Security is not a product, but a process.

learn more… | top users | synonyms (1)

11
votes
6answers
5k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
0
votes
3answers
23 views

Possible attack on the ssh server

could be anybody so nice explain me. On my linux server in log auth.log, i've found next line: Jul 27 09:16:30 aws-ftp sshd[13186]: Bad protocol version identification 'telnet mail.softlution.com ...
3
votes
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
0
votes
3answers
90 views

Kali Linux Running in AWS

Normally I run Kali in a virtualbox VM however due to the nature of a project it may be useful to run Kali from an AWS EC2 instance. So imagine my joy when I learned there was a Kali AMI only to be ...
7
votes
1answer
18k views

Why are there no local users and groups on Windows 2K3/2K8 domain controllers?

MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller. The ...
0
votes
1answer
2k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
-2
votes
0answers
21 views

VPS server hosting multiple sites each in a sandbox? [on hold]

I've been running a VPS for quite some time now, and I've always wondered after surviving a hacking attempt at how to have 1 VPS, run multiple sites each in it's own sandbox, so that if one site (...
-1
votes
0answers
16 views

Finding location of data centers [on hold]

I have a list of applications for which i need to find their actual data center location, we can check it manually through checkhost.net but I want to check after load blancer from where the actual ...
0
votes
0answers
27 views

Unknown ssh connections found in lsof -i has my server been compromised?

I have a Digital Ocean droplet running Ubuntu 14.04. I use it for running quick node.js tests on a publicly available server. I just logged in via SSH and did $ lsof -i to see what ports I was using. ...
2
votes
2answers
3k views

How to set up TLS on hMailServer?

Complete noob here. Please be gentle :) I have a Windows 2008 server, running hMailServer. Right now all my communication is unencrypted. I want to start using TLS. So now I've got myself a SSL ...
3
votes
1answer
2k views

Where I can find ModSecurity Rules for Specific Applications

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
0
votes
2answers
20 views

Safe to secure mysql server with private networking?

I can't figure this out, so hopefully somebody can explain to me why and what's most secure: I'm hosting a Magento webshop on a VPS at DigitalOcean, but to make things more secure I thought it would ...
3
votes
1answer
109 views

Is it safe to store shell scripts into /var/www?

I have my apache host under /var/www/html and I put few small git deploy scripts into /var/www directory for simplicity. Is www a public folder? Is it safe to store scripts in there? If so, are there ...
25
votes
8answers
12k views

How do I responsibly dispose of backup tapes?

Our old tape drives have failed and we not using tapes for backup anymore. We still have a stack of DLT tapes with backups which may contain sensitive information like credit card numbers, social ...
1
vote
1answer
2k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ==...
0
votes
0answers
6 views

Is a root kit not an exploit? [migrated]

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that root kits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
-1
votes
0answers
12 views

Do UDP process in netstat-ano command means being hacked? [on hold]

If yes how to stop them permanently.. I am getting these pid's for svchost.exe process whwn i check in task manager Checking for pid(process id ) again and again is not good
0
votes
0answers
14 views

AWS security group change

I modified the security group for two VMs on AWS (from one security group to another - not just editing the security rules of an existing group). The VM's are behind Amazon ELB (and using Route 53). ...
1
vote
3answers
650 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
0
votes
0answers
17 views

Secure Storage Requirements in the Cloud [closed]

I'm trying to understand some low-level security requirements for a cloud based secure storage solution. Specifically, I'm interested in the following: What mode of encryption (and integrity ...
21
votes
2answers
31k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
0
votes
1answer
16 views

Printer installed on terminal server 2012 only works with group “everybody”

I'm trying to restrain access to printers on my terminal server. The printers are installed directly on the server because we're using thin clients to connect, so people don't have a local default ...
9
votes
6answers
6k views

Send email when anyone logs on

My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch. I've installed tripwire, but I'd also like to be emailed when anyone logs in. I ...
0
votes
1answer
27 views

Subdomain for every customer or one domain for everyone?

