Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
3answers
234 views

Confused about what I'm seeing in my apache access log (think I might have been hacked)?

I have a VPS running CentOS. I installed apache and configured the access log. Just checked it and found some interesting traffic: VPS-Hostname MYIP MYIP - - [23/Dec/2014:16:47:20 -0500] "GET / ...
4
votes
2answers
54 views

Website is being targeted by mail bots

I have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
1
vote
1answer
48 views

What is the best way to block IPs from an apache2 web server?

I'm asking myself whats the best way to block certain IP Addresses (or whole blocks from countries like china, south korea) from accessing my apache2 web server. I'm aware of methods using Allow ...
12
votes
3answers
736 views

Enable SSH shell access but disable SFTP access

I've searched for a viable answer to this question, and most of the answers include advice on why to not do it. However, here's the scenario, and what makes it necessary: I have a console app, and in ...
-3
votes
0answers
16 views

Connect public cloud network with a private enterprise network [on hold]

can you describe or provide some documentation related to the different architecture used to connect a public cloud network and a private enteprise network? Nowadays hybrid cloud is sold as a solution ...
0
votes
1answer
29 views

Pricing of Key Pairs and Security Groups on AWS?

My free AWS account expired. I deleted all S3 and EC2 resources, but am wandering if I can leave the Key Pairs and Security Groups without having to pay for them. (My account resources look like this ...
0
votes
1answer
128 views

nginx - deny all *.php requests except index.php for security reasons

os: CentOS 7 nginx: 1.6.2 httpd: apache 2.4.6 cms: Drupal 7 After my server was compromised I removed all from server, reinstalled OS and soft, and restored data from backup. Now I configure all ...
-1
votes
1answer
55 views

How do you “prevent powerful accounts from being used on unauthorized systems”? [closed]

I was browsing through Microsoft's Best Practices for Securing Active Directory and saw the chart linked which includes some of the best practices included in the document, rated by importance. At ...
0
votes
2answers
179 views

Unexplained spike in web traffic

Question I am suspicious of an unexplained 1600% increase in traffic and massive slow-down that lasted about 10 minutes. I'm not sure if it was an attempted DoS attack, dictionary login attack, etc. ...
5
votes
5answers
5k views

“Account locked out” security event at midnight

The last three midnights I've gotten an Event ID 539 in the log...about my own account: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 539 Date: ...
-1
votes
1answer
67 views

Restrict shared folder access to specific computer/IP [closed]

How to configure a server [having DNS and ADS roles installed user account created/configured] to restrict its shared folder access to a specific computer in the network. Sol-1: Solution proposed ...
4
votes
1answer
39 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
3
votes
2answers
36 views

Are redirected GET request to HTTPS secure?

This affects a lot of thank-you pages from 3rd party carts, etc. Are GET requests to HTTP that are redirect to HTTPS secure? Or, can they be snooped before the redirect takes place? Thank you
6
votes
1answer
56 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
1
vote
1answer
28 views

HTTPS posts to HTTP URL's insecure?

Have to deal with some incorrectly assigned/redirected posts from an HTTPS server to HTTP URL's. How much of a security risk are these? Are they vulnerable to something like a man-in-the-middle ...
1
vote
1answer
28 views

Authentication of saltmaster against salt minions

I am just getting started with salt and I am wondering how the saltmaster is being authenticated against the clients. I know that when connecting a minion the master has to accept the public key of ...
0
votes
1answer
2k views

EC2 instance always ask me to enter passphrase for the pem during connection

The pem file is generated by AWS console I was able to connect using the EC2 remote web interface, using the same pem file The permission of pem is 600 already Error.. ssh -i ~/test.pem -v ...
-2
votes
0answers
13 views

WordPress Unauthenticated Shell Upload Vulnerability - wdt_upload_file [duplicate]

I have problem with my Debian server and security issue. In /var/log/apache access.log i found those errors: 46.118.159.153 - - [14/Dec/2014:13:42:25 +0100] "GET //wp-admin/admin-ajax.php HTTP/1.1" ...
0
votes
0answers
13 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
-1
votes
0answers
49 views

Non-standard way to access a drupal site (circumventing security)

In a Drupal installation, I have a site configured like so: DRUPAL_ROOT /sites /sites/example.com.au/ /sites/example.com.au/settings.php The web server's default site has DRUPAL_ROOT as its ...
0
votes
1answer
27 views

Centralised log monitoring for linux servers [closed]

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch. To describe my situation: 10 linux hosts Using logwatch to ...
1
vote
2answers
776 views

Best pen test distro [closed]

I have seen a lot about Back Track and was wondering if that was the best pen testing distro or if there are others that are better.
1
vote
0answers
19 views

Why does SYSTEM “Privilege Use” event cause another program to crash?

