Security is not a product, but a process.

learn more… | top users | synonyms (1)

2
votes
3answers
151 views

AWS Security Groups vs Windows Firewall

Is it considered best practice to disable the Windows Firewall on an Amazon EC2 instance, and control traffic only via EC2 Security Groups? If I open a port on the server firewall, and then open the ...
1
vote
1answer
1k views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
1
vote
0answers
18 views

How to secure configuration management server

There are many configuration management software options nowadays (Chef, Puppet, CFEngine, Ansible...) which offer an architecture with their repository on a central server and clients communicating ...
0
votes
0answers
15 views

Secure Email Settings for Email Clients & for PHPMailer

I'm trying to work out how to make my outgoing/incoming email's as secure as I can possibly make them. First of all, my domain has Wildcard OV SSL Certificates, I have copies of the .csr, .crt and ...
0
votes
0answers
24 views

Company Discover A Ghost IP With All Ports Opened [on hold]

Good day, recently when we do a screen through at our internal network. We discover a Ghost IP with all the ports open FTP SSH etc.. and the last one is VNC. My questions is , does it mean our ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
4
votes
2answers
4k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
14
votes
6answers
21k views

Securing a SuperMicro IPMI BMC

I've recently acquired a SuperMicro X8DTU-F motherboard, which has a built-in BMC, which basically runs the IPMI system. It turns out to be a small Linux system running on an ARM processor. ...
-1
votes
0answers
10 views

Download files from server securly from mobile app [on hold]

I am creating a mobile app that need to download some files from a server (AWS S3 or similar). I would like to use a REST API for downloading and authentication. I have read a lot about ...
-1
votes
1answer
15 views

Allow run /sbin/ifconfig to user

So, I want to allow some user to execute ifconfig. I'd created a special group "if" and done user to own this group. And now I'm going to do "chown root:if ifconfig". But I think: What wrong thing ...
0
votes
0answers
21 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
2
votes
0answers
32 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
2
votes
2answers
25 views

How much protection is provided for my remote centos vps by using certificate-only root login

I have two leased centos servers, one to run mysql for backends to the web and mail server on the other, as well as data from my android apps. I am only planning to give access to the data server if ...
1
vote
0answers
23 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
0
votes
2answers
2k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
0
votes
1answer
32 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
18
votes
9answers
11k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
0answers
21 views

WordPress site with no traffic; MySQL reporting 300-500 queries per second, frequently crashing

My server is running Debian 7.10 (Apache 2.2.22, MySQL 5.5.47, PHP5). It's a VPS. I've tried to summarise the issue in the title. I'm running a very small, private WordPress blog which is only ...
2
votes
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
0
votes
0answers
21 views

multi-factor authentication to delete disks/snapshots/etc GCE [closed]

I want to know if there's any way to configure a multi-factor authentication to delete snapshots and disks on GCE Like SMS or an token authenticated app on a smartphone. Thanks! If yes, where can I ...
2
votes
1answer
38 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
2answers
21 views

Is it necessary to secure TCP traffic for PHP FPM over shared private VPS network?

There are lots of recommended practices and tutorials for securing various components of a LEMP/LAMP stack when running in a cluster whose private network traffic is shared by other, potentially ...
6
votes
5answers
17k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
1
vote
1answer
1k views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
2
votes
0answers
14 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
1
vote
3answers
189 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
-1
votes
0answers
28 views

working on a locked corporate network, what do I need to get unblocked in order to be able to use tools like NPM and GIT? [closed]

I work at a company that has it's network really locked up. There are very few sites you can browse, etc, and when you try to download a file, it has to go through a process where it first gets ...
3
votes
6answers
64k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
2
votes
3answers
62 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
2answers
90 views

Configure same Internet Explorer zone mappings with and without ESC via GPO

Our Active Directory domain consisting of Windows Server 2012 R2 servers and Windows 7 workstations configures Internet Explorer security zones using this Group Policy setting: Computer ...
-2
votes
0answers
25 views

Protect data so only verified client can read [closed]

I am creating a REST server that will be holding a decent amount of proprietary information. I want users to be able to access the information in only the intended way, which is through a map built ...
64
votes
5answers
58k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
2
votes
0answers
23 views

Protect cached content in apache

I'm facing an issue where I have some cached contents in a disk and I want to protect it with a token url. I can protect my files via htaccess, once they are not cached (direct access), but now I ...
1
vote
1answer
55 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
2
votes
0answers
27 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
7
votes
2answers
182 views

How to ensure integrity and security enforcing signed unmodified RPM package?

There is a way to verify files related to specific package against original RPM content: # Verify `vsftpd` package. rpm -V vsftpd How to complete the chain and verify that rpm command itself hasn't ...
6
votes
2answers
290 views

What does 'Log on as a Service' actually mean?

I am building Group Policy for a new domain that we are migrating to. In our current environment the settings Log on as a Service is set at the Server OU level - which has about a hundred Service ...
4
votes
1answer
177 views

Where does Credential Manager store credentials on the file system?

I want to clear a users stored credentials on a remote machine. Without having to have the user login and open the Cred manager GUI or run CMDKEY with them logged in. Is there a place on the file ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
0
votes
0answers
18 views

Website was hacked but only 1 domain [duplicate]

I recently found out that one of my Domains (which was only a empty Wordpress installation), was hacked. The website didn't show the wordpress installation anymore, instead there was just a website ...
1
vote
1answer
32 views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
3
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
1
vote
3answers
85 views

Secure Administration AD Domain

I have a project to securize my Active Directory infrastructure. To do that, one of my colleague told me about the possibility to create another AD domain in the forrest just for administration. That ...
1
vote
2answers
48 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
1
vote
4answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
22 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
1
vote
0answers
19 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
3
votes
3answers
3k views

what's the difference b/w MMC.exe and certmgr.msc

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove ...