Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
2answers
262 views

Secure way to monitor and restart services that require password

Sometimes when the power goes out and the UPS dies before it goes back on, some services on our servers don't come back up. Namely some VMware virtual machines. I was thinking of setting up a ...
0
votes
3answers
909 views

Using a Security Group to Manage MS SQL 2005

I want to add an AD security group to my MS SQL 2005, which will contain the personal allowed to fully manage all aspects of the server. I have created the group (DOMAIN\SQL Admins) and added it to ...
0
votes
1answer
1k views

sshd_config GatewayPorts

Is there any reason why I shouldn't set GatewayPorts yes in my sshd_config file if the hosts are only going to be internal to the network?
0
votes
1answer
426 views

Windows Admin can not change the time

On my work laptop I have a local admin account that is in both the administrator group and the backup operators group. This the account cannot install windows updates or change the time. I've asked ...
0
votes
1answer
4 views

Secure elasticsearch but allow remote CRUD

I'm going to run a bit of software on server A to add and remove entries from elasticsearch on server B. How can I allow these remote create and delete operations, but still keep ES secure? Is ...
0
votes
2answers
34 views

Protecting mysql instance on Linux Azure VM

I have mysql running in a Linux Azure VM. It's currently bound to the "Internal IP Address" of the VM as looked up in ifconfig and the Azure Dashboard. I've turned on logging to see who and what is ...
0
votes
1answer
27 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
1answer
54 views

Recomendations for this mail server setup?

EMAIL SERVER SETUP Hey, its my first time using serverfault but I hope the community can help. I am trying to build a secure email system using Linux, Postfix, Dovecot and MySQL. I have read on ...
0
votes
1answer
121 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
0
votes
1answer
33 views

I guess that my mail server is unprotected and spammers are using my mail server to spam myself [duplicate]

Since I switch to my own mail server (I folowed this two tutorials: https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-mysql and ...
0
votes
1answer
38 views

Configure account event auditing with Secedit

I'm currently putting together a number of PS scripts which can be run against a new webserver in order to harden it prior to it being placed in production. One of these scripts will launch secedit ...
0
votes
1answer
39 views

How to lower security level of IE on Win 2008R2 to allow product register?

There is IE 11 installed on Win2008R2 server. After installing a Visual studio express, we are asked to register the software. A user account was created on outlook.com. However after entering login ...
0
votes
1answer
18 views

vSphere-created node complaining about ECDSA fingerprint?

I just cloned an Ubuntu template in vSphere Client, just like I've done hundreds of times before. It didn't give me any errors, however when I went to SSH into this server to test it, I get the ...
0
votes
1answer
15 views

Viewing older entries for lastb on linux

I have a server (Amazon Linux) that has been up for 261 days: [server]$ uptime 16:29:46 up 261 days, 4:47, 1 user, load average: 0.05, 0.16, 0.18 I am trying to find out if there have been any ...
0
votes
1answer
93 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
0
votes
1answer
80 views

Centralised log monitoring for linux servers [closed]

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch. To describe my situation: 10 linux hosts Using logwatch to ...
0
votes
1answer
56 views

Disable Apache server signature [closed]

I've just set expose_php to off via WHM's Configure PHP and suExec. For security purposes I want to additionally hide: Apache ServerSignature/ServerTokens/PHP X-Powered-By I can't find a relevant ...
0
votes
1answer
85 views

Does Active Directory alone is not enough to secure hadoop?

I am trying to secure Hadoop environment installed in windows. So basically I started to analyse how to secure a Unix-based hadoop cluster. Have gone through various links related to Kerberos and ...
0
votes
1answer
84 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
0
votes
1answer
107 views

Network Security: Lan Manager Authentication Level

I'm a little bit confused by the explanation provided for the setting "Network Security: LAN Manager AUthentication Level" in group policies. The provided explanation only talks about clients and ...
0
votes
1answer
44 views

Securing Webserver and Database

I need to secure an internal web server and sql db, that is going to be made public(www) At this stage im only looking to provide a reasonable amount of security($$) until it gets bigger at which ...
0
votes
1answer
112 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
1answer
115 views

Google Authenticator - generate new set of emergency codes

I use Google Authenticator on my SSH servers with Andoid app for generating codes. After I run $ google-authenticator application create set of emergyncy keys: ...
0
votes
1answer
324 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
0
votes
1answer
109 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
0
votes
1answer
247 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
190 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
0
votes
1answer
99 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
0
votes
3answers
66 views

Is there some free remote sniffer (aka sniffer on free remote server)? [closed]

