Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
4answers
128 views

Our server hosting provider asked for our root password

I work at a company that develops and hosts a small business critical system. We have an "Elastic cloud server" from a professional hosting provider. I recently got an email from them saying that ...
9
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
-1
votes
0answers
5 views

php disable_function recommended settings [on hold]

Looking to enhance PHP security. What is a recommended disable_functions setting for a shared hosting server with cPanel, PHP 5.5 (CloudLinux), suPHP enabled? My current setting is: ...
1
vote
1answer
12 views

Can I block a file execution with AppLocker?

We currently use a combination of a regular and an "advanced/fancy" endpoint malware protection, in the advanced malware app, I can feed a SHA256 hash of an executable into the advanced platform and ...
0
votes
0answers
13 views

Virtual web server configuration dmz

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running: - Mail server - WEB server for enterprise website and ecommerce. the esxi server has an iscsi ...
-1
votes
0answers
21 views

Universal management System abuse [duplicate]

Our ISP have told us that our machine ( universal management tool ) is being abuse. What they send us as log files was this: Jun 13 08:37:37 penfold postfix/smtpd[6176]: connect from unknown[x.x.x.x] ...
2
votes
1answer
935 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
2
votes
2answers
29 views

Restrict access to .ssh folder over network shares

I run a small server running Ubuntu Server 14.04 and have just noticed that the .ssh folder in the users home directory is accessible via SMB and NFS. The SMB and NFS are both secured, however I ...
10
votes
9answers
5k views

How to disable responses to PING

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
0
votes
0answers
16 views

How can I automate the retrieval and usage of passwords from within a script?

We have automated scripts that access certain devices and are getting the passwords for the devices from a root-read-only plain-text file. Is there some kind of architecture we can use so that we can ...
1
vote
5answers
201 views
+150

How to prevent remote code execution from a domain member server?

Is there a way, using a firewall, Group Policy setting, or other control, to prevent someone logged into a domain member from being able to remotely execute code on a domain controller (that they ...
0
votes
0answers
19 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
3
votes
1answer
105 views

Server2k8: Prevent membership in a group based on membership in another group

I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, ...
4
votes
0answers
42 views
+100

Is is possible to disable Certificate Transparency (audit log checking) of certificates in Chrome?

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on ...
3
votes
6answers
42k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
1
vote
2answers
1k views

McAfee ePO server not displaying updated Product version number

I have recently been given Administrative rights to help maintain ePO on my companies network. From the group of machines that I am in charge of keeping up-to-date, a small amount of these machines ...
0
votes
1answer
16 views

Azure SQL - Sudden connection spike

At first: This is my first question on Serverfault. I am not sure if it fits better on Information Security. If so, please leave a comment and I will move the question. Question My company is ...
0
votes
0answers
7 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
3
votes
1answer
38 views

Debian - Warning: Possible LKM Trojan installed

I am running chkrootkit every night on 3:04. More than 1 year it was not returning any problems but 1 month ago this warning started to appear: ======================= Checking `lkm'... ...
0
votes
0answers
5 views

Is it secure to do “chroot” SFTP directory without actually setting owner to be root?

I don't know if this sounds wrong, but I have a use case where I need to run a cron job and rsync the data into the SFTP file directory. Typically SFTP set up on the Internet would suggest to set the ...
1
vote
2answers
1k views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
0
votes
1answer
15 views

Google Apps password change not reflected across all devices

We have a paid Google Apps account and I recently changed the password for one of our users. I confirmed the password change by logging into gmail.com using the new password. The old password isn't ...
1
vote
0answers
4 views

I can installa “Ossec” on xenserver host?

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
7
votes
2answers
18k views

HOWTO: Disable complex password policy on Hyper-V Server 2008?

