Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
8 views

Windows Server Administration - which services are safe to run internet facing?

Coming from a Linux background and now having to manage some Windows servers (2008R2 & 2012R2) I'm wondering which services are safe to run directly over the internet. The servers are all internet ...
0
votes
1answer
34 views

Recomendations for this mail server setup?

EMAIL SERVER SETUP Hey, its my first time using serverfault but I hope the community can help. I am trying to build a secure email system using Linux, Postfix, Dovecot and MySQL. I have read on ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
0answers
8 views

web application audit task require my remote IP to be allowed on application network firewall

I want to audit web application (xyz.com) which is hosted on web server sitting behind the cyberoam firewall. My task is to run scan from my remote machine which has ISP MTNL broadband. My machine ...
27
votes
4answers
6k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
0
votes
2answers
74 views
+100

WinRM Publicly Available

Though there is quite a bit of documentation available for using WinRM internally on domain/non-domain machines, I have not found alot out there relating to using it in a situation where it is ...
1
vote
1answer
821 views

Limit simultaneous call per user in Asterisk

I want to limit simultaneous calls per extensions in Asterisk for security reasons. For example when a user is on the call no body else would be able to make a call by that extension. How can I ...
2
votes
2answers
115 views

MySQL allows entry without Password [duplicate]

I have configured my MySQL Database to require passwords on all users, even root from the machine itself. Now I discovered that there are empty Users in my Database Reproduce: mysql -u root -p and ...
0
votes
1answer
18 views

How do I open specific ports on Linux (an AWS instance of RHEL v. 7)?

I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
8
votes
4answers
329 views

Paranoid Sysadmin -vs- Out-of-Date PHP version

How can a paranoid sysadmin confidently stay up-to-date with the latest stable PHP versions? (security fixes have been coming in pretty regularly). This is a Production server, and so "breaking ...
1
vote
2answers
4k views

How to fix “TCP/IP Sequence Prediction Blind Reset Spoofing DoS”

Just finished a Nessus scan and the only thing that came back was "TCP/IP Sequence Prediction Blind Reset Spoofing DoS" - It may be possible to send spoofed RST packets to the remote system. ...
0
votes
0answers
13 views

Tracking user activity in openvz container?

I have been trying to figure out a way to track user activity in an openvz container for a long time now (auditd like in KVM's). This is a PCI-DSS requirement. I can't seem to find any good ...
5
votes
3answers
133 views

Fixing the IIS tilde vulnerability

One of our IIS servers (IIS 7.5, Server 2008 R2) is apparently "vulnerable" to the tilde Short Filename disclosure issue. However, I'm having a hard time actually fixing the issue. So far, I've ...
1
vote
1answer
574 views

The Security Implications of Implementing Facebook Connect on your Website

The organization I work for is rolling out a Wordpress Multi-User install for it's members to have a "Personal Mini-Website/Blog," that will be hosted on our main organization's website. They are ...
-1
votes
1answer
1k views

How to block incoming login attempts to postfix, pop3, imap? [closed]

We are running CentOS 6.5 and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or fail2ban, but ...
0
votes
1answer
39 views

Block SPAM IP addresses [on hold]

Short version: Can I do something on the server side to prevent IP addresses detected as malicious from third party projects from consumpting my resources? Long version of the question: Hi, I have ...
0
votes
2answers
22 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
1answer
1k views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
-1
votes
1answer
17 views

Run two mysql process on one data directory

I would like to launch two mysql process on one data directory (/var/lib/mysql) I have two servers, web-01 and web-02 but web-01 locked mysql data directory, and i would like to break this security. ...
1
vote
1answer
30 views

Need advices on iptables

Helly guys ! :-) . I need a (several?) advice(s) from you about my iptables setup. I'm pretty new to iptables, and this is the first time I configure a server with iptables ONLY as a firewall (we ...
0
votes
1answer
11 views