I have this setup: ________Company LAN_______ _________ . '| _________ | | .| BUNCH OF | ...
0
votes
1answer
51 views

nginx not showing internal at directory

Below is my nginx configuration file. It should make /inc and /admin/inc internal, but I can access them normally, like the line doesn't even exist. It's not giving me a 404 for external requests like ...
0
votes
1answer
82 views

How to secure private communication among Apache servers with SSL (sign IP only)

I have 2 Apache servers (with PHP): public server A which hosts web pages, it has domain name etc. public server B which hosts some services (built as PHP application) and those services are used ...
0
votes
2answers
119 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
1answer
39 views

SecAst: Premature Exit in Daemon Mode

To Generation D: This is a new problem with build secast-1.0.4.0-x86_64-ub12 that didn't happen with the previous build, secast-1.0.1.0-x86_64-ub12. When secast is run as a service (service secast ...
0
votes
1answer
70 views

Fixing Apache Struts XSS vulnerability

A recent network scan revealed the following vulnerability: Apache Struts s:a / s:url Tag href Element XSS. Here is a link with more info about this vulnerability: http://osvdb.org/show/osvdb/54122 I ...
0
votes
1answer
109 views

Is the shred utility always safe given a good random number generator?

I recently experimented with different methods of disk randomization to find what would get the job done fastest. The openssl random number generator with AES in counter mode was said to be pretty ...
0
votes
1answer
101 views

Computers in-scope for PCI DSS [closed]

I am trying to determine what servers & workstations, etc. that are in-scope for PCI compliance. PCI DSS SAQ-D states that any devices that "store, process or transmit cardholder data" are in ...
0
votes
2answers
282 views

Protecting my Bind dns server from slow kaminsky-style cache poisoning attacks

Dan Kaminsky described how DNS servers could be poisoned with spoofed DNS responses [1]. As I understand it, the problem was that Kaminsky found a way to account for most other sources of randomness ...
0
votes
1answer
258 views

IIS Webserver hosting intranet and public sites in DMZ

We have a webserver (VM) hosting several sites. One of the applications has a part intranet and a part public. (archiving/docflow = intranet, customer invoices = public) This webserver is currently ...
0
votes
2answers
50 views

If a web root directory has a simlink that points to a folder one-level up, does that pose a security risk?

Assuming a Linux/Unix system. Not asking about any particular server software, just wondering in general. I want to use this to include javascript libraries or things like that in multiple sites or ...
0
votes
1answer
99 views

How to autoban IPs that request URLs with a .php extension?

I've noticed in my linux/apache server logs that bot computers running muieblackcat are periodically trying to access all forms of phpmyadmin.php on my server. It's interesting, because I have a ...
0
votes
1answer
1k views

Can dd-wrt do a firmware autoupdate?

I need to get a new company router but am looking for a secure but low cost solution. My first idea was to get a 20€ TP-link router and flash it with DD-wrt, but the latest firmware is a year old and ...
0
votes
1answer
30 views

Linux package management and security flaws

Is there a mechanism built into rpm or apt that will warn (or prevent) a user from installing a package contains a known security threat? I'm thinking of an RPM like ...
0
votes
2answers
134 views

Enable Apache Virtualhost Site To Only View Over SSL [duplicate]

Viewing site over http and https are both working but prefer to configure it so that ALL visitors ONLY go through the SSL connection so that it always start with http*s*://www.example.com - what am I ...
0
votes
2answers
37 views

Security Help? Is this a safe way of doing things?

I am running Apache with Debian. At the moment to share my site I am just setting up my router to foward my local ip on port 80. So anyone who wanted to look at my site can just type in my router's ...
0
votes
1answer
39 views

In apache how do you validate that the logged in username matches the directory name?

Sometimes you want to setup a directory structure in apache such that logged in users can only see their own directory. (i.e. the directory name and the username match.) What do you put in the ...
0
votes
1answer
107 views

DDoS Attack Mitigation Techniques [duplicate]

Our hosting is set up on Amazon EC2 servers, which have been performing great. The problem we run into are spikes in requests for invalid URLs from scripts/bots looking for security holes. When ...
0
votes
1answer
182 views

Configure Apache to allow the access for the specific URL under VPN [closed]

Here is the case, I want to configure the Apache server so that some of the URLs can be accessed under VPN and some of them should be accessible with/without VPN. Here is my scenario Without VPN ...
0
votes
1answer
168 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
0
votes
1answer
149 views

Site security - how to filter incoming traffic to a specific port

Just ran a security test on ScanMyServer.com, the results showed a medium risk vulnerability: Database Reachable from the Internet Summary: The remote host is running a database server that is ...
0
votes
1answer
51 views

removing process (and child process) access to file systems? [closed]

is there a unix-type free OS that allows me to remove all disk access for a specific process and any of its children? #!/usr/bin/perl -w use strict; use Perl6::Slurp; my $infile= ...