Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
3answers
1k views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
-3
votes
2answers
29 views

Modifiying a server securely

I wanted to purchase a dedicated server to host my site. I am a newcomer to this and wanted to know if I hired someone to secure the server and SSH for me, will that put me at risk? Or is there an ...
7
votes
2answers
49 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
10
votes
7answers
4k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
-7
votes
2answers
47 views

How to secure server when the root password is changed [on hold]

I have a server now and I do a web application for my customer, I have the server credentials, what if my customer changes the server credentials after I have completed the application, I don't get ...
0
votes
1answer
21 views

Webmin - Disallow access by IP [on hold]

I have installed a Webmin instance. I can access by both domain:port and ip:port. Is there any way to restrict access to an specific domain name and disallow direct access by IP?
0
votes
1answer
19 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
0
votes
1answer
31 views

How to save output from grub-md5-crypt to a file ?

I am using Cent OS 6.5 and I want to save the generated output and md5 hash from grub-md5-crypt command to a file. The grub-md5-crypt command asks us to set a password. I want the password(which I ...
-3
votes
0answers
46 views

Linux based security for companies - how much do you do? [on hold]

So if your company is mostly Unix/Linux based on the server side (but mostly Windows on the client side), how do you go about securing the network and all workstations? I assume that you have a ...
-1
votes
1answer
14 views

winserver2012 “closed access” permissions to folder

I have some sensitive files, that should be accessed only by a small group of users. Currently the files are stored in a folder, on a WinServer 2012 machine, and will be accessed via a mapped location ...
1
vote
0answers
11 views

Weird `lastb` output

Recently I got weird output from lastb on my VPS: root ssh:notty 122.10.102.42 Thu Aug 27 11:19 - 11:19 (00:00) root ssh:notty 122.10.102.42 Thu Aug 27 11:18 - 11:18 (00:00) ...
2
votes
1answer
56 views
+100

Apache security - list all possible handlers / actions

To ensure there aren't security weaknesses that can be exploited via .htaccess, how can we see all possible handlers that Apache can use via directives like SetHanlder and AddHandler. I know I can ...
3
votes
2answers
28 views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
-1
votes
0answers
14 views

CVE RSS security vulnerability feed/alerts for specific software? [on hold]

I've found myself responsible for maintaining PCI compliance on our servers. I get reports from our scans and then react based on the information in the scans by applying patches or updating ...
2
votes
3answers
578 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
29
votes
5answers
15k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
0
votes
1answer
2k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
1answer
18 views

DNS queries are high for non existent records. can safely do a 0.0.0.0 wildcard record?

I have a domain and i am use dnsmadeasy for the DNS. I have noticed the queries are up in the millions each month for records i don't even have. So is it okay to do a wildcard A record such as ...
-1
votes
2answers
18 views

okay to allow any outgoing port for sending mail

I have a small app on my centos6.6 server i am running that allows the user to send an email on a custom port and I am allowing any port to be used. Is there any security risk for allowing this app to ...
8
votes
3answers
3k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
0
votes
0answers
13 views

Teamviewer webclient does not use https [migrated]

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
0
votes
0answers
39 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
-1
votes
2answers
757 views

Disable support for LOW encryption ciphers for glassfish port no 3920

Qualis team found a vulnerability with our glassfish with port no 3920 . glassfish version :- glassfish-3.1.2.2 Port no :- 3920,3820 Below are the details from Qualis Messages ...
2
votes
1answer
22 views

Group Policy settings for account policies disappeared

Looking for any ideas, we discovered that our group policies (default policy) was no longer applying our account policies (password age/complexity/history etc). Our DCs still had the local policy ...
-1
votes
1answer
25 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
0
votes
0answers
15 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
3answers
301 views

Managing Linux users remotely

In a Linux network, is it possible to manage permissions from a central location? If I have an LDAP server where users can authenticate, can I manage permissions from there? I'm talking about ...
0
votes
1answer
40 views

How to access AD directory user which has no read permission

While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible". I've done the ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
-2
votes
3answers
61 views

Is there a GUI tool to log and view outgoing CURL requests from a Linux server? [duplicate]

I've seen several similar questions - but none that truly answer the question. So here goes: PROBLEM: A script is being run on one of our servers that is making outgoing post (and other) requests ...
1
vote
3answers
69 views

SSH and security guidelines

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines. One of these guidelines suggests to disable root user and create a new user that works as an administrator using ...
1
vote
1answer
37 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
0
votes
1answer
19 views

Ubuntu production server access configuration recovery options

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server The configuration of SSH is as follows: # ...
0
votes
1answer
46 views

Linux DMZ in a Windows Network

I'm a wet-behind-the-ears reluctant sysadmin, so I'm playing catch-up here. I've come across the term DMZ before, but I never looked into it until just recently. In fact I'm still not sure exactly ...
0
votes
1answer
45 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
2
votes
1answer
40 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
3
votes
3answers
30k views

ASP.net user account permissions in IIS 7 on Windows 2008 server

I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until. I'm in the middle of an upgrade to IIS 7 on Windows 2008 ...
52
votes
5answers
45k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
0
votes
0answers
22 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
1
vote
1answer
47 views

Using a whitelist too large for an AWS VPC Security Group

I have a large list of IPs I need to whitelist for a VPC instance. I've added as many ranges as possible to the security group until I ran out of available rules. I'm adding rules for HTTP and HTTPS ...
0
votes
1answer
40 views

Permission issue on windows server

I have logged on to a windows server 2012 R2 machine with local admin account. I was trying to save a file on the hard drive but it says that I do not have permission to save file on the disk. I have ...
0
votes
1answer
9 views

How to forbid access to admin URL path in Apache config by IP subnet?

I want to only allow a private IP range to be able to access the administrator panel on my site. I found an article explaining how to do it for a specific directory path, such as /var/www/admin/, ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
0
votes
2answers
36 views

Lost all local admin rights on domain joined computer

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled. On a new domain I'm ...
3
votes
2answers
3k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
-1
votes
0answers
14 views

secure IIS directory traversal and command exec [duplicate]

i have a IIS 7.5 webserver that an attacker upload an aspxshell on it, is there any aspect to restrict this malicious script to it's application pool folder? like php_openbasedir thanks
0
votes
0answers
12 views

Openswan L2TP setup to allow admin user access to AWS VPC

I've got an ssh bastion host, but managing the ssh whitelist is annoying, opening ssh to the world is suboptimal. I'd like to tuck a vpn server in front. Can't get openvpn to stay connected for more ...
2
votes
1answer
4k views

How to secure memcached?

In Debian, I have installed memcached (using this guide) to lower the otherwise unmanageable load on mysql database. The database is on a separate server, and memcached and Varnish are on the front ...
0
votes
1answer
16 views

mitmproxy device identification

Currently am experimenting with mitmproxy. I have a setup where I can see all the traffic that is running through. I have multiple mobile devices (ios and android). I have installed the mitm ...