Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
3answers
1k views

How to set the ulimit (fd) when you fork a process?

Normally /etc/security/limits.h only work when you login into a shell. How about when you fork a process in Linux, where is the value of Max open files of /proc/PID/limits is controlled by?
0
votes
2answers
98 views

Can't get rid of Apache server-status

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server. I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP ...
0
votes
2answers
622 views

Script to check server for WordPress installs and report version information [closed]

I'm looking for a script that can be run on a linux server that will find all WordPress installs and report their versions, or report if a version is out of date. I've googled for something and it ...
0
votes
1answer
424 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
1answer
62 views

How to find on the Windows 7 who and when use(d) a certain share?

We have a workstation using Win7 on a LAN with a domain. On that workstation we set up some network shares. Can we find who used (user name and/or computer name) and when the shares? Note that we ...
0
votes
2answers
168 views

Why should I keep the root user if I'm not supposed to use it?

I'm on a fresh VPS with Ubuntu Server 12.04. I wanted to ask you the good practices to apply to enhance security over a stock Ubuntu-server. This is what I did up to now: I added Google Authenticator ...
0
votes
2answers
3k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
0
votes
1answer
351 views

Can /etc/hosts.deny/allow be overridden?

I have security measures put in place to keep unwanted users out of my server. I've changed the SSH port, disabled root login, have a software firewall to block portscans, and have entries in hosts....
0
votes
2answers
1k views

vsftpd whitelisting

How do you whitelist IPs for the service to allow only certain subnets on? Do I use IPTables or is there an easier way like IPWrappers Do you have to register the service for it to work with ...
0
votes
1answer
3k views

Iptables: Block all countries except my own for specific port

I would like to block all IPs (CIDR 0.0.0.0/0) except for German IPs for the SSH, FTP and SMTP ports. So, the default policy for those ports should be "DROP". I have a list of all German IP CIDR-...
0
votes
1answer
2k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
0
votes
1answer
417 views

How to restrict user to run and use only one program running on my server?

I have a cloud server running windows-server-2008 and i want my customer to log in to the server using remote desktop and the customer can run my own program only , he should not be able to run any ...
0
votes
3answers
1k views

How can I tell which ColdFusion hotfixes are installed?

I saw the new secruity hotfix for ColdFusion on adobe.com, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765. How can I tell which ColdFusion hotfixes ...
0
votes
4answers
383 views

How to determine the cause of high resource usage for two hours last week?

I know there are several tools I can use to find out what's causing heavy network and CPU usage right now, but every so often on my server I'll check the logs and notice that there were periods of ...
0
votes
1answer
59 views

How to protect file if physicall access to the server is possible? W2008R2

Is there a way to protect exe if server is on colocation hence the physical access is possible for the colo people? I have W2008R2 and was thinking of using BitLocker but it seems encrypting the whole ...
0
votes
1answer
183 views

My website keeps being hit by iPhones…am I being DDOSed?

66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
0
votes
2answers
139 views

Scanning Vendors (non-PCI related) - Hype or Not?

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL ...
0
votes
2answers
128 views

Oracle Security Update Patch July 2011 - How to know if i am affected?

Oracle Security Update Patch July 2011 I am using JDK 1.4.2_08, 1.4.2_19, 1.4.2_22, and Oracle DB 9.2.0.8. Can any experts tell me how to tell if i am affected, i.e. after installing the patch ...
0
votes
2answers
201 views

Hide SQL Server 2008 from attackers

I am using an MS-SQL Server 2008 instance as back-end DB server for a project. I did some security tests on the machine hosting my project and SQL Server and got the following report on SQL Server: ...
0
votes
4answers
422 views

Safety concerns on allowing connections to MySQL with no password on localhost?

In the case of a Linux system, is there any security concern to let MySQL users with standard privileges (that is, not the root users) connect to the database with no password from localhost? I think ...
0
votes
3answers
2k views

Security: How to check if our server is hacked?

Our server are hosting a website, but we find our database are added some tables, so we suspect if the server was hacked ? How can I confirm this and solve it ?
0
votes
2answers
297 views

Windows Server 2003/2008: Please recommend security software and practices [duplicate]

Possible Duplicate: What do I have to configure on my server to increase security from default? Hello, I am a "returning" MS Windows Server admin, I haven't been in in MS server business for a ...
0
votes
2answers
2k views

Setting up PGP FTP

I have a situation where I need to setup a FTP server with PGP encryption. Currently I use FileZilla w/ SSL, but in this case we are required to use PGP. Any recommended products/procedures from ...
0
votes
1answer
516 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
0
votes
3answers
66 views

One of my VPSes is very sluggish usually past midnight ( 1-5AMish )

I've noticed that on one of my VPSes ( debian 5 lenny ) ( not my linode ones but a host I used prior to linode ), the filesystem is very, very sluggish past midnight. If I try to use the command ...
0
votes
3answers
514 views

Database security guidelines and tips

I have been recently hired by an event-planning company to create a web application that will allow online payment for specific events and keep a list of registrants. My employers are asking for a ...
0
votes
6answers
120 views

Which are services or programs do I need to watch from linux security point of view

I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password. i just saw ...
0
votes
3answers
3k views

