Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
2answers
661 views

Deny Stored Procedure Data Modification by User Security

I want an easy way to make a read-only user on my database. The user should have permission to execute stored procedures only if they don't modify data. I don't want to figure out which stored ...
1
vote
2answers
864 views

Best pratice for VPS setup and administration (web/ftp/ssh)

After a long hesitation, I finally ordered a small VPS for my own use, basically web hosting (several websites, for me and friends) amongst other things (mumble server hosting, wave server, etc.). It ...
1
vote
1answer
163 views

How do I secure a 6to4 link?

What firewall settings should I add to my (Linux) 6to4 tunnel to prevent harmful IP address spoofing?
1
vote
1answer
317 views

Determining When a Windows Reboot is Required

We are using Microsoft Systems Management Server (SMS) & Inventory Tool for Microsoft Updates (ITMU) for the distribution of Microsoft Security Patches. We use the following command for ...
0
votes
3answers
179 views

IIS6 Double-Encoding: Still a Security Vulnerability?

Is Double-Encoding still a security vulnerability on IIS6 as it was in IIS4/5?
0
votes
3answers
1k views

Windows server: restrict user by ip?

As an extra layer of security I use "Integrated Windows authentication" in IIS to protecte our admin tool. To setup new user accounts I got to "Computer Management" -> "Local User and Groups" -> ...
1
vote
2answers
512 views

Script to bulk generate passwords with upper/lowercase & numbers

Should be simple to write, but I'd rather save time by using an existing solution... Does anyone know of a script that will generate passwords of a given length such that every password will have at ...
3
votes
1answer
148 views

Firewall Port Mapping, Good or Bad?

Is it worth the trouble to map open ports in the firewall from some inconspicuous port number to the correct port number for a given service? Or is it simpler and similarly secure just to present ...
0
votes
1answer
3k views

IIS6 - install SSL certificate - pem file

Consider the need to secure a website under IIS 6 / Windows 2003. Here are the steps taken: Created a private key by OpenSSL: openssl genrsa -des3 -out filename.key 2048 A CSR was created by ...
1
vote
4answers
977 views

Securing bash scripts

Does anybody know what is the best way to secure bash scripts. I have a script which creates database and source code backup and ftp it to other server. And login/password for destination ftp are ...
0
votes
1answer
75 views

Resources for Smartphone Security

My organization is currently working on improving our data and network security due to increasing HIPAA laws and a general need to get a better grasp on controlling our health related information. We ...
1
vote
6answers
360 views

Appropriate response to an anonymous attempt to hack my servers

If I identify an anonymous attempt to hack my servers is there an appropriate response? Or is it a case of look at what they were attempting and make sure we're covered against it and similar attacks? ...
0
votes
4answers
74 views

storing private data on a public site (but unlinked) OK?

I've occasionally had occasion when I needed to share some as-yet "private" data (i.e. unedited drafts of audio lectures) so it can be reviewed by authorized people before being made public. ...
2
votes
2answers
214 views

Networking and network security book

i am in the early stages of producing a thesis 'Network security: Cost Vs Security', are there any books that can give me an insight to real world setups and costing of such systems, as I am purely ...
5
votes
9answers
15k views

how to know who is accessing my system?

Is it possible to know if anyone is accessing any of folders or drives in my system(32 bit windows 2003)? I mean shared folders or non-shared folders, anything. And once if we know, how to deny access ...
0
votes
3answers
803 views

Is AuthType Basic secure when used over SSL?

I am authenticating clients of an apache2 server using AuthType Basic over SSL secured connections. I imagine these are secure, as the usernames and passwords are encrypted before they are sent to ...
4
votes
4answers
10k views

How is a password hash encoded in the shadow password file?

I'm learning about Linux password security (more curiosity than anything useful), and I understand that the real password is hashed and stored in the shadow password file. What I'm not sure of, and ...
1
vote
2answers
434 views

Where do I find high security dedicated servers?

I'm currently working on a project that will need to protect sensitive data. I use servers on amazon and gigenet, but I'm not sure they are the most secure alternative. The servers must be a .net ...
1
vote
1answer
341 views

XML Schema For MBSA Reports

I'm in the process of creating a script to run the command line version of Microsoft Baseline Security Analyzer (mbsacli.exe) against all of our servers. Since the MBSA reports are provided as XML ...
2
votes
5answers
656 views

Why does anyone use ftp?

I am a newbie, so maybe I'm missing something. Why would anyone use ftp or telnet for site administration? If they use them, why would they wonder how they've been hacked? Isn't it obvious that all ...
5
votes
3answers
2k views

What are best practices for securing source code on a development network?

At my company we are very protective of our source code. We have satisfied our paranoia by setting up a development LAN that we air-gap off from the Internet and the rest of our company networks. ...
0
votes
2answers
466 views

Windows IIS6 site authentication

I have a site running on IIS6 and I want to make it authenticate via the standard gray pop-up window. I.e. it should use Windows to authenticate. I want to make it so only one single user on the ...
1
vote
2answers
835 views

Disable (disconnect from) WiFi on XP/Vista when cable is connected

We have a problem in office when a user connects to our LAN without disconnecting from WiFi network he was previously on (a free WiFi provided by building owners). At a minimum, firewall log entries ...
1
vote
1answer
210 views

Is there a robust, low-hassle solution for “port-knocking” based protection of SSH ports?

By robust and low-hassle I mean NOT involving complex iptables setups, NOT involving apache, NOT requiring an additional client program, NOT requiring fragile shell scripts running from cron, etc. ...
1
vote
2answers
1k views

Best way to use large IP blacklist to deny access to a Windows 2008 web server?

