Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
3 views

snort fails to run in IDS mode

I installed snort-2.9.7 from sources, and try to run it: % snort -dev -h 10.10.10.0/24 -l /var/log/snort/ -c /etc/snort/snort.conf ... "afpacket DAQ configured to inline. ERROR: Can't initialize DAQ ...
4
votes
1answer
2k views

Does www-data user need a real shell?

Interestingly enough, on my Ubuntu derivative with nginx installed with apt, the www-data user has a shell: $ cat /etc/passwd www-data:x:33:33:www-data:/var/www:/bin/sh Shouldn't this be set to ...
0
votes
2answers
23 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
3
votes
2answers
66 views
+50

Fixing the IIS tilde vulnerability

One of our IIS servers (IIS 7.5, Server 2008 R2) is apparently "vulnerable" to the tilde Short Filename disclosure issue. However, I'm having a hard time actually fixing the issue. So far, I've ...
0
votes
0answers
15 views

how do I set restrict anonymous to 2

I want to change the registry setting for restrictanonymous to "2" (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous). I created a script to do this but noticed the setting kept on going ...
-1
votes
1answer
103 views

Misuse of the statistics script of Plesk? [on hold]

I downloaded the log file from the web server, and found many strange entries. Why is a statistics script called so terribly often? What do all the junk referrers do there? Looks like some ...
-1
votes
1answer
1k views

How to block incoming login attempts to postfix, pop3, imap? [on hold]

We are running CentOS 6.5 with Plesk and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or ...
-1
votes
2answers
440 views

Techniques for securing mod_php for shared hosting (WAMP)? [duplicate]

I've setup a web server for production use. The OS is Windows Server, and it runs Apache 2.0 and PHP 5.3 as an apache module (and MySQL too...). It is used to host several virtual hosts (Apache ...
0
votes
1answer
33 views

Apache 2.4 Restrict url to all except certain IP address in ubuntu 14.04

I know there are several Questions similar to this but none of them worked for me, Here im trying to block "example.com/phpmyadmin" to all except my public ip "a.b.c.d" and "x.x.x.x" . i have used ...
0
votes
1answer
18 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
0
votes
0answers
46 views

Disable Keyboard on Ubuntu Kiosk Touch PC

I'm in the middle of deploying a series of Kiosk PC's with a minimal Ubuntu server and a web enabled Application(Rails) on it. The hardware are Shuttle All-in-one PC's at the moment. The PC starts ...
1
vote
2answers
37 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...
0
votes
1answer
157 views

Security Risks of catch-all email address [closed]

What additional security issues does an MTA and email client face if a catch-all email address is setup on an sub-domain (that isn't published/publicly listed anywhere) compared with setting up ...
8
votes
3answers
562 views

What are some best practices when taking over IT at a new company? [on hold]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
0
votes
4answers
396 views

Permissions set to 555. How can another user modify the files? [duplicate]

I run an Ubuntu 12.04 x64 VPS with Vesta, and a site in PHP. It has been hacked several times with injected code that looks like this: <?php ...
0
votes
0answers
19 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
1
vote
2answers
66 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
10
votes
6answers
3k views

How do I effectively destroy a SSD? [duplicate]

What is a repeatable way of destroying SSDs? For example, if i opened it which part could i take out and destroy for just the data(How to identify the actual "storage unit")? Case 1. Normal user that ...
2
votes
0answers
119 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
562 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
0
votes
1answer
33 views

Tools for scanning database for viruses [on hold]

I wonder if anyone knows some useful tool for scanning threats like sqlinjection, command injection in mysql databases? The db is for multiple wordpress, drupal installations. The first step obviously ...
0
votes
1answer
68 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
4
votes
2answers
677 views

Can't disable Enhanced Security Configuration after upgrading to IE9

I disabled ESC in Server Manager on 2008 R2, originally just for Administrators but have tried to disable it for users and Administrators to try and solve this problem. Despite it being completely ...
1
vote
1answer
67 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
-4
votes
4answers
77 views

Blocking another Win 2008 R2 admin from accesing some important folders [on hold]

I have sold half my dedicated server to somebody but I dont want them accessing my web hosted Plesk files for my Wordpress website. As some of them are custom and confidential. I gave them local ...
1
vote
1answer
51 views

