Security is not a product, but a process.

learn more… | top users | synonyms (1)

11
votes
3answers
18k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
1
vote
0answers
15 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
0
votes
1answer
871 views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
3
votes
2answers
38 views

should anonymous access to the IPC share be allowed on Windows 2008 r2

During an audit the question of anonymous access to the IPC$(null sessions) share was raised. The audit lists the following as being a risk on a Windows 2008r2 file server: C:\>net use ...
0
votes
2answers
18 views

Asterisk new PJSIP driver security option

I have a working asterisk environment, but I get a lot of unwanted traffic, like sip scanners of people who even try to call as a guest. I'm using res_pjsip, the configuration is stored in ...
0
votes
2answers
237 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
0
votes
0answers
7 views

Warnings in Tiger auditing reports (process is listening on socket)

I get email logs like the ones below emailed daily from my server. I don't really know what does it mean and thinking about disabling them, but I guess this is not a good idea and it's better to learn ...
4
votes
1answer
2k views

Force SSH public key authentication for specific users

Is it possible to force specific users to login with public key, while allowing other users to login with password? Since public key authentication (with passphrase) is stronger than password-only ...
0
votes
2answers
93 views

Can't get rid of Apache server-status

I am trying to deactivate the /server-status from an Apache2 running on a Fedora server. I tried to comment the lines in /etc/httpd/conf/httpd.conf and I also tried to make it work only for my IP ...
0
votes
0answers
11 views

recieved abuse complaint that badbot came from my ip [duplicate]

I recieved an abuse complaint that a badbot was used to attack their servers and the badbot listed my ip as the source. Does this mean that my server is infected and using my server to send out ...
1
vote
1answer
531 views

How can I aggregate account lockout events in Novell eDirectory?

I'm seeing an account become locked out pretty frequently and I wanted to pull an aggregated log together of all of the lockout events so I could get a better idea of what times it's occurring. ...
0
votes
2answers
290 views

Multiple POST requests to same file from same IP address

I periodically check my apache domlog to check for anomalies in GET and POST requests. Earlier today I noticed the same POST request to a login php happening two and sometimes three times a second for ...
0
votes
0answers
13 views

How to prevent MITM in mobile apps [on hold]

I want to make sure that my mobile app is the only one making calls to my API. How to ensure that if softwares like Fiddler generate a HTTPs certificate (man-in-the-middle) and anyone is able to ...
3
votes
3answers
530 views

Access logs show someone “GET”ing a random ip, why does this return 200?

I have a small linux box set up with Apache as a way to teach myself Apache. I've set up port forwarding on my router so it's accessible from the outside world, and I've gotten a few strange requests ...
4
votes
3answers
1k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
24
votes
2answers
685 views

Isn't it a huge security issue to include the MAC address inside of an IPv6 address by default

Many times you don't want to be identified while surfing. For one thing your browsing history might be sold without your knowledge, and with no benefit to you.
1
vote
2answers
30 views

How to set up TLS on hMailServer?

Complete noob here. Please be gentle :) I have a Windows 2008 server, running hMailServer. Right now all my communication is unencrypted. I want to start using TLS. So now I've got myself a SSL ...
20
votes
5answers
52k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
1
vote
0answers
23 views

What is the best way to configure an iDRAC/dell server in a public data center such that the idrac doesn't have to be exposed public facing

I have a server right now in a data center behind an OpenVPN using the client on the box to connect to the vpn server. I'm going to install the iDRAC and want to know how to best configure the ...
0
votes
0answers
41 views

Got hacked. Want to know how and protect the others similar setup instance [duplicate]

The website got hacked, would like to know how / possible approach the hacker did and how can i protect the server. This is the information of the hack: http://www.zone-h.org/mirror/id/23884086 The ...
-3
votes
0answers
34 views

DD-WRT Router Update [closed]

I installed DD-WRT on my Linksys E3200 router. Flashing the firmware using the associated Linksys E3200 DD-WRT firmware file found though the DD-WRT.com router database. This firmware was created in ...
0
votes
1answer
14 views

SonicWALL SSL VPN Can't Click Bookmarks

I've added an RDP bookmark to my SSL VPN Virtual Office page, but can't click it. I've tried importing the certificate, adding to Trusted Sites, and setting Security to Low....but the bookmark just ...
1
vote
2answers
963 views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
2
votes
3answers
252 views

Rebuild or repair? [duplicate]

Possible Duplicate: Updating Malware cleaning skills I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged ...
0
votes
1answer
20 views

Managing VPN-based users/VLAN access to a test environment

I'm involved in the setup of a demo/user lab environment comprising several racks of server kit. The idea is that potential hardware/software customers can be given a VPN account that will allow them ...
2
votes
1answer
40 views

How to detect Bios Rootkits on a server mainboard?

I recently read about a talk by Corey Kallenberg and Xeno Kovah given at the CanSecWest-conference which describes how the firmware of a server mainboard can be reprogrammed to include malicious ...
8
votes
2answers
2k views

Is LXC secure enough for VPS hosting?

