Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
344 views

Setting up Shibboleth to secure part of a website

I've installed the Shibboleth module for apache on Ubuntu 10.04 using aptitude to install libapache2-mod-shib2 as per ...
0
votes
2answers
312 views

Change local time on XP box - local admin but group policy restricts time change

I am a developer in need of doing some temporal unit testing on my local XP box. I am local admin but there is a group policy enforced centrally that prohibits changing local time (a severe case of ...
0
votes
2answers
6k views

Default Domain Policy Overriding Custom GPO even though Custom GPO is Enforced

I'm trying to apply a custom GPO to an OU with a specific account in it. Even though I enforce the GPO, the default domain policy is still overriding my custom GPO and settings are not being applied ...
0
votes
2answers
766 views

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon ...
0
votes
1answer
84 views

Running Radius on a Novell Backbone

I am a rookie network engineer and I've been asked to create a secure wireless system intergrated with an existing network. So far I'd decided to use 802.1x secuity with a Radius enabled server over a ...
0
votes
2answers
918 views

How to control remote access to Sonicwall VPN beyond passwords?

I have a SonicWall TZ-210. I want an extremely easy way to limit external remote access to the VPN beyond just username and password, but I do not wish to buy/deploy a OTP appliance because that is ...
0
votes
1answer
810 views

Unhide sys says HIDDEN Processes Found: 1 but gives no further information

i checked 2 of my ubuntu systems with sudo unhide sys. On both machines the result is HIDDEN Processes Found: 1 but unhide gives no further information no pid, nothing. how can i investigate ...
0
votes
1answer
219 views

Using RSA SecurID without a Windows Domain

I have a bunch of PCs I'd like to secure with RSA SecurID tokens. However, they're not part of any Windows domain. Is this doable? Anyone any experience with that?
0
votes
3answers
695 views

How to troubleshoot this memory usage?

I have a classifieds website. I use PHP, MySql, and SOLR. Solr uses a Servlet Container, in my case JETTY, which is java application. I just noticed that something was terribly wrong on my website. ...
0
votes
2answers
2k views

Unable to access NAS device

I have a 3 site network A, B, and C. Each site has its own DC, that replicates to the others. Each site also has a local NAS (Thecus) device. The NAS devices should be accessible from every other ...
0
votes
2answers
128 views

Securing Linux Users

I would like to know what is best solution for securing linux user account on application and database server (JBoss, Tomcat, mysql database).Lets asume i have user jboss for running JBossm and user ...
0
votes
2answers
131 views

What is the best/easiest way to use scripts to analyze network traffic?

I'm looking to analyze packets via scripts. I'd like to use something high level. I'm in a mac/linux environment. I'm currently looking at different python+libpcap libraries. Perhaps lua+wireshark ...
0
votes
1answer
2k views

How to access files over a network using local accounts?

I have setup a small (wireless) home network comprising of 3 computers. Two with Vista and one Windows 7. There is no domain controller for this network and all accounts on all machines are locally ...
0
votes
2answers
1k views

How can I stop SMB on Windows 7 null authenticating?

This is a nasty question to be asking but we're really desperate. By which I mean we have about four hours to fix this or dire consequences will follow. We have a PC for card processing in our office ...
0
votes
1answer
103 views

make iis/asp.net give as less as possible information

This question is related to security of a website. I know that web servers give information as if it was a pride (mostly in header form yet also in error pages as well). In this case, IIS (dev. ...
0
votes
5answers
458 views

TCP attack invisible to netstat

we are hit by a strange attack, the attacker even emailed to challenge us. The output of "netstat -n" is just a few "ESTABLISHED" and "TIME_WAIT" typically, yet the server's website cannot be reached ...
0
votes
1answer
418 views

Difference between SetEnvIf and RewriteCond?