.htaccess query string blocking phpmyadmin [closed]

After phpmyadmin login, I get this error message Error in Processing Request Error: 403 Error text: Forbidden" I found that removing the following lines from .htaccess it doesn't give any error ...
1
vote
1answer
724 views

net.inet.tcp.blackhole option on Fedora

This link of freebsdblog.org suggests a configuration option for FreeBSD that tells the system to drop all packages arriving from the network to a closed port and thus somewhat securing your system ...
0
votes
1answer
150 views

Getting lots of traffic from russia to an unpublished site

I am currently building a website. Currently nobody knows about it but it is already reachable for testing purposes. Now I saw, that I get a lot of traffic from russia (Its a german website hosted on ...
2
votes
1answer
20 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
0
votes
1answer
19 views

How to I assign OWNER RIGHTS permissions to a file in Windows 7?

When I run ICACLS on a file, it returned: foobar.LDF OWNER RIGHTS:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) What securityid do I pass to icacls to assign to the generic user ...
0
votes
0answers
10 views

give serverprincipalname read write permissions to security group members

What are the settings for the group to make the following change? I need to create a group that can be used to grant: serviceprincipalname SELF Read serviceprincipalname SELF Write to its members. ...
2
votes
1answer
40 views

Use VPS provider's kernel or maintain my own?

I've got a Debian Wheezy VM on Linode and they run it with their own kernel. As a reputable company, I'm sure they're quick to apply security patches, and all I need to do is reboot to get the new ...
2
votes
2answers
981 views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
3
votes
4answers
5k views

SSH access problem: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

We have a server XXX ON Amazon EC2. SSH is running on a standard (22) port. I placed my pubkey at the /.ssh/authorized_keys file The fun thing is that YESTERDAY it was working great! But today, I ...
1
vote
2answers
882 views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
0
votes
0answers
4 views

smb.conf - where do I set key and certificate for 'smb encrypt' transport encryption?

Reading smb.conf man page I can enforce encrypted smb transport; smb encrypt = mandatory. Where do I set the keys to use for the encrypted transport? I was expecting something like apache2: ...
0
votes
1answer
25 views

I guess that my mail server is unprotected and spammers are using my mail server to spam myself [duplicate]

Since I switch to my own mail server (I folowed this two tutorials: https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-mysql and ...
4
votes
4answers
74k views

Windows Security (In windows 7) keeps asking for my credentials, and won't “Remember my credentials”

I'm not the network admin, but my network admin is having trouble solving this as well. My issue is exactly as the title says... Windows Security (In windows 7) keeps asking for my credentials, and ...
1
vote
2answers
143 views

What hotfixes should be applied to a ColdFusion 8 Server

I've recently inherited a server running ColdFusion 8 and believe it may not have been patched for security updates (as per http://www.adobe.com/support/security/#coldfusion) for quite some time. The ...
2
votes
1answer
140 views

What should I do if an necessary client application has to run on an older (vulnerable) framework?

A client needs to have .NET Framework 4 installed and not patched so their software running on their Windows 2008 R2 Server functions properly. This sparks the questions: When is it okay to ...
35
votes
12answers
8k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
-1
votes
0answers
11 views

apt repository signature and key verification

Is there a way to verify the integrity and authenticity of apt-get packages i.e. 1- How can I be sure that its not man-in-middle 2- is there a way to enable public key/cert verification in apt, to ...
0
votes
0answers
19 views

Is it possible to break out of a “trap 1 2 3” secured terminal session by using SIGSEGV?

The title says it mostly. I'm auditing the security of a terminal-based application on AIX, and the way you use it is to connect to it remotely through telnet, where the ".profile" of the telnet user ...
-5
votes
0answers
22 views

Server Approach to pitch to Management? [closed]

So, as a client who got hacked, I looked at myself and said "self", what did I do wrong? Your corp "help" desk is flooded with "doh" attitude every second of every day. Yet, it occurs to me, if Your ...
0
votes
1answer
22 views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
1
vote
0answers
19 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
5answers
106 views

How to get an early warning to someone logging into a server

I like to be notified when someone is logged into one of my Linux servers, and also be able to find out what the location of the login attempt. How can I do this?
5
votes
2answers
3k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
2
votes
2answers
904 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
0
votes
1answer
9 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...