Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
6 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
2
votes
10answers
4k views

Is it worth blocking hackers' IP addresses?

A Chinese IP address shows up in our logs as accessing one of our surveys but it stands out because the user tried adding a string to the end of the survey's URL (as if trying to perform a SQL ...
0
votes
0answers
9 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
17
votes
3answers
13k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
0
votes
1answer
46 views

Network maps, best admin practises and how them saved your ass?

I am reviewing the security of a (quite large) network. There are a some thousands switches, several hundred routers, several hundred access points, tenths of FW, IPS, and so on. PCs and servers are ...
1
vote
1answer
1k views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
0
votes
0answers
25 views

Win Server 2003, security permissions are reset by SYSTEM. Why?

I've got a Windows Server 2003 with a physical drive (let's say Z:/) It's shared within my company. In the past two days the users were complaining that they do not have access to files on that drive. ...
1
vote
0answers
15 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
1answer
33 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
-2
votes
0answers
28 views

How might I give secret keys to a php web page without making them readable by the apache user?

I am developing a web site which runs on a generic LAMP stack. Consider these two PHP files /web_stuff/phpbin/secrets.php /web_stuff/public_html/index.php Apache is runs as the user www-data and ...
4
votes
8answers
66k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
4
votes
2answers
1k views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
-3
votes
0answers
18 views

Unauthorized connection [closed]

I have a problem with connecting a user .... that manages to connect from outside my network via the internet as administrator .... ..... .... in a network with Windows 2012 r2 standard .. ..and I did ...
8
votes
1answer
84 views

Where and how is the password stored for the account associated with a Windows service?

In HKLM\SYSTEM\CurrentControlSet\Services\MY-SERVICE-NAME there is the Object Name key which contains the name of the user, but I can not find the password. I am trying to understand how DP API ...
11
votes
6answers
32k views

What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user “nobody”)?

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder: "2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning: Unknown: ...
0
votes
1answer
108 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
0
votes
0answers
14 views

Zentyal - Samba Issue : A logged in user cannot access home folder

0 down vote favorite I have a very strange issue : I can login to my domain with my username/password and when i try to access my home folder (lets say \Knosos\myname ) i receive an access denied ...
1
vote
1answer
28 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
1
vote
1answer
1k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
3
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
0
votes
0answers
27 views

How do I require a sudo password on Google Compute Engine instances?

The default configuration of Google Compute Engine instances allows administrators to run all commands via sudo without specifying a password. This seems like a security weakness, because the theft of ...
1
vote
3answers
629 views

Erase Sharp Printer Hard Disk?

I have a number of Sharp MX-M550 printers that are at the end of their useful life. Each device has a hard disk. Can anyone advice as to how I go about erasing the drives either whilst they're in ...
1
vote
1answer
52 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
0
votes
0answers
31 views

Windows File Security settings

I would like some input on a problem I am working on. The scenario is as following. I have a folder which has security settings (permissions) that are inherited. One of them is a permission entry for ...
4
votes
6answers
36k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
0
votes
0answers
11 views

OpenVpn Client credentials security, key crt generation

I'm curious what is Your opinion on openvpn client crt/key security In most cases (tutorials), the clients key/crt are generated on the same openvpn server, and no one cares about the future. This is ...
2
votes
7answers
2k views

Enabling xp_cmdshell in a production environment

A SQL developer on a project I am working on has asked whether it would be possible to enable xp_cmdshell on the production database as it is easier to export CSV files using xp_cmdshell than to write ...
1
vote
2answers
62 views

Security implications of using relative paths in the PATH enivronmental variable?

We had an audit just flag us for having relative paths inside out $PATH env variable. I am uncertain if this is truly a security concern and would like to reach out to everyone to see if this is ...
0
votes
1answer
24 views

Understanding Apache rules in <Directory> directive

I have tried reading the manual although to be honest I am still finding it hard to understand and get my head around what the Order/Allow actually does. I have the following code inside a virtual ...
0
votes
0answers
27 views

How to respond to password crack on SSH server? [duplicate]

Update: I'd already read How do I deal with a compromised server? but was hoping for advice specific to a password crack (such as using fail2ban), as well as info about whether this could be an OS ...
0
votes
1answer
32 views

What is the best way to isolate vhosts on a linux server?

Firstly, I'm wondering what is the best way to isolate Apache's vhosts from each other. I suppose this has something todo with the Linux filesystem as well, since it's not a good practise to have ...
56
votes
4answers
12k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
2
votes
2answers
62 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
4
votes
2answers
4k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
-1
votes
0answers
30 views

Variable name seemingly resetting 'itself'

I have an issue with the web-server I use where the following server-side Javascript code: var URLs = { [...] }; Keeps changing to: var URLS = { [...] }; Which seriously breaks the webpage. I've ...
2
votes
2answers
41 views

Is it possible to encrypt a virtual machine or container so the host is not able to read any of its data? [duplicate]

I'm wondering whether it would be theoretically possible for a cloud hosting provider to run an application for a customer where the customer doesn't trust the hosting provider with the data in the ...
1
vote
0answers
28 views

Determine server damage - File injected possibly through ProFTPD [duplicate]

I just found a file at the /tmp/ directory named .<?php passthru($_GET['cmd']);echo 'm3rg3';?> Owner and GroupOwner are "proftpd" and "nogroup", respectively, as follows: -rw-r--r-- 1 proftpd ...
0
votes
1answer
26 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
-2
votes
0answers
10 views

Will loading passive content in secure Iframe will show up on all browsers?

Hey we would like to move our site to HTTPS, but the main question is will our passive content that hosted on 3rd party website shown in secure iframe, Example: The page on website is using HTTPS ...
10
votes
8answers
27k views

Is using integrated security (SSPI) for accessing SQL Server better for web applications?

When deploying web applications (.net) to a production environment, is it better to use integrated security or does it even matter? It seems to me that if a hacker breaks the web server, it won't ...
0
votes
0answers
6 views

How do I supply username and password to dovecot's fts_solr plugin?

I setup solr-tomcat with password protection (on Ubuntu 16_04) and now would like to connect fts_solr from my dovecot IMAP server. However, I cannot find a way to supply username and password in the ...
1
vote
0answers
21 views

How I can look from that script runs sendmail?

my problem is that some script in php or some other script or program is sending spam. I am not able to trace where this program runs. do the following: ps aux | grep sendmail nginx 28286 0.0 ...
1
vote
0answers
15 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
44 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN ...
15
votes
9answers
7k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
3
votes
1answer
317 views

How to verify installation of ImageMagick is not vulnerable to CVE-2016-3714

CVE-2016-3714 was announced on May 3, 2016. This vulnerability unfortunately goes by the name, ImageTragick and has received some press (for example, this ArsTechnica article). Until updated ...
1
vote
0answers
32 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...