Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
3answers
82 views

Shared MySQL Database Security

I'm hoping to run a mysql server that would be accessed by 2 servers (one on linode, and one on amazon). So far we've just had the mysql server hosted on the linode box locally - so we haven't had to ...
3
votes
3answers
1k views

CentOS PCI Compliance assessment

We are currently working our way through a PCI compliance assessment on our server running CentOS. We are getting a lot of 'severe' issues with suggested fixes. The suggestions to rectify the issues ...
3
votes
4answers
146 views

SSH Access for contractors

We've recently hired an outside programmer to develop some new backend systems for us. He's requested SSH access into our webserver. We've worked with him for years and I trust him as much as any in ...
3
votes
3answers
6k views

Disable directory listings with 404 instead of 403

I've disabled directory listings like so... Options -Indexes When I try and access a directory like this:- www.example.com/secret/ I get a 403 Forbidden response. However, I want a 404 Not ...
-1
votes
1answer
269 views

Is it safe to make ssmtp SUID root?

I'm using ssmtp, and I would like to not make my /etc/ssmtp/ssmtp.conf world-readable, because it has my gateway password in cleartext. But if it is mode 600, then ssmtp run as an unprivileged user ...
8
votes
2answers
5k views

How secure is Remote Desktop Connection?

When using Remote Desktop Connection, is the information being sent back and forth securely, as in SSL? Are usernames and passwords secure? When connecting to a remote server through Remote Desktop ...
4
votes
2answers
606 views

Possible malware on my server, how to search the source?

Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears. The message is something like "The remote address has ...
0
votes
3answers
121 views

Help on securing WIndows

I have 2 systems running MSWindows Server 2003 and 2008 respectively. I have done all the updates. I am interested in securing them e.g. close all unneeded services. For example my concern is that if ...
2
votes
2answers
2k views

Webserver logs: “Morfeus F***ing Scanner”

I've just found these accesses in my web server log files: ::ffff:218.38.136.38 109.72.95.175 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner" ::...
2
votes
2answers
360 views

Block certain parts of Facebook at work

I would like to be able to block work staff from accessing their personal facebook accounts BUT would like them to be able to retain the ability to access our own company facebook page. Is this ...
3
votes
5answers
223 views

Scanning website for vulnerablities

I have found that the local school's website installed a Perl Calendar - this was years ago, it has not been used for ages, but Google has it indexed (which is how I found it) and it full of Viagra ...
3
votes
2answers
78 views

How do you check that servers/pcs are not infected

Simple question. Developers PCs have to have free access to network, including servers etc., and they have to have administrative access to perform work effectively. However developers also use a lot ...
0
votes
1answer
119 views

Windows Server 2008 Permissions for Application Support

I need to create a group on our Windows Server 2008 R2 boxes, that allows members to perform the following administrative tasks: Unrestricted access to he file system (although all activity logged, ...
0
votes
2answers
181 views

Should I ever configure a host with a public IP address to accept traffic from a private IP address?

I connect the 'net with a public static IP (my router's IP address for NAT) and a /29 subnet (for machines behind the router). On my router, I have: #sh ip route | inc x.x x.x.0.0/16 is ...
0
votes
4answers
432 views

Webserver and PHP File Security

I'm trying to figure the right security settings for the files on my shared webserver and I have a few basic questions that I've not figured out by looking around. How do I stop people reading my PHP ...
0
votes
1answer
137 views

Is it possible to have my AD logon authentication outside of my network?

We run an AD with 2003R2. I am in the process of doing Google Directory Sync, after that the plans are to go with SSO for Google Apps, and than I plan to have all our 3 world sites connected. It just ...
1
vote
1answer
93 views

Concerns regarding exposing ip and open port

I've written a server. It's written in java and only sorts connections away if they've connected within the last second. I'm concerned about exposing my IP and which port is open. What are the ...
3
votes
1answer
3k views

read write permission in root of drive c: in windows XP

What is the best way to give all users of windows XP access to create/write to files in c: drive. I do not want those permissions to be inherited to all other folders on the same drive. This access is ...
4
votes
5answers
204 views

Securing Internet and E-mail in small corporate environment

Our company is having a real problem with spam, phishing, and sophisticated viruses (ones that are brand new at time of first download, and not recognized by any virus scanners for at least a few ...
0
votes
3answers
350 views

Which steps to take to protect java server from cpu overload?

I've written a java server application for a software solution I'm fiddling with. The server uses multithreading to handle sockets and postgresql as a database. I'm worried about potential evil-doers,...
0
votes
1answer
101 views

Win Server 2003/Terminal Services Remote Access

Office users access a win2003 server from within the office using thin clients and terminal services. In reviewing the security settings it seems, by default, all users in the 'Remote Desktop Users' ...
2
votes
3answers
1k views

My wordpress site got hacked. How I trace the cause of the issue? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Someone was able to hack my Wordpress 3.2.1 installation, get access to the control panel as an admin and temper with the theme's ...
2
votes
1answer
209 views

Issue of tracking an email that was “lost in cyberspace”

The issue here is one of an email that has been "lost in cyberspace." The receiver is claiming never to have received it. However, I recieved an automated out-of-office reply as a response to my email....
0
votes
2answers
179 views

apache running as uid 0

Today morning I had powered on one of my machines after 2 months and apache was not running as daemon after digging here and there I found in /etc/init.d/ following files -rwxr-xr-x 1 root root ...
0
votes
2answers
228 views

Should smtp port be blocked on server?

