my LAMP server. Here is part of the log they have attached: 15:26:16.821245 IP My.Ip.is.here.59987 > ...
2
votes
3answers
2k views

How can I read the files stored on the hard drive of a Xerox 7242 printer?

So, I've read that most printers save the files they print/scan and I was trying to see if that's the case with our work printers. Is there a tool to let me access these files?
1
vote
3answers
267 views

Stopping PHP ability to read/write other PHP files

I host a very small hosting site that hosts a type of chat software. I give each user a /home/ jailed ftp but they have their own www folder they can upload things to. One of my users uploaded this ...
2
votes
2answers
465 views

multiuser PHP virtualhosting environment and security

I'd like to setup a multiuser PHP virtualhosting environment. However, here comes my big concern. Users could use the PHP filesystem functions to access the other users directories, thus read the ...