Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
506 views

403.7 - Client Certificate Dialog Not Prompted

Here is my scenario: Server: Windows 2K3 SP2 x86 IIS6, with a Web Site with SSL, requiring client certificates. The server certificate was issued by a CA (AD Directory Services). Client: IE8 with a ...
0
votes
2answers
3k views

How can I diagnose the cause of unexpected restarts on a Windows Server 2003 VPS?

At first I always assumed this was the host applying updates or doing some maintenance. But after contacting the company, they assure me I would have received prior notice before any such event. In ...
0
votes
1answer
70 views

Configure Apache2 to only respond to virtual hosts

Have a server that, while reviewing the logs, appears to get hit many many many times a day via the direct ip address by automated scripts looking for vulnerabilities. Entries like: [Sat Jul 31 ...
0
votes
1answer
106 views

Samhain: depth of “-1”

In a samhainrc file you are allowed to have a depth associated with your dir. Like so: dir=3/etc/tinydns But what does it mean when you have a depth of -1? ( I was not able to find anything in the ...
0
votes
1answer
233 views

Hosting shared full trust asp.net sites while limiting their access to the registry & file system

I am planning to host some asp.net apps which require full trust. The sites will be under different domain names and I am the admin of the server. They will be hosted in Windows 2008 R2 (IIS 7.5). I ...
0
votes
2answers
2k views

Allowing users to configure printer ports without full admin rights on Windows Server 2003 R2 Standard

At our organization, we have multiple levels of support personnel. The lowest (level 1) of these personnel deal with a single job site with about 40 printers. Each site has a Windows Server 2003 R2 ...
0
votes
3answers
1k views

Security groups not allowing domain admin to view files

This should be very simple. I have my Documents folders redirected to a share called //dc/documents. It creates a folder under this share for each person and then creates a folder under that for My ...
0
votes
1answer
963 views

Online scan detecting SQL Injection vulnerability

I have had my boss do vulnerability scans on our servers using online services and it's frustrating trying to explain that we don't actually suffer from the vulnerabilities that the reports say we do. ...
0
votes
2answers
86 views

Post Vulnerability Actions

To protect the guilty I will avoid names... I know of a site that last night went down. Sort of. For about 5 hours all requests to this asp.net site were producing a YSOD. The details that were spit ...
0
votes
1answer
850 views

windows server 2008 guest account issue

If I need to open guest acconut for Windows Server 2008, any security risks? Appreciate if anyone could recommend some readings and also how to resolve any potential security risks. thanks in ...
0
votes
2answers
340 views

Msmq authentication from asp.net site

If you have an asp.net site sending messages to a remote queue, how do you handle authentication. If Windows Authentication is turned off, the network service sends a message to the remote queue. Does ...
0
votes
1answer
674 views

How to create a user in ubuntu for ftp, and lock the account to a specific ftp folder

I want to create a ftp user on my ubuntu server, and lock the user to a specific folder to read/write to. I read I use the /usr/sbin/useradd but I don't see how I set the password? thanks in advance ...
0
votes
2answers
257 views

Best solution for development IIS to reach files via UNC share

What is the best way to configure security with IIS to allow developers local IIS instances reach a UNC share for documents that are in our deployed website but not a part of the development source?
0
votes
2answers
84 views

Sharepoint user can view site collections he is not a member of

as i understand sitecollection security ,member of a given sitecollection can not view another site collection where he has no membership ,my problem is that any user from a given site collection can ...
0
votes
3answers
192 views

How would you set up a one-way VPN?

I would like to set up a VPN between my LAN: Windows 7 Ultimate Desktop workstation OpenSuse 9.3 server and my co-located web server: Windows 2008 R2 Web Edition server (with just one NIC!) ...
0
votes
1answer
148 views

Open Source Software that combines Snort and Cisco Blocked Lists

There used to be this software that existed maybe 8-10 years ago (I thought it was maybe called FloodGate?) It worked by having a Linux box bridge running snort or prelude. When it detected a DOS or ...
0
votes
1answer
3k views

How to backup postfix?

