Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
2 votes
1 answer
5k views

How could I make a MsAccess Frontend and Mysql Backend more user aware?

I have a distributed MsAccess front-end database which uses a mysql backend. It uses the Windows System DSN ODBC connections to connect to the server. All my Linked tables refer to that ODBC ...
Mallow's user avatar
  • 144
2 votes
3 answers
743 views

Can Solaris RBAC roles be ported to Linux using SElinux only?

We are migrating an application from Solaris to Linux and the main user is allowed, through the use of RBAC roles, to run a few system commands like svccfg/svcadm (chkconfig on redhat). Is it ...
user avatar
8 votes
2 answers
927 views

Dealing with SMTP invalid command attack

One of our semi-busy mail servers (sendmail) has had a lot of inbound connections over the past few days from hosts that are issuing garbage commands. In the past two days: incoming smtp ...
mark's user avatar
  • 81
1 vote
1 answer
151 views

ip_conntrack ideal or not for server stability

By default the module ip_conntrack is installed into the kernel. My question is simple, is having ip_conntrack a performance booster for better tracking of connections? On VPS nodes they do not have ...
Tiffany Walker's user avatar
4 votes
3 answers
271 views

Store system passwords with easy and secure access

I'm having to handle several VPS/services and I always set passwords to be different and random. What kind of storage do you suggest to keep these passwords safe and let me access them easily? ...
CodeShining's user avatar
1 vote
1 answer
904 views

Why is FunWebProducts flooding my server?

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible? 89.70.25.120 - - [03/...
giorgio79's user avatar
  • 1,877
5 votes
2 answers
784 views

Best security practice for small networks - wifi, lan,

We regularly setup small networks for clients in different locations to allow them to work on different products now the question what should be the best security practice. Currently we have a wifi ...
Grimlockz's user avatar
  • 325
1 vote
1 answer
1k views

Cygwin: how do I disable /cygdrive

I'm using a cygwin based SSHD server and I want to disable the /cygdrive/c and /cygdrive/d paths; is this possible? Using NTFS ACLs to achieve this will be a mess because the user will need access to ...
DrStalker's user avatar
  • 7,036
4 votes
1 answer
4k views

SIDs in Active Directory GPO

I am looking into some weird issues with active directory and group policy. This domain has been upgraded from windows NT and has had a few different administrators over the years. I am looking ...
Phillip R.'s user avatar
0 votes
1 answer
2k views

PAM Errors in auth.log [Debian Squeeze]

Based on the the Securing Debian article on debian.org, I added the following to /etc/pam.d/other. auth required pam_securetty.so auth required pam_unix_auth.so auth required ...
tacotuesday's user avatar
  • 1,389
5 votes
1 answer
3k views

ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices? Can someone let me know if this is possible? I get lots of Google hits for ...
Chris_P's user avatar
  • 53
1 vote
1 answer
950 views

How to allow custom program on 80 port via selinux

I have custom webserver that i want to run on 80 port. The problem is its being blocked by selinux. So from localhost I can browse the site, but from outer world its not accessible. I run the ...
Shiplu Mokaddim's user avatar
5 votes
2 answers
69 views

Requiring mulitple group membership in order to access folder

How would I go about creating a file or folder that requires a user to be a member of two or more different groups in order to read/write to the folder? For example, say I run an auto repair shop, ...
David's user avatar
  • 439
1 vote
0 answers
2k views

Only allow domain logins using TeamViewer

TLDR How do I setup TeamViewer to only allow logins that authenticate through Windows (domain controller), while disallowing any other login method? I recently started a system administrator job ...
BloodyIron's user avatar
1 vote
2 answers
4k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
sorin's user avatar
  • 8,216
4 votes
1 answer
418 views

Windows Firewall IPSec configuration, how to protect the AD

Here's my infrastructure configuration: All servers have public IP I've setup a GPO to enable IPSec on everyone of them with a "require for inbound and request for outbound" rule, for all server, ...
Nock's user avatar
  • 203
3 votes
1 answer
3k views

Is there a way to change the string format for an existing CSR "Country Code" field from UTF8 to Printable String?