Basically, I'm looking for a solution similar to the ones mentioned in a similar (but Linux-focussed thread) located here so that I can deny access to blacklisted IPs. I am specifically focussed on ...
18
votes
3answers
23k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
2
votes
3answers
225 views

What security problems are caused by public MAC address knowledge?

What types of attacks are made possible or worse by having knowledge of a target computer's MAC address? I am planning on using a type 1 UUID generator that includes the generating computer's MAC ...
2
votes
4answers
3k views

How to find out what files an installer (rpm, deb) created?

I need to find out all the file system modifications an installer did. Most likely the installed package is an rpm or deb, but an app could of course be simply copied over or compiled and installed ...
1
vote
2answers
379 views

.htaccess redirect - Is it secure?

This works; I'm not having trouble, but I want to be certain that this is bulletproof. I came up with a neat little .htaccess redirect, but I am not sure if it is secure; do you know? <IfModule ...
6
votes
13answers
2k views

Mysterious html inserted into my site's pages (hacked?)

Twice, I've found weird code the top of my index.php. The first time, it was this: <iframe src="http://ntwportal.com/" width="2" height="4"></iframe> Then this: <iframe ...
2
votes
2answers
593 views

Is there a workaround for SSL Renegotiation Attack?

I read that the theoretical weakness in SSL has been proven real. Is there a workaround that we can apply as users or admins to protect our users/selves?
2
votes
5answers
887 views

Blacklisting: IP's or domains?

I am implementing a blacklisting system on my website that monitors contact forms for suspicious usage (both spam content and excessive frequency). When I find somebody / robot that meets my criteria ...
9
votes
3answers
5k views

How do I setup sshd on Mac OS X to only allow key-based authentication?

I have a Mac OS X machine (Mac mini running 10.5) with Remote Login enabled. I want to open the sshd port to the Internet to be able to login remotely. For security reasons I want to disable remote ...
0
votes
2answers
1k views

LAMP setup + FTP - problem with user privileges

I'm sorry for uber noobish question, I'm new to linux and trying to learn and practice secure LAMP administration for upcoming little project of mine. I've installed vsftpd but can't setup ...
7
votes
5answers
405 views

I have about 20 servers…how do I manage the SSH keys and permissions of each?

I have database servers, web servers, SVN servers, etc. Often times I ssh among them...or they auto-ssh. How do I manage what server gets to log into which others?
2
votes
2answers
204 views

How do you use Oracle's tools from scripts?

Most Oracle tools and scripts request that you pass them the password via the command line - where everyone on the same machine can see them. Example: exp <user>/<password> ... Is there ...
0
votes
8answers
136 views

Security suite software [closed]

We have 55+ workstations (MS only) and looking for security suite software. I am looking at ESET Security suite, Symantec Endpoint protection, Trend-micro worry-free business security or McAfee Total ...
0
votes
2answers
219 views

Securing 2 post rack or securing patch bays?

We have a shared 2 post relay rack in a shared room in our building (Chatsworth brand). It only has patch bays on it (using 12U out of 46). We'd like to prevent anyone from just walking into the room ...
0
votes
9answers
304 views

Is it possible for large ISPs to give you the range of IPs you can be assigned?

My company is trying to sign up for LexisNexis services. LexisNexis (or more specifically, a service offered by LexisNexis) restricts logins to either a handful of IPs, or a range of IPs. We just have ...
0
votes
1answer
127 views

What strength should I use for my ISC BIND transfer key?

Currently I'm using 128, is this secure enough? dnssec-keygen -a hmac-md5 -b 128 -n host foobar.com Also I'm not sure if "host" is the correct value for -n arg. I believe that the last argument ...
14
votes
11answers
4k views

Is there a security benefit to a regular changing password policy?

I've found in several cases, forcing users to change their password on a regular basis becomes more of a strain on maintenance rather than a help for security. Also, I've seen users write their new ...
30
votes
8answers
13k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
-1
votes
3answers
283 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
0
votes
0answers
519 views

ssh on standard port 22: how risky?

I'm setting up a CentOS 5 machine that will be used by several coworkers. The only things it will be serving are ssh and Apache. I'm trying to assess the importance of running ssh on a nonstandard ...
3
votes
4answers
356 views

Signed executables under Linux (or other OS's)

This question was asked first at stackoverflow. After 60 views, I got just one response. Now I'm trying serverfault - that's a pertinent topic for here, I guess. For security reasons, it is desirable ...
5
votes
5answers
628 views

LDAP for privilege control?

I've been wondering for a while if LDAP can be used to control user privileges. For example, if I have UNIX and web logins, is there an easy way to grant a user access to just or just UNIX (or even ...
2
votes
4answers
2k views

What is a secure way to transport hard drives?

I would like to transport several gigabytes (apx. 250 GB) worth of sensitive data from one location in the US to another. It seems at the moment the easiest way to do this is to ship an encrypted ...
0
votes
1answer
585 views

Giving apache user the rights to modify subversion repositories

I'm developing a front end to our subversion setup using WebDAV, XSL stylesheets and some php scripts to interface the svn binary. I wrote a simple shell script that sets up a project based on our ...
0
votes
2answers
992 views

What tcp/ip ports should not be open on a windows webserver 2008?

I am wondering what ports can / should be closed down on a windows webserver 2008. Port 80 of course not, and 3389 not, too, because I need a remote desktop connection. netstat told me the server is ...