I am putting together a list of things that I need to backup, on my website. I am using postfix for handling my mail. Which files in /etc/postfix (if any) do I need to backup? My goal is that after ...
0
votes
2answers
113 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
0
votes
2answers
176 views

New Secure Website with Apache Reverse Proxy

I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a ...
0
votes
2answers
241 views

security and hacking of mysql-servers

i'm very very new in questions such hacking, security, servers. Where i can read some documentation about security, and hacking of php(mysql) servers. Maybe you will give some links, where can learn ...
0
votes
1answer
106 views

Are there any default security settings I should be worried about in windows Server 2008 R2

I'm running Windows Server 2008 R2 (via Rackspacecloud) and now that I'm going live I'm just curious if there are any security settings I should "turn on" or other settings I should tinker with to ...
0
votes
1answer
379 views

What are the alternatives to using allow.sysvipc in a jail running PostgreSQL in FreeBSD

This question is prompted by this one. I've set up a jail to run PostgreSQL but without allow.sysvipc when creating the jail (or setting the relevant rc.conf entries), the system call to shmget are ...
0
votes
1answer
54 views

network folder share issue in Windows

I am using Windows Server 2008 Enterprise. I want to share a disk folder and I want users to be able to access directly (e.g. using \\10.10.10.123\shared in Windows resource explorer) without using ...
0
votes
1answer
433 views

Windows: Audit/View logins from remote networks?

i want to audit remote connection attempts to a Windows 2003 Server. i've changed the group policy to show logon successes and failures: >gpedit.msc Local Computer Policy Computer ...
0
votes
1answer
1k views

How to set Windows Services permissions from Powershell?

I need to grant a specific account SERVICE_START permissions for a given Windows service. There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and ...
0
votes
2answers
224 views

Give a domain group full control to the profile folders of all servers and workstations

I have a domain group (called GSG_TECH_USER) which need "full control" right to the folder "document & setting" of all servers and workstation. I made a test with this configuration: On a ...
0
votes
3answers
1k views

Finding outbound connections from Apache/PHP

A client website was recently compromised, and we're analyzing the damage and exposure from the attack. We've found a script that is "calling home" to a URL we can easily find in a log, but is this ...
0
votes
2answers
215 views

Should smtp port be blocked on server?

I have a newbie security related question. Should port 25 (smtp) be blocked by firewall on my server? Or will doing so mean that i cannot send any mail at all? Maxwell: I basically have my own mail ...
0
votes
1answer
112 views

What are the steps needed to achieve EAL4

I read the wikipedia article on EAL (http://en.wikipedia.org/wiki/Evaluation_Assurance_Level) but didn't find it very helpful in laying out the steps needed to achieve EAL4. Can someone please lay out ...
0
votes
2answers
466 views

How to secure Cpanel/WHM from malacious uploads [duplicate]

Recently my site's index.php file was replaced with some malicious javascript code. I really don't know how it was added to the page. Today when I tried to download the file via FTP, my local ...
0
votes
2answers
328 views

Password protect with apache2.conf works on files, but not on ports

I have changed the apache2.conf so that my website requires authentication. This works fine when typing the adress like this: www.domain.com or my_ip/ Problem is, I have Solr, which admin interface ...
0
votes
1answer
1k views

Basic IPTables setup for OpenVPN/HTTP/HTTPS server

I'm trying to get a basic IPTables setup on my server which will allow HTTP/SSH access, as well as enable the use of the server as an OpenVPN tunnel. The following is my current rule setup - the ...
0
votes
2answers
40 views

Ubuntu server users question

I have read this article: https://help.ubuntu.com/9.04/serverguide/C/user-management.html But it doesn't go into depth with the privileges section. I need to know how to set privileges of me (as a ...
0
votes
1answer
269 views

How to set up Drupal Plugin Manager on MAMP in a secure way?

