Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
3k views

How can I setup an IP whitelist for a subdirectory?

A client of mine complained of an attack. I checked the access log and found a massive number of requests for the admin login page from seemingly random IP addresses. I created an .htacces file in the ...
0
votes
1answer
102 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
1answer
149 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
0
votes
1answer
69 views

Amazon EC2 - Help setting up security based on how my software works [closed]

I'm currently developing on a project of mine where I need some guidance on securing my server. My server is Ubuntu Server 64bit hosted at Amazon AWS EC2. I have my own software running on it. My ...
0
votes
1answer
628 views

Remove “Act as part of the operating system” policy

On one of our servers we have enabled the "Act as part of the operating system" policy in the Local Security Policy. (Security Settings > Local Policies > User Rights Assignment). Now we would like ...
0
votes
1answer
50 views

How to secure mount NFS folder for read & write access?

I have 4 load balanced apache servers, and all of them can add files to /project/media/ direcotry (different pictures). I want to store all media files in separate server and mount them on apache ...
0
votes
1answer
212 views

Allied Telesis AlliedWare gui http server accepted cipher suites

When configuring a AT-9924T switch running AlliedWare 2.9.2 to serve ssl encryption on the http server as described in the manual like this: create enco key=0 type=rsa length=2048 set system ...
0
votes
1answer
180 views

Is it worth to use chroot when running web applications?

My setup: In production I'm using one virtual server per one web application shard. Shards are behind load balancer. In backstage we run web application + DB on a single virtual server. The ...
0
votes
1answer
43 views

Referrer in access.log is a directory

It seems that the referrer on the following log is a folder. 112.200.208.5 - - [29/Jul/2013:20:43:14 +0800] "GET /sites/default/files/download/argie/pos-code.zip HTTP/1.1" 206 294677 ...
0
votes
1answer
227 views

hacking attempt or something else in IMAP - logwatch logs

In my Logwatch logs I found 3 lines that look weird to me, I speculate that they are hacking attempts. IMAP connect from @ [::ffff:121.183.126.37]DEBUG: Connection, ip=[::ffff:5.102.221.2]: 6 ...
0
votes
1answer
86 views

Securing nginx (user/file permissions)?

I'm just setting up nginx on my web server, and I created a user account for it to use (nginx). However, it runs its worker processes by default as www-data. Is there any disadvantage to using ...
0
votes
1answer
34 views

Setting up SSL at the server level on a VM [duplicate]

Forgive me if this is a trivial question, but I literally have zero experience in hardware administration. I build websites/web apps, but usually use a third party like GoDaddy or Arvixe to ...
0
votes
1answer
56 views

disallow file types (shell script wordpress security)

We recently got our servers into SVN which has been great, but this causes a lot of problems when using things like WP Filebase for CMS file management. It's also hard to keep the uploads folder ...
0
votes
1answer
434 views

Which user should i give permission to in IIS?

I'm running a windows 2012 server with IIS 8 installed, I have a php script which complains about not having write permission on a specific folder. If I grant permissions to this IUSR user, It works ...
0
votes
1answer
527 views

Ramnode was hacked SolusVM zero day exploit (what should I customer do?) [duplicate]

So, ramnode was compromised, some kid used zero day exploit to gain access and rm -rf. I'm really happy how ramnode team handled situation, finally my VPS was restored and it is back online. I've a ...
0
votes
1answer
251 views

How can I allow traffic only from my load balancer, if the private IP of the load balancer changes all the time?

I'd like to limit (via iptables or otherwise) inbound traffic on 80/443 to traffic coming from my load balancer. I have the public IP (which doesn't change, of course), but the only private IP info I ...
0
votes
1answer
557 views

How to unblock exe-file and windows-help-chm-file on a mapped network drive using Windows Server 2008 Active Directory group policy?

We have a mapped drive M: in our Server 2008 R2 64 AD Domain. There is an important exe and a windows help file on the drive that all users need to access from there. How can I remove the security ...
0
votes
1answer
60 views

How to ensure all public mirrors contain same content?

Basically I plan to have some files mirrored on multiple servers on different providers. A unique cname will auto-balance the traffic across all available mirrors and will serve from the closest to ...
0
votes
2answers
311 views

Should I use openVPN or something Else?

I'm in charge of setting up a "walled network" set of servers for a group of employees, but I have no clue where to start. Posted below are the initial requirements, my line of thoughts, and my ...
0
votes
1answer
598 views

Errors whilst installing kolab

i'm struggling for the past 2 days please help me anyone... [root@mail /]# setup-kolab Please supply a password for the LDAP administrator user 'admin', used to login to the graphical console of 389 ...
0
votes
1answer
25 views

How do you deny a user access to a certain collection in mongo?

I have several collections that I would not like certain users to see. How would I go about "hiding" them or blocking a user from viewing?
0
votes
1answer
166 views

Allow either password or private key SSH authentication

I set the lines PasswordAuthentication yes and PubkeyAuthentication yes in /etc/ssh/sshd_config. I also disabled root login for security purposes. I can now SSH with a user's password without ...
0
votes
1answer
312 views

How can I configure a Ubuntu LAMP web server with permissions like CPanel? [closed]

I know how to set up a LAMP stack on Ubuntu pretty well for a single website / single user, but I'd like to allow multiple users to host multiple sites on a single server. This is for different ...
0
votes
2answers
333 views

apache: restricting access by network

Im working on a (linux based) device that has 4 network interfaces: two wired, one wireless and a VPN. The device has a web 'control panel' of sorts that I want to restrict access to. Ideally it ...
0
votes
3answers
5k views

How to disable SSL/TLS compression in Apache 2.2.16?

