Security is not a product, but a process.

learn more… | top users | synonyms (1)

7
votes
4answers
4k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
93
votes
7answers
24k views

How does CTRL-ALT-DEL to log in make Windows more secure?

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination ...
0
votes
1answer
77 views

Apache HTTP server STIG rule

I am new to setting up Apache HTTP and have to STIG the Apache HTTP 2.2 I have running. (http://iase.disa.mil/stigs/app-security/web-servers/Pages/index.aspx). For one of the rules it says the ...
2
votes
2answers
89 views

Apache security - list all possible handlers / actions

To ensure there aren't security weaknesses that can be exploited via .htaccess, how can we see all possible handlers that Apache can use via directives like SetHanlder and AddHandler. I know I can ...
0
votes
1answer
35 views

Why do you need the awverify CNAME record for Azure?

See i.e.: How to set up CNAME to point to Azure or the text within the azure portal: Why is this necessary in the first place? How does pointing the domain name through an A record not prove that ...
-2
votes
5answers
2k views

What ports are least likely to be probed on the internet?

Suppose you've got a server that runs insecure software and you have to make it publicly accessible, what ports are "safest" for providing that service on the internet. By "safest" I mean least likely ...
0
votes
1answer
15 views

Openswan L2TP setup to allow admin user access to AWS VPC

I've got an ssh bastion host, but managing the ssh whitelist is annoying, opening ssh to the world is suboptimal. I'd like to tuck a vpn server in front. Can't get openvpn to stay connected for more ...
3
votes
2answers
2k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
0
votes
0answers
7 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
17
votes
7answers
4k views

Easiest way to send encrypted email?

To comply with Massachusetts's new personal information protection law, my company needs to (among other things) ensure that anytime personal information is sent via email, it's encrypted. What is the ...
1
vote
0answers
21 views

Public Key Pinning and subdomains [on hold]

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
1answer
35 views

Many failed ssh logins even with password authentication off

There are some bots trying to ssh (hundreds per day) all my servers at digital ocean. On /etc/ssh/sshd_config I´ve set: PermitRootLogin without-password PermitEmptyPasswords no ...
1
vote
1answer
294 views

Google Authenticator - generate new set of emergency codes

I use Google Authenticator on my SSH servers with Andoid app for generating codes. After I run $ google-authenticator application create set of emergyncy keys: ...
1
vote
2answers
1k views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
4
votes
3answers
1k views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
-3
votes
2answers
36 views

Modifiying a server securely [on hold]

I wanted to purchase a dedicated server to host my site. I am a newcomer to this and wanted to know if I hired someone to secure the server and SSH for me, will that put me at risk? Or is there an ...
8
votes
2answers
63 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
10
votes
7answers
4k views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
-7
votes
2answers
49 views

How to secure server when the root password is changed [closed]

I have a server now and I do a web application for my customer, I have the server credentials, what if my customer changes the server credentials after I have completed the application, I don't get ...
0
votes
1answer
22 views

Webmin - Disallow access by IP [closed]

I have installed a Webmin instance. I can access by both domain:port and ip:port. Is there any way to restrict access to an specific domain name and disallow direct access by IP?
0
votes
1answer
20 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
0
votes
1answer
31 views

How to save output from grub-md5-crypt to a file ?

I am using Cent OS 6.5 and I want to save the generated output and md5 hash from grub-md5-crypt command to a file. The grub-md5-crypt command asks us to set a password. I want the password(which I ...
-3
votes
0answers
46 views

Linux based security for companies - how much do you do? [closed]

So if your company is mostly Unix/Linux based on the server side (but mostly Windows on the client side), how do you go about securing the network and all workstations? I assume that you have a ...
-1
votes
1answer
14 views

winserver2012 “closed access” permissions to folder

I have some sensitive files, that should be accessed only by a small group of users. Currently the files are stored in a folder, on a WinServer 2012 machine, and will be accessed via a mapped location ...
1
vote
0answers
12 views

Weird `lastb` output

Recently I got weird output from lastb on my VPS: root ssh:notty 122.10.102.42 Thu Aug 27 11:19 - 11:19 (00:00) root ssh:notty 122.10.102.42 Thu Aug 27 11:18 - 11:18 (00:00) ...
3
votes
2answers
32 views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
-1
votes
0answers
14 views

CVE RSS security vulnerability feed/alerts for specific software? [closed]

I've found myself responsible for maintaining PCI compliance on our servers. I get reports from our scans and then react based on the information in the scans by applying patches or updating ...
2
votes
3answers
591 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
29
votes
5answers
15k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...
0
votes
1answer
2k views

Event 4625 Audit Failure NULL SID failed network logons

In 3 separate systems, the following event is being logged many times (between 30 to 4,000 times a day depending on the system) on the domain controller server: An account failed to log on. Subject: ...
0
votes
1answer
18 views

DNS queries are high for non existent records. can safely do a 0.0.0.0 wildcard record?

I have a domain and i am use dnsmadeasy for the DNS. I have noticed the queries are up in the millions each month for records i don't even have. So is it okay to do a wildcard A record such as ...
-1
votes
2answers
18 views

okay to allow any outgoing port for sending mail

I have a small app on my centos6.6 server i am running that allows the user to send an email on a custom port and I am allowing any port to be used. Is there any security risk for allowing this app to ...
8
votes
3answers
3k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
0
votes
0answers
13 views

Teamviewer webclient does not use https [migrated]

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
0
votes
0answers
41 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
-1
votes
2answers
768 views

Disable support for LOW encryption ciphers for glassfish port no 3920

Qualis team found a vulnerability with our glassfish with port no 3920 . glassfish version :- glassfish-3.1.2.2 Port no :- 3920,3820 Below are the details from Qualis Messages ...
2
votes
1answer
25 views

Group Policy settings for account policies disappeared

Looking for any ideas, we discovered that our group policies (default policy) was no longer applying our account policies (password age/complexity/history etc). Our DCs still had the local policy ...
-1
votes
1answer
29 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
0
votes
0answers
16 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
3answers
301 views

Managing Linux users remotely

In a Linux network, is it possible to manage permissions from a central location? If I have an LDAP server where users can authenticate, can I manage permissions from there? I'm talking about ...
0
votes
1answer
44 views

How to access AD directory user which has no read permission

While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible". I've done the ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
-2
votes
3answers
64 views

Is there a GUI tool to log and view outgoing CURL requests from a Linux server? [duplicate]

I've seen several similar questions - but none that truly answer the question. So here goes: PROBLEM: A script is being run on one of our servers that is making outgoing post (and other) requests ...
1
vote
3answers
71 views

SSH and security guidelines

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines. One of these guidelines suggests to disable root user and create a new user that works as an administrator using ...
1
vote
1answer
38 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
0
votes
1answer
19 views

Ubuntu production server access configuration recovery options

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server The configuration of SSH is as follows: # ...
0
votes
1answer
46 views

Linux DMZ in a Windows Network

I'm a wet-behind-the-ears reluctant sysadmin, so I'm playing catch-up here. I've come across the term DMZ before, but I never looked into it until just recently. In fact I'm still not sure exactly ...
0
votes
1answer
45 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
2
votes
1answer
41 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...