Security is not a product, but a process.
0
votes
1answer
21 views
curl fails to take self signed certificate
I've installed apache 2 server with self signed certificate.My browser is showing 'It works!' when I tried to connect to the sever. But from an application when I issued cur_easy_perform() the call ...
0
votes
1answer
36 views
Security of NameVirtualHost in regard to HTTP request forgery
If I understand the concept of NameVirtualHost correctly it works by reading the Host variable of every HTTP request and matching it to a ServerName in any active VirtualHost directive with the ...
0
votes
1answer
16 views
How can I configure a Ubuntu LAMP web server with permissions like CPanel?
I know how to set up a LAMP stack on Ubuntu pretty well for a single website / single user, but I'd like to allow multiple users to host multiple sites on a single server.
This is for different ...
0
votes
1answer
14 views
What are the security implications of STARTING a reverse proxied origin server as an unprivileged user?
A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. ...
0
votes
0answers
9 views
Setup cherokee as a shared hosting platform
I would like to use cherokee webserver to host multiple websites NOT on one account, simular to cPanel(I don't need or want all cPanel has to offer and as far as I know still can't use Cherokee) . In ...
0
votes
2answers
20 views
apache: restricting access by network
Im working on a (linux based) device that has 4 network interfaces: two wired, one wireless and a VPN. The device has a web 'control panel' of sorts that I want to restrict access to. Ideally it ...
0
votes
1answer
24 views
Ubuntu Server DDoS protection
I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
-1
votes
1answer
17 views
How to disable SSL/TLS compression in Apache 2.2.16?
I have one sever running on Apache 2.2.16. I run the VA scanner on the server. According to the VA report it is recommended that SSL/TLS compression should be off.
I tried to search google, but didnt ...
4
votes
7answers
201 views
+50
Configure a “hardened” user account that an attacker would have a hard time abusing
Suppose you have a Windows Server machine running various sensitive services. Suppose that one of these services is pretty simple, maintaining a small amount of information in a text file, but as a ...
0
votes
1answer
937 views
Use SECEDIT to export “Security Options” from one computer and import on another
Can I use secedit.exe to export out the "Security Options" from the local security policy and then import them on another machine?
I'm trying to do this on Windows Server 2008.
Update
I just tried ...
-1
votes
1answer
20 views
SSL secured account section, Subdirectory vs Subdomain [closed]
I'm currently running Drupal on an nginx server, and I also have a separate user account system running on account.domain.com. I purchased a wildcard SSL certificate to protect the login form, but the ...
1
vote
1answer
40 views
Given an Amazon Web Service Security Group, how can I find out what the IP's are?
I'm looking at using a cloud service which has an AWS Security group...
I've got a hardware firewall and a software firewall.
I have no idea how to say: Given that security group, allow any ...
7
votes
4answers
6k views
How to create a limited “domain admin” that does not have access to domain controllers?
I'm looking to create an account similar to a Domain Admin, but without access to domain controllers. In other words, this account will have full Administrator rights to any client machine in the ...
-1
votes
1answer
68 views
how is possible to become root without having the password and only a ssh login?
I am having a problem, I have one server, I have my root account, but some other co worker has an ssh login, still... I have no so much experience and I dont know what I could do to block him to ...
3
votes
1answer
60 views
Traffic backlogged after (D)DoS attack? [closed]
About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down.
I raced over to my server room, where my TP-Link router was completely unresponsive ...
1
vote
1answer
59 views
Limited SSH access for log retrieval
I want to have limited access to a Linux server to be able to grab a certain set of logs. Ideally, I would like to be able to run rsync locally to grab the logs from the server and for security ...
-1
votes
0answers
23 views
motion - usb camera not working on monitoring server [closed]
I had a Debian Squeeze server running, which monitored our building with cameras. I installed a new server now with Debian Wheezy and all except on camera are working. It's a USB camera(Pixart ...
3
votes
1answer
55 views
How can I proactively detect compromised Exchange 2010 accounts?
We have had issues with compromised Exchange accounts sending out malicious e-mails via SMTP and OWA.
It seems that many of these accounts were compromised via incoming phishing attempts. We are ...
1
vote
2answers
2k views
How do I grant a database role execute permissions on a schema? What am I doing wrong?
I am using SQL Server 2008 Express edition.
I have created a Login , User, Role and Schema.
I have mapped the user to the login, and assigned the role to the user.
The schema contains a number of ...
2
votes
0answers
24 views
Remote disk monitoring with WMI without admin rights
I am setting up a restricted WMI group that should be able to read WMI information from my remote hosts.
I have the group set up as member of the remote DCOM and performance monitor groups. I also ...
4
votes
2answers
69 views
Should I delete the .pfx or .cer files after importing the SSL cert?
When provided, I have to import into IIS on Windows Server (2008 R2) using either a .pfx or .cer to get SSL certs ready for use.
My question is, is should I delete these files after I have ...
0
votes
1answer
36 views
How to update/maintain a patched kernel?
If I patch my linux kernel with grsecurity, will I still be able to update my system with yum (or apt-get)?
Won't the updates available via yum be incompatible with my patched "non standard" version ...
16
votes
1answer
327 views
What's the importance of the email address in the DNS SOA lookup?
