Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
2answers
4k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
7 views

Securing Mail From Admins - Office 365

I'm trying to determine the best solution that allows me to assure our CEO that his Office 365 mailbox cannot be read by anyone, including myself, an admin. Obviously the mailbox is already locked ...
0
votes
1answer
10 views

AWS EC2: Secure configuration via IP access list

My company have a network with a fixed IP address/IP address range. Is it save when I configure my Security group that all traffic from this IP address will be accepted and everything else will be ...
0
votes
0answers
10 views

MYSQL error: IP address could not be resolved

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there ...
0
votes
1answer
19 views

How to make git forget my credentials

I am using GIT in windows. The repository stores my credentials and uses it for manipulating remote directory. For security reasons, I want to manually enter my credentials every time I do ...
0
votes
0answers
19 views

avoid data leak by block internet access for PCs, but allow internet access through remote desktop

In a small network(in my company), I would like to block some computers(PCs) to access the internet, so that sensitive data or files in those PCs can not be leaked. But I still need users of the PCs ...
-4
votes
2answers
43 views

Does it make sense to have a server dedicated to login? [on hold]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
0
votes
1answer
211 views

TACACS+ configuration: how to receive priv-lvl value?

I need to configure TACACS+ server to know if the given user is authenticated* and what is his priv-lvl. As a client I'm using tactest (tacacs.net) and TACACS+ Client Java Library (AXL). I tried with ...
3
votes
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
3
votes
2answers
31 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
6
votes
5answers
9k views

SSH access problem: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

We have a server XXX ON Amazon EC2. SSH is running on a standard (22) port. I placed my pubkey at the /.ssh/authorized_keys file The fun thing is that YESTERDAY it was working great! But today, I ...
0
votes
0answers
25 views

Web server got compromised (What to do next?) [duplicate]

My webserver got compromised (I think). The last 3 days inbound traffic spiked up to abnormal levels, in 3 days +/- 2.5TB of bandwith got used. when reading my access logs I see thousands of requests ...
0
votes
0answers
260 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false configs....
0
votes
0answers
17 views

FTP server secured by denying write permission to chrooted home directory (virtual users) [on hold]

I have a Pure-Ftpd server configured in a way that users have no write access to their ftp root directory. Instead user can write only to subdirectory created within its home dir (this subdir is ...
8
votes
3answers
808 views

Password similarity

I wanted to change my password on a unix machine. I did a normal "passwd" and typed in my old and my new password. Then the machine came back to me with the following message: BAD PASSWORD: is too ...
0
votes
3answers
63 views

Are there any disadvantages of blocking port 80 for security reasons?

To improve security, we would like to make https access to all customer sites that we host mandantory, and guarantee this in our terms and conditions. The problem is that currently the Apache ...
1
vote
3answers
1k views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
-1
votes
1answer
21 views

Updating Ubuntu Webserver

Our webserver is on AWS running on Ubuntu 14.04.3 LTS. When I ssh into the server I see this message. 196 packages can be updated. 123 updates are security updates. Should I update our ...
0
votes
0answers
14 views

FTP file upload positive or negative file extension list

I'm setting up an FTP on IIS and I want user's to not be able to upload possible dangerous files based on file extensions. Now I'm uncertain if I should create a positive list to allow or negative ...
-1
votes
0answers
6 views

How safe are proxies if your IP could be cross-referenced? [migrated]

Let's say you're the NSA. And let's say you have "backdoor" access (for the sake of this discussion we'll assume that includes at a minimum the mapping of an IP address to a logged-in user) to Google. ...
0
votes
0answers
15 views

Tracking filesystem changes in runtime

I need to have program that tracks changes made to the file e.g. when I am installing software from supplied installer instead of packages. I do not want to checksum every file in filesystem because ...
-4
votes
0answers
26 views

Circumventing web restrictions [closed]

One of my network users is trying to circumvent web access restrictions to access Google Talk service. I have enough evidence including key strikes and passwords to talk to the user in but I'm still ...
1
vote
1answer
29 views

Security of SSL certs on AWS ELBs / SSL offloading

I have some concerns about security and am wondering how AWS will store an SSL certificate deployed to an ELB. I have a wildcard SSL cert for my domain that I want to make sure doesn't persist ...
0
votes
0answers
16 views

Arch Linux install without root password

Is it possible to install (and later maintain) Arch Linux (or some of its derivatives) without ever setting root password - using only user account and sudo? The same way it's done in Ubuntu and many ...
0
votes
1answer
49 views

