Security is not a product, but a process.

learn more… | top users | synonyms (2)

5
votes
1answer
48 views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
0
votes
0answers
4 views

How to config Squid SSL bump to let Paloalto PA series firewall recognize App-ID

A Paloalto firewall(PA-2050,POS 4.1x) was capable of recognizing the websites which users are visiting(thru http/https) then flag them with a App-ID and apply application control on the traffic, for ...
9
votes
15answers
3k views

How to manage rack keys?

As a result of a security audit there's the need to lock the racks and manage the keys: Keep the keys safe Record key usage Complying with these two requirements has many challenges as there are a ...
-5
votes
0answers
31 views

Why minimal install of OS? [on hold]

We are working with one of our customer on Performance Tuning. During the kick off discussion with their IT team.A best practice of slimming down the operating system with minimal install and install ...
-1
votes
1answer
33 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
5
votes
5answers
1k views

How can I flush my ssh keys on power management activity?

Using ssh-agent and private keys per the usual. Everything's working as normal. My question regards best practices on flushing keys from ssh-add on activity like sleep, suspend, hibernate, etc. I ...
0
votes
0answers
8 views

IIS Security - prevent web script to navigate upper level

I would like to know how to prevent the web script to be able to navigate his upper level ? For instance, the web script is located at C:\Websites\Website-A and it shouldn't able to navigate to upper ...
0
votes
1answer
730 views

Nginx : Proper use of limit_req_zone and limit_req

I have 2 website running on VPS. Their purpose is sharing music files and publishing news. Both of them use wordpress. What I am trying is that I want to prevent little hackers from flooding the ...
5
votes
4answers
64 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
3
votes
1answer
81 views
+50

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
16 views

How are the security groups injected in an image in OpenStack?

I have been using OpenStack for some time and was just wondering how the security groups are injected in an image file. I browsed on the internet but I could not find a solution.
1
vote
3answers
1k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
-3
votes
1answer
46 views

Keeping your server safe [on hold]

I have a typical vps server with some custom sites on it running on port 80, a mail server, I don't have a DNS server and it is a default ubuntu 12.04. I don't have any admin panel, I am doing all the ...
-3
votes
0answers
23 views

How to test connection to Google mail server? [on hold]

For example, google mx records for gmail is ALT1.ASPMX.L.GOOGLE.com I've tested all common smtp ports (25, 2525, 465, 587) and does not work. Any idea?
1
vote
3answers
409 views

Security implications of adding www-data to /etc/sudoers to run php-cgi as a different user

What I really want to do is allow the 'www-data' user to have the ability to launch php-cgi as another user. I just want to make sure that I fully understand the security implications. The server ...
0
votes
2answers
21 views

How to restrict access to root to daemon user?

I have Apache 2.4 with PHP 5.5.14 installed on latest Debian. According to Apache security tips&tricks I've set my httpd.conf to this: <Directory /> AllowOverride none Require all ...
0
votes
2answers
52 views

Blocking geographic cities from accessing Asterisk using Secast

I am using Secast (www.generationd.com) for intrusion protection on my Asterisk PBX. It’s working great, and I now want to start blocking specific geographic regions. My system is getting hammered ...
0
votes
1answer
20 views

secast init file already exists

I'm installing SecAst on a new computer and I'm on step 2.1.7 (copying init files). I copied the first initd file, but when I copy the second one it says file already exists (and I'm overwriting the ...
2
votes
1answer
23 views

Preventing SecAst access from across the network

I have SecAst up and running great, and I realize that any workstation on the network can access the SecAst telnet interface. Is there a way to limit this to only my laptop? I don't want one of the ...
2
votes
1answer
29 views

Robocopy Ext USB HD to Server 2008

I tried copying data from an external usb drive to my W2008 server, g:\parent_directory d:\server_shared\parent_directory. Unfortunately, I picked the "copyall" paramenter which copies over D=Data, ...
4
votes
3answers
70 views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
0
votes
1answer
10 views