Right now I'm using Linux VServer for VPS hosting. But it's lacking some functionality I need (ex. cpu usage virtualization, quota support for guests, etc.) so I'm thinking about switching to OpenVZ ...
2
votes
2answers
115 views

Ideas for using a computer as a 'display' for public use

I'm going to be presenting a website at a show/expo, and I'm wondering what the best way to go about it is... My plan so far is - leave my laptop (hidden, secured, folded over) connected to an ...
-1
votes
1answer
30 views

Block everything except some ports and specific IP Addresses, server can't do HTTP GET

I can't get this firewall.sh script to work. It currently doesn't allow me to get a file at 'https://index.docker.io/v1/repositories/library/ubuntu/images' so either my DNS is flawed or I am blocking ...
0
votes
0answers
10 views

How to set relaxed security for Terminal Services on 2008 R2

I installed Remote Desktop Services on Windows 2008 Server R2. I am trying to set it up with 'Relaxed Security' similar to Windows 2003 would have. Windows 2003 Server, I would set up: Permission ...
0
votes
0answers
47 views

How can I disable specific file type uploads globally in Apache?

In order to secure my webserver, I would like to block specific file types from being uploaded globally, independent of what FTP users configure in their webpages. Is there a way to globally block ...
13
votes
1answer
241 views

What is the Rowhammer DRAM bug and how should I treat it?

DRAM chips are very tightly packed. Research has shown that neighboring bits can be flipped at random. What is the probability of the bug triggering at random in a server-grade DRAM chip with ECC ...
-2
votes
0answers
38 views

Someone uploaded index.php into my ubuntu server, I don't know how? [duplicate]

I recently figured that someone uploaded an index.php into my server, which is an Ubuntu by the way. How could he do it? What should I do to fix this bug and prevent it from happening again?
0
votes
1answer
25 views

Will Apache2 performance be reduced by huge IP blocklist

My web application is getting more and more hits from unknown sources trying to access secure pages, such as admin panel, etc. So, I want to block IP address from certain countries using this source. ...
2
votes
2answers
1k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
0
votes
2answers
451 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
5
votes
4answers
205 views

Is it good or not to include all frequently used and important addresses in /etc/hosts?

Is it generally considered a good or bad practice to include all frequently used and company's important hosts in /etc/hosts? Now I can see the following pros and cons: Pros: improved speed, ...
2
votes
0answers
63 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
4
votes
1answer
102 views

Alternative to Firewalld on memory critical servers?

I've bought a 512MB VPS @ DigitalOcean. Currently, I use Firewalld to allow/deny access to certain ports (probably 22, 80, 443 are open). It uses around 25-30MB of memory. EDIT: Not to forget that ...
4
votes
5answers
5k views

SSH access problem: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

We have a server XXX ON Amazon EC2. SSH is running on a standard (22) port. I placed my pubkey at the /.ssh/authorized_keys file The fun thing is that YESTERDAY it was working great! But today, I ...
0
votes
0answers
22 views

clamscan using maldet Error: Servname not supported for ai_socktype

So i have installed Linux Malware Detect (maldet) to scan a server and everything went fine with installation but when i run it i get an error. Bunch of errors and than the scan just closes it. Here ...
1
vote
2answers
48 views

How risky is storing credentials on disk in a Powershell SecureString?

Basically, I want to cache the credentials needed for New-PSSession and make them available to scripts so they don't have to nag a human. If I use export-clixml or similar to store a PSCredential on ...
2
votes
1answer
15k views

Group Policy Internet Explorer default security settings?

Since re-installing our Domain Controller (Windows Server 2008R2) and re-creating all of our group policies I have stumbled across an strange issue. When a user logs in and goes no the internet, ...
0
votes
3answers
4k views

Security Tab missing on internet explorer

I have a windows 2003 SBS domain, which I administrate to the best of my limited abilities. I need to install an active X-control for which I must change settings in internet explorer. It surfaced ...
1
vote
1answer
927 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
0
votes
1answer
51 views

Information regarding netstat output

On netstat, I see my port 22 in connection with 122.225.97.99. Does this mean someone is accessing ssh .. OR is it just something related to ubuntu user@ubuntu:~$ netstat -ntu Active Internet ...
7
votes
4answers
3k views

Can I disable interactive shell access while tunneling web traffic through SSH?

I am looking into implementing SSH tunneling as a cheap VPN solution for outside users to access Intranet-only facing web applications. I currently am using Ubuntu Server 10.04.1 64 bit with OpenSSH ...
1
vote
1answer
2k views

MS SQL Server configured for secure (SSL) connection allows non-secure connection from JDBC Client

I need to connect to the MS SQL Server 2008 r2 using the secure communication. I have been able to do the same using the following connection string: jdbc:sqlserver://<<db server ...
2
votes
2answers
13k views

troubling anonymous Logon events in Windows Security event log

I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...