Kali Linux Running in AWS

Normally I run Kali in a virtualbox VM however due to the nature of a project it may be useful to run Kali from an AWS EC2 instance. So imagine my joy when I learned there was a Kali AMI only to be ...
-1
votes
0answers
29 views

Security and chaining firewall, very specific scenario [closed]

I'm in a very specific scenario where i need to secure as much as possible a single server in a Datacenter connected only to the internet (no company network, just a lone Windows Server computer alone ...
1
vote
1answer
81 views

Every website on the server redirects to a foreign page, even after clean install

First of all, this is my first time posting here, so sorry if I posted in the wrong section. To get to the point: I have a CentOS 7 + Gnome server, with VestaCP configured and running 2 WordPress ...
0
votes
1answer
22 views

How make Docker auto-survive kernel upgrades and restart?

Brief question: Docker, Ubuntu 16.04, auto-security-upgrades & reboot. Then how can I ensure the newest linux-image-extra-`uname -r` has been installed before Docker attempts to start the ...
1
vote
3answers
103 views

How to simulate a WORM environment w/Active Directory/NTFS

In NTFS/Active Directory, assume I have two drives mapped: H:\ I:\ Users can edit files in H:\, but not in I:\ . I want users to be able to, using a script, move their files to the I:\ drive unless ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
0
votes
0answers
7 views

Is mod_evasive on ajax application a good idea, or will it block on false negatives?

I have a web application that injects content into the users page dynamically via ajax at the click of a button. A user may click the button multiple time in quick succession. In increasing the ...
0
votes
1answer
22 views

Integrating Web Application Firewall into this architecture

I need some help figuring out how to implement a Web Application Firewall (WAF) in my existing architecture. Currently I have 2 HAproxy servers clustered using keepalived which are responsible for ...
4
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
1
vote
1answer
2k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ==...
0
votes
1answer
35 views

Shared hosting server sites showing up suspicious results on google [closed]

I seem to have found loads of hacked websites on a shared hosting server, or at least something really strange must have happened. The server company refuses to admit there is anything wrong, so I ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
1
vote
1answer
44 views

How to install secrets safely on EC2 instances?

Context: Setting up an infra with some Auto-scaling groups and some non-scaling self-standing VMs. Some roles need secrets (private keys) which should be restricted to root or to specific users. ...
10
votes
3answers
4k views

Is it possible to have a 100% secure virtual private server?

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS. Obviously there are some things that you could do to ...
0
votes
1answer
23 views

Windows 2008 server SMB security

My understanding is that if I use .net System.IO namespace to write files to a remote file share it eventually uses kernel32.dll and SMB protocol is used behind the scene. Let's say both source and ...
2
votes
6answers
608 views

My site hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I just discovered that my site has, I believe, been hacked. Along with a couple of other sites on my host. If you go to the bottom of ...
-1
votes
0answers
34 views

OpenVPN gateways configuration with non-routable addresses

I have to configure OpenVPN gateways with cryptographically protected tunnel connecting two non-routable subnet addresses. Mutual authentication gates on the basis of certificates. I used this ...
8
votes
5answers
430 views

Is setting a very strong password enough to secure an SSH on port 22?

Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols ...
0
votes
1answer
183 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
0
votes
2answers
37 views

Find out exactly what (which php script) is trying to send spam from server

Last night my server was compromised (I guess - one of outdated PHP CMS's) and many spam messages were sent. I have restricted access to Postfix (via authorized_submit_users directive in main.cf) ...
-2
votes
1answer
44 views

Blocking IP Addresses dynamically without any software [duplicate]

I'm no expert in reading logs, so I posted some of my log today at another forum answered: DDOS Attack. This is what I've done so far: copied all sys logs, kern log , ufw log & auth log in one ...
1
vote
2answers
46 views

Block SSH hop based on traffic origin?

Is there a way to find where the SSH traffic origins from? We have two servers A and B. A is on a private network. B has 2 nics, private and public. A can SSH into B and B can SSH into A problem is, ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
0answers
56 views

Restricting NetBIOS Access

There is a Windows Server in the domain. It has folders NetBIOS shares for users to access. It also plays the role of Remote Desktop via RDP. How can I keep all of these services advertised but ...
0
votes
0answers
20 views

A domain controller in Azure ends up public on the Internet with no firewall - is it compromised? [duplicate]

I'm helping a customer stand up an Azure environment and they decided to stand up a server (DC) on their own without asking for help. The only access method is supposed to be IPsec, but they forgot ...