I have a newbie security related question. Should port 25 (smtp) be blocked by firewall on my server? Or will doing so mean that i cannot send any mail at all? Maxwell: I basically have my own mail ...
0
votes
2answers
463 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
1
vote
2answers
594 views

How to ban potential hacker IP Addresses from Port 80?

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an ...
0
votes
2answers
128 views

Oracle Security Update Patch July 2011 - How to know if i am affected?

Oracle Security Update Patch July 2011 I am using JDK 1.4.2_08, 1.4.2_19, 1.4.2_22, and Oracle DB 9.2.0.8. Can any experts tell me how to tell if i am affected, i.e. after installing the patch ...
0
votes
1answer
1k views

Nginx: Run fastcgi process under individual owners, like suexec on Apache?

I've had issues with Apache 2 on my server of which I had an Apache2-worker/php-fpm setup and am migrating to Nginx. I've followed various guides to set up the wrapper script for fastcgi spawning ...
2
votes
2answers
91 views

How to structure the “authentication graph” of a group of frontend/backend servers?

I'm taking over a bunch of servers as a newbie sysadmin, which include a frontend web server, and several backend servers that hold databases that include private information of the users of the web ...
1
vote
2answers
2k views

CentOS Vulnerabilities - Exploits/Payloads

I'm doing an academic work where I have to find vulnerabilities in CentOS and show how to take advantage of those same vulnerabilities. I'm no hacker and I'm finding this task to be of great ...
3
votes
1answer
549 views

Stopping SYN DDoS Attack [duplicate]

One of my servers is under constant SYN DDoS attack. I have decided to setup fail2ban but as far as I can understand, that will only take care of the ssh login attacks. How can I stop these SYN DDoS ...
0
votes
2answers
83 views

Security track record of unix programs [closed]

I'm looking for a database with all the noteworthy unix programs with a timeline of vulnerabilities found in that individual product in some categories (remote/local, DoS, privilege elevation, data ...
2
votes
1answer
1k views

Minimum SQL login permissions for an AD domain group

I've created a web application that uses a SQL Server 2008 R2 database in the background. Application uses integrated security SSPI connection to database so users need granted access to database ...
3
votes
2answers
162 views

Need to convert WinXP desktop into a WinXP-based server, suggestions? (more details inside) [closed]

My company's IT department would be better named the "computer purchasing and LAN cable maintenance department" because that's just about the limit of their abilities. In my division we just had a ...
1
vote
1answer
109 views

Staging and Development Server Accessibility Restrictions

I have some staging and development web servers on cloud hosting. I do not want them to be accessible to the general public. It's easy enough to restrict access by network or authentication. The ...
0
votes
1answer
64 views

How to create special groups and give them special process

I have many admins on the network and I want to specify job for them for example I want to create group responsible for install and run yahoo messenger means I don't want to give them full admin ...
2
votes
1answer
208 views

Is a firewall really necessary? [duplicate]

Possible Duplicates: Why should I firewall servers? Why would I need a firewall if my server is well configured? For a single web server that only listens on 22/80/443, is a firewall (...
0
votes
1answer
127 views

Security & Malware Protection for Windows 2008 Server (with RDP)

I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
0
votes
1answer
72 views

How do i grant my windows user access to a production database restored to my local machine?

So I am trying to migrate schema changes to my production system. To do this I want to first test the schema changes on a local backup of my production database, so I downloaded the latest backup ...
-4
votes
1answer
107 views

How to protect against attack against a domain name? [closed]

A friend has a domain name which redirects to another through the domain registrar control panel. A few hours ago the server hugely slows down. When he removes the redirection server runs normally. ...
1
vote
1answer
162 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...
1
vote
2answers
159 views

Secure password less ssh between Macs and Linux

Okay so I ssh a lot, mainly from my Macs to my Linux boxes but sometimes also from a Linux box to a mac or from a Mac to a Mac. I would want to implement a secure passwordless way to ssh between these ...
1
vote
2answers
122 views

security implications of ~/.ssh/config

I am worried about the security implications of using ~.ssh/config. If somebody steals my home computer and looks in my ~/.ssh/config file, they would immediately know which other computers I'm using ...
2
votes
1answer
969 views

Why is SSH suddenly complaining about permissions on .ssh directory?

This morning when connecting to my Ubuntu VPS, my local computer is suddenly complaining about my private key: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
0
votes
1answer
103 views

Web Browser Kiosk Temporary Internet Files

For a PC that is set up as a kiosk always running a web browser, are there settings available in the major web browsers to delete the temporary internet files periodically? I know Firefox has ...
0
votes
1answer
81 views

Which brands of wireless routers and DSL modems care about security? [closed]

Which vendors have established a strong security process during development where they educate firmware developers about security issues, arrange security engineers to review the code, accept ...
1
vote
1answer
40 views

Create groups in svn

I have a svn repository, but I want to control the access, For example one of the group have access for test folder but don't have access for the test2 folder. It's possible this, or I have to create ...
1
vote
1answer
285 views

Which is more secure - windows authentication or encrypted config sections?

I recently had this discussion with a colleague. We need to secure the connection strings that are in our .config files (for SOX compliance) and found two options: Encrypt the connection string ...
1
vote
1answer
165 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...