Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
2answers
114 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
0
votes
2answers
85 views

Information about recent code injection from http://superiot.ru

I manage the hosting for a few dozen websites. Since about a week I've been finding this code in 12 different websites in theindex.php files: <script type="text/javascript" ...
1
vote
2answers
267 views

Configuring linux server firewall to allow access from a certain range of IP addresses

I'm new to linux server. I'm currently trying to get an Ubuntu 10.10 server up and running for the first time and I'm using Webmin for administration. I'm stuck on the setting up the firewall. What I ...
4
votes
1answer
614 views

Get SSH fingerprint from remote server securely?

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home. Is there any other ...
2
votes
3answers
202 views

Disallow root to su on a user which is not listed in /etc/passwd

On Linux we authenticate users against AD. The AD users are not listed on /etc/passwd. We are about to deploy a NFS solution to mount some extra space for each group of users. If a user(A) with sudo ...
1
vote
4answers
1k views

Securing bash scripts

Does anybody know what is the best way to secure bash scripts. I have a script which creates database and source code backup and ftp it to other server. And login/password for destination ftp are ...
6
votes
2answers
681 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
1
vote
4answers
142 views

Do I need a hardware firewall for Win 2003?

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to ...
1
vote
2answers
205 views

Is SSL to the proxy good enough?

We are currently trying to decide on how best to do SSL traffic in our environment. We have an externally facing Apache proxy server that is responsible for directing all traffic into our environment. ...
3
votes
4answers
1k views

VPN - Man-in-the-middle when connecting to a https service?

Choosing an off-the-shelf VPN service, is it safe to access my Gmail, Paypal, ... accounts? The accounts are accessed via https, but I don't know if with a VPN there is one secure channel between my ...
1
vote
2answers
380 views

How to restrict file system when logged into terminal services

What I need to accomplish: With one login, when user is physically in the building I need them to see everything. When they are using terminal services with same login they should not be able to see ...
3
votes
2answers
173 views

Secure corporate document storage

One of the more interesting arguments currently rumbling around the office is the lack of backup for the HR person's laptop. This contains a copy of the contract and other HR type info on every member ...
1
vote
1answer
320 views

Security / Permissions when multiple sites accessing single directory : SuPHP

I am on a HostGator "Basic" Dedicated linux server. A current project calls for an image library that is accessible from multiple sites on the server. We are running SuPHP so each site has a ...
3
votes
3answers
386 views

Looking for a way to audit/monitor removable media on a Mac

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her ...
0
votes
4answers
203 views

Security holes in in PHP 5.2.5

My shared hosting provider uses PHP 5.2.5, which was released at the end of 2007. I would like to know the security holes of PHP 5.2.5. Where I can get them? phpinfo
0
votes
2answers
1k views

Setting up PGP FTP

I have a situation where I need to setup a FTP server with PGP encryption. Currently I use FileZilla w/ SSL, but in this case we are required to use PGP. Any recommended products/procedures from ...
0
votes
1answer
281 views

Moving file security from one server to another (asp.net sites, IIS)

I am running windows server with asp.net websites and sql server 2008 and IIS 6. It is working fine. Now I need to move my asp.net websites to another windows server and I have hard time setting ...
0
votes
3answers
137 views

Where would I go to learn to make a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS)

Where would I go to learn to set up a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS). Note that I am not looking for a favorite choice between ...
0
votes
1answer
250 views

Hosting shared full trust asp.net sites while limiting their access to the registry & file system

I am planning to host some asp.net apps which require full trust. The sites will be under different domain names and I am the admin of the server. They will be hosted in Windows 2008 R2 (IIS 7.5). I ...
2
votes
4answers
349 views

Unauthorized SSH coming from my linux server

My ISP has contacted me stating that unauthorized attacks are coming from my LAMP server. Here is part of the log they have attached: 15:26:16.821245 IP My.Ip.is.here.59987 > ...
2
votes
3answers
2k views

How can I read the files stored on the hard drive of a Xerox 7242 printer?

So, I've read that most printers save the files they print/scan and I was trying to see if that's the case with our work printers. Is there a tool to let me access these files?
1
vote
3answers
267 views

Stopping PHP ability to read/write other PHP files

I host a very small hosting site that hosts a type of chat software. I give each user a /home/ jailed ftp but they have their own www folder they can upload things to. One of my users uploaded this ...
2
votes
2answers
465 views

multiuser PHP virtualhosting environment and security

I'd like to setup a multiuser PHP virtualhosting environment. However, here comes my big concern. Users could use the PHP filesystem functions to access the other users directories, thus read the ...
1
vote
1answer
240 views

Apache2 Virtual Host Restrict to Localhost

So here's the deal. I have multiple virtual host. Each virtual is a separate domain. Each domain is for separate applications. Lets say I have virtual hosts for: http://.abc.com http://.def.com ...
3
votes
1answer
231 views

Onscreen keyboard with RSA Authentication Agent on WIndows

I'm attempting to integrate a touch panel into our secured environment. As such, the touchpanel requires that the user login via RSA SecurID. Unfortunately, there is no exposed keyboard for the user ...
7
votes
6answers
598 views

Why are we advised to not log into SSH as Root [duplicate]

Possible Duplicate: Why shouldn't root be allowed to login via ssh? Hi, Why is it safer to not log in as root via SSH? Since the login is SSH protected the root password is not in plain ...
1
vote
3answers
230 views

Block a specific host from accessing my server?