I use MAMP PRO as global webserver. First of all, is it a good idea? Secondly, my objective is to run a Drupal website with as easy management as possible. Now I want to use Plugin Manager module to ...
0
votes
1answer
66 views

Users in ubuntu; Cant figure it out

I am the only one who will have access to my website. Just installed my VPS and managed to get most stuff working. However, stuck on the "members" part. Currently, everything has been done as ...
0
votes
2answers
544 views

AWS EC2: How to determine whether my EC2/scalr AMI was hacked? What to do to secure it?

(See update below) I received notification from Amazon that my instance tried to hack another server. there was no additional information besides log dump: Original report: Destination IPs: ...
0
votes
6answers
2k views

Is my dns server being attacked? And what should I do about it?

I've been having some intermittent dns problems with a web server, where certain isp's dns servers don't have my hostnames in cache and fail to look them up. At the same time, queries to opendns for ...
0
votes
2answers
811 views

Protecting DNS entries from duplicate hostnames entering network

Given a Windows domain, with DNS provided by a server on that domain, I am curious about what happens if a guest joins the network attempting to use the same hostname as an existing server, and then ...
0
votes
3answers
766 views

SharePoint extranet security concerns, am I right to be worried?

We are currently running MOSS 2007 internally, and have been doing so for about 12 months with no major issues. There has now been a request from management to provide access from the internet for ...
0
votes
1answer
296 views

Blocking IP Range in .htaccess Problem

I'm trying to block the access of one of my webapps using IP Filter in the .htaccess, the problem is that after updating the file with: order allow,deny deny from 58.14.0.0/15 allow from all I get ...
0
votes
1answer
206 views

Is it a bad idea to run an asp.net app pool with the same identity as IIS's anon user?

Subject says it all really, Thinking on security terms, I want to give each site on my server its own user account, so that they can't access each other's data. I also want to use integrated ...
0
votes
1answer
168 views

Lock down SFTP access on OpenSolaris

I have an OpenSolaris 2009.06 server and I'd like to enable a user to remotely change files in a specific directory, ideally via SFTP or FTP-via-SSH. This user does not yet have an account on the ...
0
votes
1answer
602 views

How can I have APF block script kiddies that mod_security detects?

In one of the vhosts' error_log I found thousands of lines like these, all from the same IP: [Mon Apr 19 08:15:59 2010] [error] [client 61.147.67.206] mod_security: Access denied with code 403. ...
0
votes
2answers
115 views

protect my web server

how can I know who enter web server and how can I protect my IP from others?
0
votes
1answer
275 views

Moving file security from one server to another (asp.net sites, IIS)

I am running windows server with asp.net websites and sql server 2008 and IIS 6. It is working fine. Now I need to move my asp.net websites to another windows server and I have hard time setting ...
0
votes
1answer
262 views

Which Linux Distro has TARPIT out of the box?

I need TARPIT. Im worried to patch the kernel as it may result in unexpected problem. So, Which Linux Distro has TARPIT out of the box? thanks.
0
votes
4answers
533 views

How to find systems with vulnerability which may later become agent for DDoS?

How to determine the systems with vulnerability, which scanning tool is best. The system should be identified so that it can be used as agent for DDoS. In a test bed environment I want to check ...
0
votes
1answer
377 views

IIS7 authentication

To give our user's the ability to protect content on their IIS6 sites we used a tool called IISPassword which emulates .htaccess to provide Basic authentication. There isn't support for IISPassword ...
0
votes
1answer
207 views

Running .net application over a network

I need some advice please. I need to enable a .Net application to run over a network share, the problem is that this will be on clients network shares and so the path will not be identical. I've had ...
0
votes
2answers
84 views

Secure data hosting

I've looked online and can't seem to find a proper answer. We have a client that requires very sensitive data be stored in a database. Is there a hosting company that provides high-level database ...