CentOS 5.x The short version: Is there a way to change the encoding format for an existing CSR "Country Code" field from UTF8 to Printable String? The long version: I've got a CSR generated ...
Mike B's user avatar
  • 12k
1 vote
1 answer
463 views

AWS EC2 security group source

I'm currently trying to configure a security group and allow MS SQL connections from my other instance. I want to be able to specify the security group's name as the source. But the connection is not ...
greener's user avatar
  • 203
16 votes
2 answers
49k views

How can I tell when a given user's password will expire?

Is there a way from either the computer management console or the command line to determine when a user's password will expire? Note: I'm asking this questions for a server that is not part of a ...
Aheho's user avatar
  • 367
0 votes
1 answer
182 views

Is special software necessary (apart from card reader drivers) to use a smartcard for authentication on websites?

Our company now begins to use SmartCards as the online portal for tax administration that we use requires authentication. I have never before worked with SmartCards. The device drivers are installed ...
LumenAlbum's user avatar
-4 votes
3 answers
689 views

Need Anti-Virus software for CentOS [closed]

We are using CentOS with parallel plesk server for our web application. User can upload their files to server. For security reason I need a anti-virus software scanning on all uploaded files. So ...
Mark Danney's user avatar
9 votes
2 answers
9k views

Is there a security reason not to use a wildcard cert other than manageability and exploitation if used on multiple servers?

I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need ...
Gray Race's user avatar
  • 903
1 vote
0 answers
96 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...
slivu's user avatar
  • 161
0 votes
1 answer
147 views

a safe way to provide multiple ftp credentials?

We have a web development company and have ftp credentials for over 300 customers. Is there a method to provide access to employees without giving them username and password? Kind of how credit card ...
Exploit's user avatar
  • 165
2 votes
2 answers
488 views

LOCK/Password Protect home partition

I have access to a server with SSH and for some reason I want to LOCK/Password protect or encrypt the home partition. Its very important for me to do it in the best possible way, I don't want anyone ...
Mr.shot's user avatar
  • 21
3 votes
1 answer
138 views

Security issue with ssh on Debian server

I have setup Debian Squeeze on an old laptop to serve as a testbed. I have installed OpenSSH and edited /etc/ssh/sshd_config to use ssh keys and disallow password authentication. I am able, however, ...
Andy's user avatar
  • 31
0 votes
1 answer
422 views

Provide Internet access for different VLAN

I have several managed switches at work that connect all computer within our office to the ADSL modem. However I would like enforce a VLAN policy to isolate traffic within the network. Through my ...
Nocturnal's user avatar
  • 111
1 vote
3 answers
5k views

Setting wget permission to 755 so users other than root can execute it a big security risk?

I read recently in blogs that by default wget on linux is 750, so only root can execute it. I would like to allow users wget and change it to 755, but I read around the web that it is a big security ...
giorgio79's user avatar
  • 1,877
1 vote
4 answers
7k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
THpubs's user avatar
  • 1,775
22 votes
6 answers
22k views

How To limit Nginx Auth_Basic re-tries?

I have protected a web folder with Nginx's Auth_Basic module. The problem is, we can try several passwords until it works (brute force attacks). Is there a way to limit the number of failed re-tries?
THpubs's user avatar
  • 1,775
2 votes
2 answers
449 views

Renting a dedicated server, should I rent a physical firewall aswell?

I plan to rent a dedicated server to host a commercial application, which should house esentially everything necessary to run on a single machine (frontend, backend, databases, analytics, backup ...
Mahn's user avatar
  • 201
2 votes
1 answer
15k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
THpubs's user avatar
  • 1,775
0 votes
1 answer
287 views

How do I secure my SSH access?

I'm one of those guys who climbs up the ladder to the high dive and jumps off, then realizes he doesn't know how to swim. So I have a VPS, and I have no idea how to administer it. I understand one of ...
brentonstrine's user avatar
1 vote
2 answers
1k views

PBKDF2 (or BCrypt) hash implementation for Apache HTTPD or APR

Does anyone know of (simple) way to use PBKDF2 or BCrypt as a password hash within Apache HTTPD. The general scenario is that I have a resource in /private that I would like to restrict to a given ...
Ben Walding's user avatar
2 votes
1 answer
704 views

With HTTPS-Enforcer chrome extension, a normal ping is answered by different site

I have installed the HTTP-Enforcer chrome extension. Now if I open a terminal and type ping google.com I see: $ ping google.com PING google.com.home (67.215.65.132) 56(84) bytes of data. 64 bytes ...
Synesso's user avatar
  • 219
0 votes
2 answers
3k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
tacotuesday's user avatar
  • 1,389
-5 votes
1 answer
907 views

check local user accounts for blank passwords [closed]

I need a tool/script that can help me find local user accounts that do not have passwords across a network. Not all computers will be on the domain, but 90% are (win2003). But I need to audit/check ...
Logman's user avatar
  • 455
0 votes
1 answer
217 views

Should the webserver user have write permission on the uploads/ directory?