In my .htaccess file, I'm currently using RewriteCond to match the user agent of bad bots. I know that SetEnvIf can also be used to block bad bots too. The question is, what's the difference between ...
0
votes
1answer
122 views

system logging in linux

Which one is better? syslog-ng or rsyslog or dsyslog? Please help me
0
votes
1answer
332 views

Why is crond listening on port 6550/tcp (fg-sysupdate)?

A friend is investigating break-ins on some of his servers, and he has noticed that on several of them (from very recent CentOS all the way back to one old ancient RHL 9) the crond process is ...
0
votes
1answer
35 views

Hosted SharePoint privacy

I was wondering if there is anyway to have a hosted SharePoint that is not accessible by the hosting company. I've spoken to 2 vendors so far and one can access the site but has a audit list and the ...
0
votes
1answer
143 views

Script and file execution security with .htaccess

I'm trying to figure out which method I should use to control script/file execution security. I'm trying to protect against malicious file upload/execution exploits where a user could potentially ...
0
votes
1answer
472 views

PAM cracklib vs login.defs

If there are different parameters set for minimum password length in pam_cracklib and login.defs. Which takes precedence ? Any good docs/books about PAM ?
0
votes
1answer
3k views

Axway Tumbleweed Desktop Validator unable to validate certificate?

Anyone use or know anything about Axway Validation Authority Suite? I am currently googling the heck out of this and not finding an answer. It looks like I will have to read the Administration ...
0
votes
2answers
477 views

Issue accessing domain pc from local pc after entering incorrect username/password

I'm using windows 7 local account, I have admin domain credentials too. I must have entered them incorrectly when accessing a domain pc (to get to a share) and now any time I try to access the pc, ...
0
votes
3answers
125 views

Any ideas about securing a Windows 2003 enterprise X64 gameserver?

I have a MUonline (link) gameserver running on Windows 2003 enterprise X64. I had a website running there too. I do not know much about security here so I'm asking for some tips or tutorials you know ...
0
votes
1answer
68 views

How google,yahoo and other mail services securing passwords?

How Google,yahoo and other top level mail services securing passwords ? What technology they are using for securing and storing ? How they managing mail passwords ?
0
votes
1answer
395 views

Is there a tool to check GPOs like MBSA?

I'd like to provide some background before I pose my question so please, bear with me. I have come across Microsoft's Security Compliance Manager. It's rather new to me and as I understand so far, ...
0
votes
1answer
192 views

Allow existing user access to db. SQLSERVER 2000

I restored a db on my SQL 2000 server called R1. I went to add R1 to the user mapping of a user called JUNO. I get an error: User or role 'JUNO' already exists in the current database. So I ran on ...
0
votes
1answer
519 views

403.7 - Client Certificate Dialog Not Prompted

Here is my scenario: Server: Windows 2K3 SP2 x86 IIS6, with a Web Site with SSL, requiring client certificates. The server certificate was issued by a CA (AD Directory Services). Client: IE8 with a ...
0
votes
2answers
3k views

How can I diagnose the cause of unexpected restarts on a Windows Server 2003 VPS?

At first I always assumed this was the host applying updates or doing some maintenance. But after contacting the company, they assure me I would have received prior notice before any such event. In ...
0
votes
1answer
71 views

Configure Apache2 to only respond to virtual hosts

Have a server that, while reviewing the logs, appears to get hit many many many times a day via the direct ip address by automated scripts looking for vulnerabilities. Entries like: [Sat Jul 31 ...
0
votes
1answer
110 views

Samhain: depth of “-1”

In a samhainrc file you are allowed to have a depth associated with your dir. Like so: dir=3/etc/tinydns But what does it mean when you have a depth of -1? ( I was not able to find anything in the ...
0
votes
1answer
242 views

Hosting shared full trust asp.net sites while limiting their access to the registry & file system

I am planning to host some asp.net apps which require full trust. The sites will be under different domain names and I am the admin of the server. They will be hosted in Windows 2008 R2 (IIS 7.5). I ...
0
votes
2answers
3k views