Using a log monitoring tool I had noticed an IP had attempted 100-200 logins as root though failed (PAM's logs caught that), those IPs differ slightly but originate to one single domain which is a ...
10
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
1
vote
1answer
88 views

Securing open access point

I need to have multiple yet unknown devices to connect to an open wireless AP. I plug various mesurement instruments on this wireless network I also have an existing network with multiple desktops ...
1
vote
1answer
973 views

Auditing events 4656 and 4658 on Windows folder on Server 2008

During an overnight system state backup we are seeing thousands of success audit events (4656, 4658) on the folder c:\windows\servicing, system32 and others in the windows folder. We use file success ...
4
votes
8answers
453 views

Security concerns about Windows NT 4.0

My company is (amongst many other things) responsible for a small network with a few servers and about 50 workstations. They want me to help out the current administrator of that network. The network ...
1
vote
4answers
231 views

How vulnerable are our servers?

Many times I hear that big entities such as NASA, Gov places, big enterprises get attacked somehow. So my questions is, if those huge places get hacked, then it could easily be us. I assume those ...
1
vote
4answers
212 views

Linux web severs and security essentials (and beyond the essentials)

I'm learning Java, PHP, HTML, xml, ajax and other web and Linux related stuff. Once every while I find someone giving me cryptic and scary warnings about security, say: "...if connected to Internet ...
2
votes
4answers
498 views

ARP packets never routed?

is it true ARP only works in single broadcast domain and arp packets are not routed frm 1 network to another ? can any one give me any example or any source of info for this hoping for positive ...
1
vote
1answer
223 views

Regular expression not working in .htaccess

I'm trying to limit which characters can be used in the request URI using: RewriteEngine on RewriteCond %{REQUEST_URI} !^([a-z0-9\:\/\.\_\-]) [NC] RewriteRule ^.* - [F,L] For some reason it's ...
0
votes
1answer
157 views

Script to get the Email Alerts for RDP Session

Is there any script to get the Email Alerts when someone logs into the server so that I can increase server security by getting the Email alerts. Any help would be appreciated
1
vote
3answers
595 views

Lockdown a laptop to prevent file copying

Is it feasible to lock down a user account on a Windows 7 or Windows Vista laptop so that it's not possible to copy files off of it? (e.g. disable all internet access, disable USB ports or at least ...
3
votes
1answer
522 views

Sharepoint 2007: Two entire site collections went read-only overnight, the other 5 are fine

Myself and a coworker are both Site Admins for every site collection we've got. Well, until Friday night. Most admin privileges were disabled for two entire site collections. There is no custom ...
21
votes
16answers
1k views

Why is it bad to have a weak mysql user password?

I was presented with an argument to the tune of "you don't need a strong mysql user password because in order to use it, they'd already have access to your server." We're talking about a 4 digit ...
0
votes
2answers
365 views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...
8
votes
3answers
12k views

Failed to generate a user instance of SQL Server

I'm using Windows 7 Beta and trying to install a web application locally. This web site uses Microsoft SQL Server 2005 Express (SQLEXPRESS) and a MDB file in the web site's ~/App_Data folder. I was ...
4
votes
2answers
1k views

iptables and blocking potentially impossible traffic

I am working on some iptables firewall rules and have seen many examples that suggest the importance of blocking potentially impossible traffic from non-routable IP address spaces. This would include ...
0
votes
2answers
128 views

Securing Linux Users

I would like to know what is best solution for securing linux user account on application and database server (JBoss, Tomcat, mysql database).Lets asume i have user jboss for running JBossm and user ...
0
votes
1answer
107 views

help me setup a good security policy

i'm running a site on a shared host while image hosting is done on amazon s3. i've opened a second shared host account for backups. here's my setup : A -> site on shared host, pushes images to B (s3 ...
2
votes
1answer
1k views

How to run Apache as another user? (as 'www', or 'apache') on my

I just recently deployed a LAMP stack that came as a package for Linode (a VPS host), I can successfully run Apache 2 but the process and all my files within are owned by root. On my shared web host I ...
1
vote
5answers
710 views

Enforcing a single-use policy with .PDF files

My organization has some Confidential (as in statutory requirements confidential) documents that go out to certain people and committee groups prior to their release into public domain. These ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
2answers
1k views

NTFS allow Read/Write/Modify, but not Copy

Is it possible to allow users to modify and read files/folders but not copy them to other locations? Problem is I have a folder that users need to read and modify files in, but I don't want them ...
1
vote
3answers
173 views

Securing VPN access from users machines (home office)

We already have a couple of people working from home, accessing some internal servers via VPN. They're all using company provided laptops or PCs which we have complete control over. Now we're faced ...
1
vote
1answer
973 views

Force screensaver lockout for multiple users on one Windows 7 PC

We have a single PC that requires the following accounts: 2x Admin accounts for each named responsible administrator (That's me and my boss). The accounts have to be associated with our names for ...