How do you disable the password complexity requirements on a Microsoft Hyper-V Server 2008 R2? Keep in mind that when you log into the server, the only UI you have is: And you cannot run ...
-1
votes
1answer
93 views

DHE cipher suite issue

I am now using this cipher suite: SSLCipherSuite ...
0
votes
1answer
23 views

What users should have access to sudo? (node, php, ftp…)

Before I begin, feel free to suggest a better title for this question. I've registered on Digitalocean and installed a LEMP stack. This is my first time configuring a server from scratch. Even though ...
0
votes
1answer
10 views

XSS Vulnerability with PCI RapidComply

I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
-1
votes
0answers
14 views

Protection of information terminal running Windows OS [closed]

I need an information computer terminal to work 24/7 in a protected public area. Operating system is Windows POS Ready 7 EVAL. I need this terminal to send HTTP messages to a single IP address in the ...
0
votes
3answers
46 views

Security concerns with enabling PowerShell on a production server [on hold]

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET). One of my colleagues said to me ...
0
votes
1answer
20 views

is there security risk when running tomcat7 on port 80

I have setup a server with tomcat7 running on port 80. I have googled around and found out that since port 80 is a "magic port" it needs root privileges to be bound. For this reason most comments i ...
0
votes
1answer
43 views

Strange SECCOMP entries for sshd in audit log

I'm seeing strange entries for sshd in my audit logs along the lines of: type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr /sbin/sshd" sig=31 ...
-1
votes
2answers
46 views

What IP address should I use for a device that I want to break network access to?

I have an IPMI server on a super micro motherboard that I am unable to disable. There is not even a jumper to disable this either. After seeing all of the security issues that the IPMI server they ...
38
votes
5answers
84k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
1
vote
1answer
11 views

MS CRM: How secure is an Internet Facing Deployment (IFD)?

From a security perspective, how secure is an IFD deployment of MS CRM 2013 or CRM 2015? I know it's the recommended way to expose MS CRM to the net, but what are the vulnerabilties? Is it ...
5
votes
12answers
6k views

How can you prevent root password change on linux?

I'm setting up a server which other people will have sudo access to via ssh. They can install stuff and make changes as they see fit, however I still need to manage the server, install patches and ...
3
votes
2answers
2k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
13
votes
2answers
8k views

Is a central location for authorized_keys a good idea?

I'm in the process of configuring a cloud server to run the following stack: Ruby, Passenger, Apache; under Ubuntu 10.04 (Lucid Lynx). In the process of wanting to make the server easier to manage I ...
0
votes
1answer
20 views

TCP Keepalive: Why does an idled ESTABLISHED connection end after 60 seconds, instead of tcp_keepalive_time?

I am investigating ways to mitigate a server against DoS-type attacks. In one scenario, I've opened several hundred TCP connections to my webserver. I do not send any data after the initial TCP ...
-4
votes
0answers
25 views

Security of Virtualization [closed]

i have three virtual servers and i need virtual switch with additional security capabilities.So how can i restrict,log and monitor VM-to-VM traffic involved routing the virtualized network traffic.
-5
votes
0answers
16 views

Controlling and Monitoring of “USB and CD ROM Drives” [closed]

I need to see list of machines (desktops and laptops) having USB and CD ROM Drives enabled on it and when they were attempted to use.
7
votes
3answers
5k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
0
votes
1answer
16 views

Block/Prevent Adminer - Apache [duplicate]

I found out that if someone was able to hack any FTP account on my server and upload Adminer they could alter the database. I tried Google'ing a way to block or prevent Adminer from working, but got ...
0
votes
1answer
16 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
1
vote
2answers
56 views

From a technical perspective, is my data insecure when using a public VPN like SecurityKiss?

I wonder if I understand well VPN. I connected to SecurityKiss, they provide a list of TunnelBlick configs. In order you to connect their VPN. (TUnnelBlick is OpenVPN based). Am I right : your IP is ...
0
votes
2answers
14 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
2answers
139 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
2answers
34 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
6
votes
2answers
3k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
13
votes
11answers
4k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
0
votes
0answers
10 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...