WRT160NL Linksys Cisco Wifi router

There is a WRT160NL Cisco Wifi router, and has to decrease the wifi range, so it cannot go outside of the office. I tried to find this settings on the admin page, but I have not found yet. Does ...
0
votes
1answer
823 views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
2
votes
1answer
47 views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
36
votes
6answers
21k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
-1
votes
1answer
15 views

What are the MOST Important Things to Configure on a WAF? Specifically Barracuda Web Application Firewall

I will be hosting a web application on a cloud provider. This will be protected behind a WAF specifically Barracuda's Web Application Firewall Vx. I do not have too much experience with WAF ...
4
votes
1answer
2k views

Does www-data user need a real shell?

Interestingly enough, on my Ubuntu derivative with nginx installed with apt, the www-data user has a shell: $ cat /etc/passwd www-data:x:33:33:www-data:/var/www:/bin/sh Shouldn't this be set to ...
0
votes
2answers
26 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
17
votes
9answers
1k views

User password age/complexity policy

Has anyone got any resources for determining a reasonable password policy for my users? My personal leaning is to ratchet up password complexity and allow them to change them less often as a kind of ...
0
votes
0answers
17 views

how do I set restrict anonymous to 2

I want to change the registry setting for restrictanonymous to "2" (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous). I created a script to do this but noticed the setting kept on going ...
-1
votes
1answer
106 views

Misuse of the statistics script of Plesk? [closed]

I downloaded the log file from the web server, and found many strange entries. Why is a statistics script called so terribly often? What do all the junk referrers do there? Looks like some ...
-1
votes
2answers
443 views

Techniques for securing mod_php for shared hosting (WAMP)? [duplicate]

I've setup a web server for production use. The OS is Windows Server, and it runs Apache 2.0 and PHP 5.3 as an apache module (and MySQL too...). It is used to host several virtual hosts (Apache ...
0
votes
1answer
39 views

Apache 2.4 Restrict url to all except certain IP address in ubuntu 14.04 [on hold]

I know there are several Questions similar to this but none of them worked for me, Here im trying to block "example.com/phpmyadmin" to all except my public ip "a.b.c.d" and "x.x.x.x" . i have used ...
0
votes
1answer
21 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
0
votes
0answers
46 views

Disable Keyboard on Ubuntu Kiosk Touch PC

I'm in the middle of deploying a series of Kiosk PC's with a minimal Ubuntu server and a web enabled Application(Rails) on it. The hardware are Shuttle All-in-one PC's at the moment. The PC starts ...
1
vote
2answers
42 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...
0
votes
1answer
157 views

Security Risks of catch-all email address [closed]

What additional security issues does an MTA and email client face if a catch-all email address is setup on an sub-domain (that isn't published/publicly listed anywhere) compared with setting up ...
8
votes
3answers
566 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
0
votes
4answers
404 views

Permissions set to 555. How can another user modify the files? [duplicate]

I run an Ubuntu 12.04 x64 VPS with Vesta, and a site in PHP. It has been hacked several times with injected code that looks like this: <?php ...
0
votes
0answers
22 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
2answers
67 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
10
votes
6answers
3k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
2
votes
0answers
119 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
581 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
0
votes
1answer
34 views

Tools for scanning database for viruses [closed]

I wonder if anyone knows some useful tool for scanning threats like sqlinjection, command injection in mysql databases? The db is for multiple wordpress, drupal installations. The first step obviously ...
0
votes
1answer
72 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
4
votes
2answers
686 views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
-5
votes
2answers
84 views

Should I touch nothing when I run production service server? [closed]

I am going to run my first public game service server later. And many people advise not to touch anything if it's running well. I agree with them. But one thing I am curious is, the security updates. ...
1
vote
1answer
78 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
-4
votes
4answers
78 views

Blocking another Win 2008 R2 admin from accesing some important folders [closed]

I have sold half my dedicated server to somebody but I dont want them accessing my web hosted Plesk files for my Wordpress website. As some of them are custom and confidential. I gave them local ...