Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
251 views

Possible to see a list + CPU use of all user processes in a locked down Windows environment?

We work in a locked down privilege environment, to the point that we are not able to see the the list of processes and CPU usage of the windows services running on one of our development servers ...
0
votes
2answers
2k views

What tools and/or procedures to use when hardening IIS7?

IIS6 had some tools for hardening, against attacks and holes. Does IIS7 have the same? If not, are there some standard thingst that should be done to protect it?
0
votes
2answers
3k views

Windows Services - Common Ports to Open in Firewall

I've always had trouble finding firewall port information for some windows-based software/services. For example,http://support.microsoft.com/kb/832017 gives me the ports but there's no differentiation ...
0
votes
2answers
623 views

Firewall: How to Allow Application to Access Database at Database Server

I have 2 machines, one is used as to host application ( Application Server), another is used to host database ( database server). Both are windows XP. Now as the App Server needs to access the ...
0
votes
3answers
4k views

DBO role in SQL Server 2005 versus DBA role?

What is the difference between DBO role versus the DBA role?
0
votes
2answers
36 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
0
votes
1answer
34 views

how to stop incoming SMTP .EML attack on an Azure Windows VM

This morning 1:53am, my Azure VM began receiving unexpected .EML files in C:\inetpub\mailroot\Queue. By about 6am when I first logged on, it had received over 36000 files. As a workaround, I stopped ...
0
votes
2answers
44 views

Locking down Azure Portal

My company does not want any staff to have access to our corporate Azure account from outside of our offices. So, is it possible to lock down the Azure Portal? Preferably by IP whitelist. I can find ...
0
votes
2answers
52 views

Use Static / Known SSH keys on GCE

We are often dropping and re-creating machines on Google Compute Engine to tear up and down testing environments, perform failover tests, etc. The problem is that GCE is always re-creating the SSH ...
0
votes
1answer
30 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
0
votes
1answer
84 views

Strange symbols in /var/log/auth.log

I just installed fail2ban after realizing that there were tenthousands of attempts to log into one of our servers over SSH. After installing fail2ban, the log bloat stopped, but I still wanted to ...
0
votes
2answers
85 views

S3 backup with versioning plus lifecycle management to prevent malicious deletion of backups?

I just want to run this idea by some smarter people to make sure I'm not overlooking something obvious: I want to backup my Linux server to S3 using one of the many backup scripts that allow ...
0
votes
2answers
47 views

Exim - password disclosure by world-readable exim.conf - is that necessary?

I saw /etc/exim.conf is world-readable. The issue with this is to configure Exim to use an SMTP service like Sendgrid to route all outgoing email, you put your username and password into that file, ...
0
votes
2answers
82 views

do i need to filter the OUTPUT with iptables for a dedicated firewall box?

I already know how to setup a firewall using iptables, but after a visit of the IT Security Department, they said i need to filter the OUTPUT, but, it is pointless to me, i really can find an scenario ...
0
votes
1answer
78 views

Blocking requests matching HTTP_X_FORWARDED_SERVER header

Someone has setup a CDN server which is directing traffic to my server and setting the HOST header to match one of my real domains. Because of this, Apache uses the virtual host for my real domain ...
0
votes
1answer
28 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
0
votes
1answer
200 views

How to deny access on files to several groups easily?

Currently I'm working with permissions on files on the network with Windows Server 2012 Active Directory as follows: I set up one domain controller, on the domain controller I create users and groups. ...
0
votes
2answers
245 views

Secure elasticsearch but allow remote CRUD

I'm going to run a bit of software on server A to add and remove entries from elasticsearch on server B. How can I allow these remote create and delete operations, but still keep ES secure? Is ...
0
votes
2answers
1k views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
0
votes
1answer
62 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
0
votes
2answers
84 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
2answers
90 views

is there a way from iptables/iproute to forward all traffic to my IDS and also keep the regular flow

The reason of this, is that to catch all packages into my IDS keeping my existing enviroment, so the IDS does not become a single point of failure. If route all my traffic into my IDS and from my IDS ...
0
votes
1answer
81 views

Information regarding netstat output

On netstat, I see my port 22 in connection with 122.225.97.99. Does this mean someone is accessing ssh .. OR is it just something related to ubuntu user@ubuntu:~$ netstat -ntu Active Internet ...
0
votes
1answer
906 views

Getting lots of traffic from russia to an unpublished site

I am currently building a website. Currently nobody knows about it but it is already reachable for testing purposes. Now I saw, that I get a lot of traffic from russia (Its a german website hosted on ...
0
votes
1answer
38 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
0
votes
1answer
63 views

Solaris 11 / OpenSolaris - stop processes from listening?

