Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
5 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
12 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN ...
15
votes
9answers
7k views

How can I increase ssh security? Can I require both a key and password?

I have a small network of servers and I would like to increase the general security. I don't have enough time/money/paranoia to set up a VPN -- what's a basic way I can increase the security of my ...
1
vote
1answer
86 views

How to verify installation of ImageMagick is not vulnerable to CVE-2016-3714

CVE-2016-3714 was announced on May 3, 2016. This vulnerability unfortunately goes by the name, ImageTragick and has received some press (for example, this ArsTechnica article). Until updated ...
1
vote
0answers
21 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...
0
votes
1answer
3k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
0
votes
0answers
13 views

Jenkins 2.x disable initial admin setup

we're using Jenkins as a cron server adding/starting crons via api. We created a vagrant box installing the jenkins. Since version 2.0 jenkins require to create an admin account (link) before disable ...
1
vote
1answer
1k views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
5
votes
3answers
2k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
0
votes
0answers
12 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
0
votes
0answers
5 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
1
vote
1answer
36 views
+50

Secure Email Settings for Email Clients & for PHPMailer

I'm trying to work out how to make my outgoing/incoming email's as secure as I can possibly make them. First of all, my domain has Wildcard OV SSL Certificates, I have copies of the .csr, .crt and ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
0answers
16 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
-3
votes
0answers
29 views

I was hacked? Random files on Windows 2012 are disappeared [on hold]

recently I met total disaster on my Windows Server 2012. It's turned out that some important files and folders are just disappeared. It seems that these files are not required while system is running ...
1
vote
1answer
8k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
0
votes
1answer
129 views

PSAD does not start on Ubuntu 14.04

I complied PSAD from source, compilation went smoothly however when I run this command: sudo psad --sig-update I got this: Can't load ...
-1
votes
1answer
15 views

Setting up an ssh authentication server

I have some 30 Media Temple grid servers and I need to manage the access of 15 or so developers to those servers. Is it possible, and more importantly secure, to setup a server who's only job is to ...
2
votes
1answer
36 views

How to secure configuration management server

There are many configuration management software options nowadays (Chef, Puppet, CFEngine, Ansible...) which offer an architecture with their repository on a central server and clients communicating ...
2
votes
3answers
158 views

AWS Security Groups vs Windows Firewall

Is it considered best practice to disable the Windows Firewall on an Amazon EC2 instance, and control traffic only via EC2 Security Groups? If I open a port on the server firewall, and then open the ...
1
vote
1answer
1k views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
0
votes
0answers
27 views

Company Discover A Ghost IP With All Ports Opened [closed]

Good day, recently when we do a screen through at our internal network. We discover a Ghost IP with all the ports open FTP SSH etc.. and the last one is VNC. My questions is , does it mean our ...
1
vote
1answer
1k views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
4
votes
2answers
4k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
14
votes
6answers
21k views

Securing a SuperMicro IPMI BMC

I've recently acquired a SuperMicro X8DTU-F motherboard, which has a built-in BMC, which basically runs the IPMI system. It turns out to be a small Linux system running on an ARM processor. ...
-1
votes
0answers
11 views

Download files from server securly from mobile app [closed]

I am creating a mobile app that need to download some files from a server (AWS S3 or similar). I would like to use a REST API for downloading and authentication. I have read a lot about ...
-1
votes
1answer
16 views

Allow run /sbin/ifconfig to user

So, I want to allow some user to execute ifconfig. I'd created a special group "if" and done user to own this group. And now I'm going to do "chown root:if ifconfig". But I think: What wrong thing ...
0
votes
0answers
24 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
2
votes
0answers
34 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
2
votes
2answers
25 views

How much protection is provided for my remote centos vps by using certificate-only root login

I have two leased centos servers, one to run mysql for backends to the web and mail server on the other, as well as data from my android apps. I am only planning to give access to the data server if ...
1
vote
0answers
31 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
0
votes
2answers
2k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
0
votes
1answer
37 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
19
votes
9answers
11k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
0
votes
0answers
21 views

WordPress site with no traffic; MySQL reporting 300-500 queries per second, frequently crashing

My server is running Debian 7.10 (Apache 2.2.22, MySQL 5.5.47, PHP5). It's a VPS. I've tried to summarise the issue in the title. I'm running a very small, private WordPress blog which is only ...
2
votes
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
2
votes
1answer
42 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
2answers
25 views

Is it necessary to secure TCP traffic for PHP FPM over shared private VPS network?

There are lots of recommended practices and tutorials for securing various components of a LEMP/LAMP stack when running in a cluster whose private network traffic is shared by other, potentially ...
6
votes
5answers
17k views

nmap on my webserver shows TCP ports 554 and 7070 open

I have a webserver that hosts various websites for me. The two services that are accessible outside are SSH and Apache2. These are running on a non-standard and standard port, respectively. All other ...
1
vote
1answer
1k views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
2
votes
0answers
15 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
1
vote
3answers
198 views

Knockd daemon fails to start

I was trying to setup knockd, a port knocking daemon available to Ubuntu distros. Before setting up my port knocking sequences, I decided to give a shot to the default knocking sequence, since it ...
4
votes
6answers
64k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
2
votes
3answers
70 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
2answers
119 views

Configure same Internet Explorer zone mappings with and without ESC via GPO

Our Active Directory domain consisting of Windows Server 2012 R2 servers and Windows 7 workstations configures Internet Explorer security zones using this Group Policy setting: Computer ...
64
votes
5answers
58k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
2
votes
0answers
26 views

Protect cached content in apache

I'm facing an issue where I have some cached contents in a disk and I want to protect it with a token url. I can protect my files via htaccess, once they are not cached (direct access), but now I ...
1
vote
1answer
56 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
2
votes
0answers
29 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...