I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off. I tried to search google, but didnt ...
0
votes
1answer
66 views

How to update/maintain a patched kernel?

If I patch my linux kernel with grsecurity, will I still be able to update my system with yum (or apt-get)? Won't the updates available via yum be incompatible with my patched "non standard" version ...
0
votes
2answers
433 views

-bash: www.mydomain.com.pem: Permission denied

I have these three files in /etc/nginx/ssl folder: www.mydomain.com.csr www.mydomain.com.key www.midomain.com.key.nopass I bought and downloaded the positive ssl certs in ...
0
votes
1answer
29 views

Limit access to an EC2 instance from different instances

I have an EC2 instance set up called Machine1. I specified the security group to be Group1. How can I allow access in Group1 to any machine that comes from an internal EC2 request? Do I have the ...
0
votes
1answer
472 views

Cisco asa 5500 series - Logging VPN connections to easily search connection history

We have a fresh requirement to log information to do with vpn connections. The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / ...
0
votes
1answer
1k views

Where should I setup a staging environment in Amazon VPC? And testing?

I setup the production environment for my service in an Amazon VPC in Oregon: 2 availability zones 1 public subnet (including bastion, nat, and ELBs) and 3 private subnets (database, web servers and ...
0
votes
2answers
667 views

Securing dnsmasq - interface(s)?

Im preparing to deploy about a thousand fanless machines running Debian. Each machine has 3 interfaces (eth0, eth1 and uap0). In many cases these machines will sit between a cable modem and a home ...
0
votes
1answer
82 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
0
votes
3answers
280 views

Is it bad to store server SSH keys in version control?

We are writing scripts to automatically redeploy our servers. These scripts are stored in version control. Some of the servers require access to private Git repositories with access restricted by ...
0
votes
1answer
125 views

Is the connection from PHP to a different MySQL server 100% secure?

I tried to find this information but was not able to. How is working the connection from PHP to MySQL server. As the password is sored plain, is it also sent plain to MySQL if it is stored on a ...
0
votes
1answer
275 views

secure cookies when https is done on balancer, but balancer->appserver is http

We're trying to maintain PCI compliance for our application and after an audit, the report was telling us that we need to set the secure flag on our cookies. The site is HTTPS (using pound for https ...
0
votes
2answers
512 views

Windows Security: can user read local files with only 'Log on as a batch job'?

A Windows Scheduled Task runs as serviceAccount@domain.tld on a 2008R2 server. The server's local disk has some files that Joe Blow should not see. Joe Blow knows the serviceAccount password. As far ...
0
votes
1answer
145 views

Possible causes of high download activity on network [closed]

We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between ...
0
votes
2answers
616 views

configure iptables to allow in/out bound connections from the WAN (web) and only a couple pcs on the LAN while blocking anything else

I have a Xen server with several Virtual Machines on it sitting along side normal pcs on my LAN. The VMs host content bound for web access. Httpd is one of them so lets use that as an example. I ...
0
votes
2answers
1k views

Can you lock down Cpanel/WHM access to certain IP's? [closed]

Is it possible to only allow access to Cpanel/WHM to certain IP's? I know how to do it for standard folders, but I don't believe that will work for this purpose as they are on different ports or ...
0
votes
1answer
84 views

Securing a switch

I have switch (HP ProCurve 1810-24G to be exact) and it's placed in a datacenter. To secure the switch, there's a lenghty password on it. But, there's one great downside: anyone with the IP address ...
0
votes
1answer
69 views

How to provide IIS Basic authentication access without a general user account

I want to provide access to my website through IIS Basic auth (already working) but I don't want to give out OS level logins, to my testers/previewers. Is this possible? How can I do this? I ...
0
votes
1answer
196 views

Is there a way to allow specific permissions to a non-root user?

I have a program that, at some point, create/destroys tun/tap virtual adapters. Obviously, for these specific operations this program requires root privileges. According to the program ...
0
votes
3answers
191 views

Ubuntu Server: Attack on blocked ports leads to Ping timeout [duplicate]

I was searching for a solution a long time but cant find anything useful. My webserver is secured by a firewall (iptables with ufw userinterface). Default is deny all and only some ports are open. ...
0
votes
1answer
310 views

Multiple users, one public_html directory

New to creating users with linux. Trying to add users in a secure manner, limiting damage a user can do give all members of the webadmins group access to the public_html folder as projects are often ...
0
votes
1answer
43 views

Blocking Access to Certain Sites

I have a weird setup on a server we host: the site hosts both live and test versions of its sites, set up in two different folders, D:\Live Sites, and D:\Test Sites. What would be the best way to ...
0
votes
1answer
7k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
0
votes
1answer
41 views

Stop certain users accessing C:\Source by security group

We have a security group called SourceCode which allows certain users access to the SVN / GIT repository. This allows them to get the latest repo and store it in C:\Source. This works fine but the ...
0
votes
1answer
35 views

Automated mails from a documentation on a closed network through adsl to user emails

I have a closed network that has a documentation system that sends automated emails to users using smtp. The users are all on the same exchange server. We have an adsl connection. Are there security ...
0
votes
1answer
52 views

is webmail db acessable through ftp

Recently we've had several attempts to access our ftp account from an outside source, (we've since locked the account). I was wandering if we use hosted webmail, such a open xchange, horde or atmail ...
0
votes
1answer
2k views

Site2Site tunnel via SSL VPN?

i have tried convincing my opposite office of the tunnel in question to get site-2-site ipsec up and running. However they are not really into that and run everything via SSL VPN.. Is it possible to ...