I want to offer an application to customers. I see that many applications on the internet have subdomain created for every client when he is creating an account. Is this good practice in terms of ...
2
votes
0answers
40 views

Privacy concerns with windows 10 Pro

I don't need any of the Windows 10 enterprise features but enterprise is the only one that (legitimately) allows me to turn off the CEIP (Customer Experience Improvement Program); this is the ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
4
votes
2answers
3k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
0
votes
1answer
27 views

Is there some project/tool for testing web server firewall quality? [closed]

Would like to have a test with different aspects of firewalls. For instance, a test that would output info on: Layer 3/4 attacks DNS amplification attacks SMURF attacks ACK attacks Layer 7 attacks ...
2
votes
1answer
1k views

Securing an Apache Setup with a Fresh Ubuntu Web Server with users and permissions

I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to ...
0
votes
0answers
12 views

Configuring nginx + Laravel to not execute any other PHP files

I have a Laravel application hosted on nginx, using a fairly standard php-fpm configuration. There should be no need to execute any other PHP files on the server, except for one specific script that ...
0
votes
2answers
514 views

How to prevent password expiration in apache Archiva

I am running a standalone Archiva 2.2.0 installation. I added security.properties file to ~\conf directory. In security.properties I defined: security.policy.password.expiration.days=999999 ...
3
votes
3answers
329 views

Suspicious password login in sshd log

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey. Today when I check the log file, ...
-2
votes
1answer
48 views

TLS auth issue: 'CompanyA@exmple.com “via” SendGrid.me' email is dropped by Exchange [closed]

Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender ...
3
votes
2answers
1k views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
0
votes
1answer
141 views

Jenkins 2.x disable initial admin setup

we're using Jenkins as a cron server adding/starting crons via api. We created a vagrant box installing the jenkins. Since version 2.0 jenkins require to create an admin account (link) before disable ...
17
votes
3answers
5k views

Automatically Applying Security Updates for AWS Elastic Beanstalk

I've been a fan of Heroku since it's earliest days. But I like the fact that AWS Elastic Beanstalk gives you more control over the characteristics of the instances. One thing I love about Heroku is ...
0
votes
1answer
34 views

Jenkins login using GitHub Authentication failed being administrator

I was setting up authentication mechanism for our organization jenkins, which had no security mechanism, "ananoumos" can do anything, delete jobs,build etc. I did Install github-oauth jenkins plugin ...
2
votes
0answers
17 views

Enforcing audit settings for all subfolders and files on NTFS

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS ...
3
votes
1answer
1k views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1 [closed]

mod_security with custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR "^10\.10\.10\.10" phase:1,nolog,allow,ctl:ruleEngine=Off,id:104008 ...
3
votes
4answers
3k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
-1
votes
2answers
43 views

Connect to AWS EC2 SSH for public location best practice

I have recently been learning about how to set up and run a Linux server on Amazon and I have been wondering about the best practice for SSH into it from a public place. By public place I mean like a ...
0
votes
1answer
83 views

Is there some way a user with an asterisk as password in /etc/shadow but a correct login shell in /etc/passwd would be able to login via SSH?

Let's assume the following. We have a server which is accessible via SSH. There is an user in /etc/passwd who has a valid login shell (so for example /bin/bash, instead of an invalid one like /bin/...
0
votes
1answer
31 views

Getting a safe access to a computational server [closed]

Disclaimer: I'm not a sysadmin, so I might say stupid things / rely on incorrect assumptions. Feel free to correct me. I work in a startup and some time ago we bought a server for internal use for a ...
1
vote
2answers
255 views

Setting up IIS 8.5 - Security practices

This is the first time I'm setting up an IIS installation and i want to make sure to provide maximum security. Some questions were popping into my mind while setting up: Note that this server hosts ...
0
votes
1answer
94 views

Authentication Configuration with IIS 8.5 on Windows Server 2012

I have a site hosted using IIS on a Windows Server 2012 R2 server. The application is configured to use an application pool that uses the NetworkService account as the application pool identity. The ...
0
votes
1answer
35 views

LAMP/Apache2: How to set webhook API PHP file as public but outside of project root directory?

I have an AWS EC2 LAMP server (using Apache 2.0 and mod_php5) with a basic directory structure like this: var |-- www | `-- api_folder (NOT public) | | |-- sensitive files (NOT ...
30
votes
7answers
8k views

Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)

I have a question about our Exchange Server: Do you think it is a good idea to refuse incoming external e-mails that have our own domain in the ending? Like external eMail from fake@example.com? ...
0
votes
1answer
31 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
1
vote
1answer
90 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN msg=audit(...
5
votes
3answers
3k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...