I would like to write a script to secure Solaris 11 servers in preparation for internet access. In addition to enabling ipfilter, I would like to disable network-accessible services that are not ...
0
votes
1answer
227 views

Apache - Drop connection for anything but HTTP 200 status

Is there a way to configure Apache to drop connection for any request resulting in an HTTP status other than 200 (or possibly a list of status codes)? The idea is that, rather than returning any ...
0
votes
1answer
75 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
1answer
74 views

Do blocking input ports increases security?

1-Do blocking unused input ports in firewall increases system security? How? (as there is no daemon listening on those ports anyway) 2-Do dropping those unused ports will positively or negatively ...
0
votes
1answer
127 views

Apache HTTP server STIG rule

I am new to setting up Apache HTTP and have to STIG the Apache HTTP 2.2 I have running. (http://iase.disa.mil/stigs/app-security/web-servers/Pages/index.aspx). For one of the rules it says the ...
0
votes
1answer
2k views

Powershell script for specifically OU

Need help with hte following, a script that can export all members of a specifically OU with in that multiple security groups. Location of the OU is; OU=Security Groups,OU=Public ...
0
votes
1answer
124 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
0
votes
1answer
491 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
0
votes
1answer
37 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?
0
votes
1answer
868 views

Nginx Password Protect Directory Downloads Source Code

I'm trying to password protect a WordPress login page on my Nginx server. When I navigate to http://www.example.com/wp-login.php, this brings up the "Authentication Required" prompt (not the WordPress ...
0
votes
4answers
106 views

Email + data server for a small company needed?

I am currently working with a small company (10 people), whose main business has nothing to do with IT. But we have some IT-Infrastructure, namely an aging Small Business 2003 server, which runs ...
0
votes
1answer
91 views

Should I still disable root if I disable password authentication and enable only key authentication?

I'm new to the linux world and I've been reading a few tutorials on security. I've seen some questions on StackExchange tackling this subject, but from what I've seen, none of the answers clarified ...
0
votes
2answers
104 views

Remote login terminal

I have an unusual request. I have a box - running Fedora 19 - that I'm using as a server. I have a crappy Atom netbook - also running Fedora - that isn't good for anything. I was wondering if there is ...
0
votes
2answers
107 views

How to restrict access to root to daemon user?

I have Apache 2.4 with PHP 5.5.14 installed on latest Debian. According to Apache security tips&tricks I've set my httpd.conf to this: <Directory /> AllowOverride none Require all ...
0
votes
1answer
45 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
0
votes
2answers
210 views

nginx as reverse proxy on front of Apache - protection and security

I'm just concerned whether to install Nginx WS alone or nginx as reverse proxy on front of Apache based on security and protection. If I had to choose nginx as reverse proxy on front of Apache, would ...
0
votes
1answer
74 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
1answer
196 views

What are the benefits of having a data center located geographically far away from your customer's office? [closed]

Was just reading through an article on data centers as linked: http://www.theage.com.au/it-pro/business-it/what-to-look-for-in-a-data-centre-20131122-hv3qj.html Appropriate quote from article below: ...
0
votes
1answer
410 views

Lean but effective linux IDS / IPS / WAF? [closed]

I'm looking for a lean but effective IDS/IDP/WAF solution for my tiny VPS webserver. Currently I already use iptables and psad but a lot of the web server scanning attempts slip through. I use ngingx ...
0
votes
1answer
249 views

Why can a local root turn into any LDAP user?

I know this has been asked here before, but I am not satisfied with the answers and don't know if it's ok to revive and hijack an older question. We have workstations that authenticate users on an ...
0
votes
1answer
101 views

what would happen when macchanger to gateway mac address? [closed]

I thought arpspoof GATEWAY_IP -t VICTIM_IP can be prevented by add a static arp entry on victim side, i.e. arp -s GATEWAY_IP GATEWAY_MAC I read ...
0
votes
1answer
60 views

Is a VPN right for restricting server access?

I would like to set up a Few QA servers for a web application, under the app domain, however I would not like these servers to be accessible to just everyone from the Internet. Ideally, the QA team ...
0
votes
3answers
77 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...
0
votes
1answer
336 views

What are the security benefits of using a proxy server?

In Wikipedia is written: Security: the proxy server is an additional layer of defense and can protect against some OS and Web Server specific attacks. However, it does not provide any protection ...
0
votes
1answer
172 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...