Win2003 Folder sharing : Group permissions not working while user permissions work

I'm very new to windows server. I'm a software engineer but since we don't have a real sysadmin I'm supposed to figure out everything that is slightly computer related (you know how it is...). I need ...
0
votes
1answer
2k views

What is host/computer SID in Windows AD? and what is needed to identify the elements of network with it? [closed]

SID as http://en.wikipedia.org/wiki/Security_Identifier 1) Help me to clarify the concept of computer SID on hypothetical situation: suppose, I want to secure a network cable (for ex., from a ...
0
votes
2answers
626 views

Potentially vulnerable to CVE-2009-3555

When checking my (secure) site https://www.just-great-software.com/ with Firefox 3.6.6 the Error Console shows: www.just-great-software.com : potentially vulnerable to CVE-2009-3555 Is this ...
0
votes
2answers
2k views

Only allow ssh connections to a specific domain

I have a server setup with several domains and subdomains. I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured. Connecting ...
0
votes
2answers
369 views

Ubuntu server security; Is this enough?

I have a classifieds website, which uses php5 and mysql, and also java (solr). I am new to linux and VPS... I have installed SSH, and I have installed IPtables, and also I have PuTTY which I use as ...
0
votes
3answers
599 views

Is it good to defense for DOS attacks with 2 request/sec?

Lots of example told me to defense with 5 or 4 request per second. Because usually a visitor clicking about in 1 or 2 links in one second, I think defense with 2 request per second is just fine. But ...
0
votes
2answers
274 views

I found a Ukranian spammer and have the exact query, IP and access time. What next?

Before I turned on comment moderation, these guys would leave comments meant to steal my Google juice (by getting an inbound link). I can still see them visit... the question is what should I do ...
0
votes
3answers
976 views

Is AuthType Basic secure when used over SSL?

I am authenticating clients of an apache2 server using AuthType Basic over SSL secured connections. I imagine these are secure, as the usernames and passwords are encrypted before they are sent to ...
0
votes
2answers
99 views

Accesibility of modified EC2 instances

This page on EC2 documentation site describes how to modify and store an EC2 instance. What it does not specify is whether the resulting instance is publicly available or not. How, and where do you ...
0
votes
3answers
906 views

Windows Server 2008 Firewall: Do inbound rules override outbound rules?

I have in inbound rule to allow all communication with MyApp.exe I have an outbound rule to block all traffic to 192.168.0.88 Can MyApp.exe communicate with 192.168.0.88 - I don't understand which ...
0
votes
2answers
418 views

Securing /var/www

I always did this: chown apache2:apache2 /var/www/ -vR chmod 555 /var/www/ -vR chmod 755 /var/www/a/special/dir/which/needs/write/permissions/ -vR OR instead of 2, 3 just set permissions to 755 ...
0
votes
6answers
1k views

Disable User Account Remotely

I work for a highly distributed IT based consulting firm with approximately 150 users in the field at different client sites at any given time. As we have grown we have needed to ability to disable a ...
0
votes
1answer
56 views

Microsoft patching folders

After extracting a Microsoft security patch, I got several folders containing the updated DLL. For Windows XP SP3 I have two folders: SP3GDR and SPQFE. Does anyone know what is the difference between ...
0
votes
3answers
300 views

Sharing directories in a Windows Workgroup

What is the best way to share and give permissions to certain users/computers in a workgroup? Does each user need the same account/password on every computer to have access to each others shared ...
0
votes
1answer
22 views

How to disable systemcalls in ftp environment with vsftpd?

I've set up a vsftpd server with local users jailed within their home directories. Anyhow if I connect through a ftp client I can execute systemcalls with the "!" command. How can I configure vsftpd ...
0
votes
1answer
48 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
0
votes
1answer
634 views

How to upgrade ubuntu 14.04 to openssl version 1.0.1s or 1.0.2g , which will be released on 1 March 2016

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How ...
0
votes
1answer
47 views

What type of SID ends with -0?

I have been parsing through the logs and found a random sid doing authentications against AD. It is as follows "s-1-5-21-xxxxx-xxxxx-xxxxx-0"; It cant be found in domain or forest. I want to know if ...
0
votes
1answer
41 views

Can VPN authentication be used for SSH?

Can VPN authentication details be re-used for SSH access? Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without ...
0
votes
2answers
260 views

Lost all local admin rights on domain joined computer

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled. On a new domain I'm ...
0
votes
1answer
43 views

Securing outgoing emails with logs of a web server

On the web server I am going to run rkhunter, tripwire, OSSEC, fail2ban and psad. All of those applications need to be able to send emails to notify the sysadmin. Therefore, I've: sudo apt-get ...
0
votes
1answer
32 views

Block/Prevent Adminer - Apache [duplicate]

I found out that if someone was able to hack any FTP account on my server and upload Adminer they could alter the database. I tried Google'ing a way to block or prevent Adminer from working, but got ...
0
votes
1answer
102 views

Https transparent proxy and SSL certificate validation

If I setup a transparent proxy for https connections using a SSL certificate signed by my local CA and distributed to all my active directory clients by GPO, may the client (browsers) reject or advise ...