Allowing users to configure printer ports without full admin rights on Windows Server 2003 R2 Standard

At our organization, we have multiple levels of support personnel. The lowest (level 1) of these personnel deal with a single job site with about 40 printers. Each site has a Windows Server 2003 R2 ...
0
votes
3answers
1k views

Security groups not allowing domain admin to view files

This should be very simple. I have my Documents folders redirected to a share called //dc/documents. It creates a folder under this share for each person and then creates a folder under that for My ...
0
votes
1answer
991 views

Online scan detecting SQL Injection vulnerability

I have had my boss do vulnerability scans on our servers using online services and it's frustrating trying to explain that we don't actually suffer from the vulnerabilities that the reports say we do. ...
0
votes
2answers
87 views

Post Vulnerability Actions

To protect the guilty I will avoid names... I know of a site that last night went down. Sort of. For about 5 hours all requests to this asp.net site were producing a YSOD. The details that were spit ...
0
votes
1answer
947 views

windows server 2008 guest account issue

If I need to open guest acconut for Windows Server 2008, any security risks? Appreciate if anyone could recommend some readings and also how to resolve any potential security risks. thanks in ...
0
votes
2answers
366 views

Msmq authentication from asp.net site

If you have an asp.net site sending messages to a remote queue, how do you handle authentication. If Windows Authentication is turned off, the network service sends a message to the remote queue. Does ...
0
votes
1answer
746 views

How to create a user in ubuntu for ftp, and lock the account to a specific ftp folder

I want to create a ftp user on my ubuntu server, and lock the user to a specific folder to read/write to. I read I use the /usr/sbin/useradd but I don't see how I set the password? thanks in advance ...
0
votes
2answers
261 views

Best solution for development IIS to reach files via UNC share

What is the best way to configure security with IIS to allow developers local IIS instances reach a UNC share for documents that are in our deployed website but not a part of the development source?
0
votes
2answers
84 views

Sharepoint user can view site collections he is not a member of

as i understand sitecollection security ,member of a given sitecollection can not view another site collection where he has no membership ,my problem is that any user from a given site collection can ...
0
votes
3answers
192 views

How would you set up a one-way VPN?

I would like to set up a VPN between my LAN: Windows 7 Ultimate Desktop workstation OpenSuse 9.3 server and my co-located web server: Windows 2008 R2 Web Edition server (with just one NIC!) ...
0
votes
1answer
154 views

Open Source Software that combines Snort and Cisco Blocked Lists

There used to be this software that existed maybe 8-10 years ago (I thought it was maybe called FloodGate?) It worked by having a Linux box bridge running snort or prelude. When it detected a DOS or ...
0
votes
1answer
4k views

How to backup postfix?

I am putting together a list of things that I need to backup, on my website. I am using postfix for handling my mail. Which files in /etc/postfix (if any) do I need to backup? My goal is that after ...
0
votes
2answers
114 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
0
votes
2answers
180 views

New Secure Website with Apache Reverse Proxy

I wish to set up a new website that will be accessed by users using HTTPS. I think it is good practise to put the "real" web server in a seperate subnet, and then install an Apache Reverse Proxy in a ...
0
votes
2answers
247 views

security and hacking of mysql-servers

i'm very very new in questions such hacking, security, servers. Where i can read some documentation about security, and hacking of php(mysql) servers. Maybe you will give some links, where can learn ...
0
votes
1answer
106 views

Are there any default security settings I should be worried about in windows Server 2008 R2

I'm running Windows Server 2008 R2 (via Rackspacecloud) and now that I'm going live I'm just curious if there are any security settings I should "turn on" or other settings I should tinker with to ...
0
votes
1answer
415 views

What are the alternatives to using allow.sysvipc in a jail running PostgreSQL in FreeBSD

This question is prompted by this one. I've set up a jail to run PostgreSQL but without allow.sysvipc when creating the jail (or setting the relevant rc.conf entries), the system call to shmget are ...