Obtain an offline image of an Xserve disk

We have an Intel Xserve with Mac OS X 10.4. It seems to have been infected by a virus. We want to obtain the disk image without booting into the OS. Preferably, we would want to boot via a USB disk ...
0
votes
1answer
1k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
0answers
15 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
1
vote
0answers
11 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
3
votes
2answers
735 views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
1
vote
1answer
566 views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
34 views

Failed PCI DSS Compliance

I got this from my compliance check results. To me it looks like my router is responding to their test but I'm not sure where to go . ( might be off track completely though) Description: PCI DSS ...
1
vote
2answers
758 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
2
votes
3answers
46 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
0
votes
0answers
23 views

Restricted logins + almost all ports closed : secure? [migrated]

Context : I plan to travel. I want to make a little cloud with my personal server. I wish I could d/l some of my files and eventually upload some files which will not be executed and the whole is ...
18
votes
2answers
1k views

Why should I start to replace Windows Server 2003?

Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis. I have heard that I should replace it by something "newer" and more "modern". Why should ...
0
votes
0answers
17 views

Apache logfile audit [closed]

I have some webservers with a lot of vhosts on them which log to the same logfile. I would like to do some audit to find successful exploitations (eg phpbb, wordpress etc exploits). Does anybody know ...
-1
votes
1answer
67 views

How to block incoming login attempts to postfix, pop3, imap?

We are running CentOS 6.5 with Plesk and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or ...
1
vote
1answer
650 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
0
votes
4answers
3k views

How can I stop SipVicious ('friendly-scanner') from flooding my SIP server?

I run an SIP server which listens on UDP port 5060, and needs to accept authenticated requests from the public Internet. The problem is that occasionally it gets picked up by people scanning for SIP ...
0
votes
2answers
30 views

SecAst: Potential documentation issue, Ubutunu 12.04.4 LTS and the command: cp -v

To Generation D: I am writing you about what might just be a documentation issue which hopefully doesn't have significant repercussions. This is something I encountered immediately at the start on ...
0
votes
2answers
42 views

Installing SecAst on AsteriskNOW with CentOS

Having some issues installing SecAst for IPS, Followed the directions up to 2.1.6 and found a way (on this forum) to install qt5-qtbase (thanks) but when I run ldd /usr/local/secast/secast the return ...
1
vote
1answer
32 views

How does one achieve in Windows 7 a level of security comparable to setting a file's permissions to 0600 in Unix?

I want to store securely the file .pgpass, which contains the authentication credentials (including passwords) for client programs to be able to log in to PostgreSQL servers. The Pg documentation ...
-1
votes
1answer
19 views

Alerting on threshold crossing?

We are using logstash + elasticsearch + Kibana to parse, store and view our logs respectively. Now, we want a notification/alert when a threshold for a particular log or threshold for a particular ...
0
votes
2answers
57 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
1answer
27 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
1
vote
3answers
192 views

Block a Non-ActiveSync Device from accessing Exchange 2010

We're trying to tighten security, and block users from accessing our mail server without having the proper MDM on their phones. With programs like Aqua Mail and CloudMagic, it seems like they go ...
0
votes
1answer
34 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
1
vote
1answer
25 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
3answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
2
votes
2answers
4k views

Grant account write access to specific attributes on Active Directory User object

I am trying to allow an account to update very specific attributes on all User objects. I am setting this security on the "User" object. When I add the account on the security tab, go to advanced, ...
0
votes
0answers
20 views

How to remove malware from Debian server? [duplicate]

We have one Debian server that is affected by a malware. It's adding some code to the .htaccess files in /var/www directory where all sites are stored. Here's the malicious code: RewriteEngine on ...
0
votes
1answer
27 views

SecAst: Premature Exit in Daemon Mode

To Generation D: This is a new problem with build secast-1.0.4.0-x86_64-ub12 that didn't happen with the previous build, secast-1.0.1.0-x86_64-ub12. When secast is run as a service (service secast ...
8
votes
2answers
3k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account. Would having users bring a copy of an SSH key ...