I always gave to the webserver user full permissions on these dirs: cache/ logs/ web/uploads/ But now I am wondering if the uploads part is 0K. I was thinking that maybe it would be better if I use ...
ChocoDeveloper's user avatar
1 vote
1 answer
5k views

How to disable LOCAL INFILE in MySql 5.5 Ubuntu 12.04

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf [client] port ...
FoREacH's user avatar
  • 13
4 votes
3 answers
316 views

Risks of Network Partitioning When a Split Brain Creates a Security Flaw

I'm looking to create a high-availability, scalable networking solution by using a distributed system of data. A node here, describes a network that has control over one copy of the data. These nodes ...
Matthew Mitchell's user avatar
26 votes
1 answer
22k views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
tacotuesday's user avatar
  • 1,389
-1 votes
1 answer
201 views

Is it more secure to spoof addresses using the HOSTS file?

If I have a Windows service with a config file that points to web services it needs to call, is it more secure to put a fake DNS name for the server being connected to, then update the HOSTS file to ...
ck.'s user avatar
  • 162
1 vote
2 answers
2k views

Store password AES encrypted in MySQL after creating a bcrypt hash

I am building an application and storing user passwords in a table in MySQL. I am already using bcrypt but wondering, does it make any senses to AES_ENCRYT() the hashed password before storing into ...
Justin's user avatar
  • 5,438
2 votes
1 answer
2k views

Prevent mail server (sendmail) used to backscatter

Hi I recently got an email from Amazon, saying that my EC2 instance is sending spam. So what they say is my mail server is receiving email for a non-existing user and therefore bounces the email back ...
Xavier_Ex's user avatar
  • 159
0 votes
2 answers
3k views

Scripting Local Security Policy settings

We have a bunch of Windows 7 laptops out in the field. They're not in a domain. We'd like to build a script/batch file that we can send to each machine and, when run, configure screensaver locking, ...
Chris_K's user avatar
  • 3,434
3 votes
1 answer
3k views

Why is "Options Includes Indexes" Enabled by Default in Apache?

I was curious as to why Options Includes Indexes is generally enabled by default in Apache configurations. Anyone know why this is, as it's generally frowned upon for security reasons?
tacotuesday's user avatar
  • 1,389
3 votes
1 answer
563 views

running arbitrary, encrypted shell commands via http(s)?

I'd like to be able to encode maintenance scripts to run on-demand remotely. edit: Good use-case: webhooks. e.g. trigger CI + staging deployment whenever someone pushes code to github. If I was to ...
timoxley's user avatar
  • 133
0 votes
2 answers
793 views

Google 2 factor authentication on Ec2?

I have set up google two factor authentication on my local machine. So when I do : ssh localhost I need to verify the code along with password. But when I try to connect to my Ec2 instance like so :...
batman's user avatar
  • 321
4 votes
4 answers
587 views

Who is 1014? I have no user on my system named 1014, so why is this httpd process run as 1014?

[root@home ~]# ps au | grep httpd 1014 9701 0.0 0.2 281620 3124 pts/24 Sl+ 18:41 0:00 ./bin/httpd -X root 9742 0.0 0.0 3084 720 pts/22 R+ 18:45 0:00 grep httpd By the ...
giantforest's user avatar
-1 votes
1 answer
135 views

HP is scanning my vulnerabilities, is this OK? [closed]

I have free server at HP cloud, and I am receiving scans from them like this. It is from 15.185.11.100 and reverses to internal-scanner.ops.uswest.hpcloud.net. I have been told numerous times that ...
Andrew Smith's user avatar
  • 1,143

1
73 74
75
76 77
139