This is an odd one that I've been trying to track down for while. I am not a server administrator, but a programmer/developer, but, sadly, at my company, I probably have the most knowledge of how to ...
0
votes
1answer
27 views

Using Cloud Servers and Firewall

I would like to ask if the configuration of "firewall rules eg. only allowing port 80.. when configuring a server instance on cloud services such as google cloud and amazon aws is securely equivalent ...
2
votes
1answer
2k views

What are anonymous logons in Windows Event log?

I'm playing with a new Win2008 R2 server installed and hosted online with a direct connection to the web (i.e. no separate firewall in front of it). The server is supposedly locked down with just ...
1
vote
1answer
864 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
12
votes
17answers
1k views

What are the arguments for and against a network policy where the sys admin knows users passwords? [closed]

I'd like to know pros and cons.. reasons for and against the idea of sys admin’s maintaining user account lists with passwords.. and additionally not allowing those users to change their passwords. I ...
0
votes
1answer
871 views

Nginx : Proper use of limit_req_zone and limit_req

I have 2 website running on VPS. Their purpose is sharing music files and publishing news. Both of them use wordpress. What I am trying is that I want to prevent little hackers from flooding the ...
1
vote
0answers
63 views

Can I install an internet connection on a small town? What would I need? How much would it cost? [closed]

Here is the problem. 3,000 people with no internet or internet very slow. Here is what I want to do. Give them free or almost free internet based on how much money they make or have. Can I do it? ...
0
votes
1answer
23 views

Remote SCP & SSFTP access to linux server denied

This situation is a bit embarrassing but I could really use some help. I took steps to secure my linux server by carrying out the following steps: created and use a different user to use in place ...
2
votes
2answers
852 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
4
votes
2answers
1k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
2
votes
6answers
12k views

How to disable SELinux for Apache httpd only on my Fedora 14?

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed ...
3
votes
2answers
95 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
2
votes
0answers
21 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
1
vote
1answer
36 views

Lockdown Mozilla Thunderbird on Windows Remote Desktop Services

I've installed Mozilla Thunderbird 31.3.0 on a Windows Server 2012 R2 which has the Remote Desktop Services role. I want to configure the Thunderbird program and set each user's email account etc and ...
23
votes
3answers
51k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
-1
votes
0answers
31 views

Hiding parts of huge php project [migrated]

I have a big php project. Now I have not big developers team but we want more. So now I'm thinking about code security. Is there any possibilities to hide parts of code? For example. One team develop ...
0
votes
1answer
50 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
0
votes
6answers
7k views

How can I stop SipVicious ('friendly-scanner') from flooding my SIP server?

I run an SIP server which listens on UDP port 5060, and needs to accept authenticated requests from the public Internet. The problem is that occasionally it gets picked up by people scanning for SIP ...
3
votes
2answers
676 views

What are pros and cons of keeping a local administrator account in Windows 7 workstations in a domain?

We have a network with Windows 7 Enterprise machines, all members of a domain. We've been keeping a local (unlocked) 'Admin' account on each workstation in parallel to the built-in (locked) ...
3
votes
2answers
1k views

Google authenticator with Openldap or Fedora 389 Server or FreeIPA

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
1
vote
2answers
87 views

Task Scheduler with Virtual Accounts, possible?

Currently I'm using LOCAL SERVICE as the user account for various regular tasks, and was wondering if it was possible to use a Virtual Account instead. Task Scheduler seems to reject NT SERVICE\ ...
33
votes
9answers
14k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
-1
votes
0answers
35 views

Best practice to provide MySQL access to my users

My application collects data and stores it in a MySQL database. I want to provide read access to my users. I previously had a VPS with cPanel. I set up a read-only mysql user and distributed the ...
0
votes
1answer
2k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
2
votes
1answer
826 views

Using a Group Managed Service Account (gMSA) for a scheduled task

Back in Windows Server 2008 R2, when stand-alone Managed Service Accounts (sMSA) were new, they could not be used to execute scheduled tasks. In Windows Server 2012 however, there is a new type of ...
-3
votes
0answers
36 views

Large number of requests, high outgoing traffic [duplicate]

I have a VPS on Linode with Ubuntu 12.04 LTS on which I run my staging server (protected with basic HTTP authentication). I the recent days, I received a high number of requests from a handful of IPs ...
0
votes
2answers
238 views

postfix feed to program as root

I'm trying to get postfix to pipe stdin from an email into a script that needs to be run by root (yes I understand the security issues of doing this. no lectures, please). Content of aliases file ...
1
vote
2answers
2k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...