Is there a real importance in this, except to publish the email address of the person responsible for some DNS zone?
In our BIND configuration, we put a mailling list as the responsible for our ...
0
votes
2answers
1k views
WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine
I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
3answers
2k views
Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause
This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
3answers
28 views
VPS security considerations when only accessing from one IP [duplicate]
I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
47
votes
8answers
45k views
Dealing with HTTP w00tw00t attacks
I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this:
My apache version is apache v2.2.3 and I use mod_security2.c
This were the entries from the ...
1
vote
2answers
43 views
How to configure transport CONFIDENTIAL in Apache HTTPD server?
We had only one VirtualHost in our Apache 2.2 server configuration:
<VirtualHost _default_:443>
Our customers want be able to put in the browser only the server name in HTTP (e.g. 10.10.0.1) ...
0
votes
1answer
16 views
Using authority-given .cer file to login on remote servers on OS X
A few months ago I bought a certificate from a popular certification authority (Certum). I used it to sign emails, but today the admin at my work asked me to connect to our main server via ssh. He ...
2
votes
2answers
68 views
VLAN & Communication
I'm working on a project regarding Network Security and I've come to the topic regarding VLANs.
I was wondering if it is possible to set up multiple VLANs (VLAN0, 10, 20, 30) in a way that all VLANs ...
2
votes
0answers
23 views
Technical security issues with proactively executing a phishing campaign targeting your own users [migrated]
We've had some issues with compromised accounts due to users falling victim to phishing campaigns.
The possibility of us doing a phishing campaign against our own users to proactively shame them has ...
23
votes
4answers
563 views
Will virtualizing a server mean another OS layer to patch and update, more work and greater risk?
I've done a search and have not found anything addressing issues regarding patching and system updates. I've got guidelines that say servers need to have necessary patches. If I have a VM host then ...
0
votes
1answer
18 views
new user and problems with ssh key configuration (pub vs pem files)
We access our ubuntu server from outside over ssh this way :
ssh -i securityTier.pem -l someUsername serverDnsName
I need to create new user which will use separate *.pem file. So far i created :
...
13
votes
3answers
3k views
REJECT vs DROP when using iptables
Is there any reason why I would want to have
iptables -A INPUT -j REJECT
instead of
iptables -A INPUT -j DROP
0
votes
2answers
38 views
-bash: www.mydomain.com.pem: Permission denied
I have these three files in /etc/nginx/ssl folder:
www.mydomain.com.csr
www.mydomain.com.key
www.midomain.com.key.nopass
I bought and downloaded the positive ssl certs in ...
0
votes
1answer
29 views
Linux user permissions setup for monitoring tool
We have external monitoring tool which will access our linux machines through SSH and will read top/ping/netstat/disk activity. As i am creating separated ssh key and separated user for this purpose i ...
0
votes
2answers
22 views
Managing security (Java) access in a shared environment
While developing a shared hosting solution for Java applications we have encountered an issue, since users can upload their own jars how do we restrict them from running Linux commands such as df -h ...
3
votes
3answers
202 views
How do I secure a Dell Idrac card?
I'm trying to completely lock down a server which has to exist outside of a firewall/directly routed to the internet and whilst I have hardened the base OS to the best of my ability, I had a moment of ...
1
vote
1answer
51 views
How to forbid user to bind a socket on other than a certain address?
I want this user not to be allowed to bind ports (effectively creating world-accesible servers, though on ports >1024) on the Internet interface, but be allowed to do in the loopback interface on ...
13
votes
11answers
3k views
Chinese Hacker-Bots attempting to exploit our systems 24/7
Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
5
votes
1answer
961 views
Custom fail2ban Filter for phpMyadmin bruteforce attempts
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log
Custom log
The format of ...
0
votes
1answer
36 views
More server in a net security
I have two ubuntu server into my company:
1) backup server which only backup computer or remote server (IP: 192.168.1.253)
2) real server which contains all data file apache where run our demo project ...
1
vote
0answers
48 views
Someone hacked my system [duplicate]
I have two linux server.
Another company phoned me that my IP try to connect into their server every 8 seconds.
I have a server with a firewall(shorewall) and a server without it.
But now I want to ...
0
votes
1answer
41 views
Are empty HTTP requests malicious?
I have seen multiple empty http request log entries from Apache:
HOST:443 REMOTEIP - - [DATA AND TIME] "-" SIZE SIZE "-" "-"
Are these malicious attacks, or some misconfiguration on my side?
1
vote
0answers
34 views
Restrict users to certain applications only
We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication.
Please let us ...
2
votes
3answers
107 views
Why should I never run software as root, yet it is frequently recommended to give an account root-access to run software? [closed]
I am a long time technical professional but 100% of my work has been within a Windows environment. I have a pretty good level of understanding of many of the technical issues such as user account ...
-1
votes
2answers
472 views
IPTABLES rule for separating users [closed]
I have an OpenWrt 10.03 router [ IP: 192.168.1.1 ], and it has a DHCP server pool: 192.168.1.0/24 - clients are using it through wireless/wired connection. Ok!
Here's the catch: I need to separate ...
1
vote
2answers
1k views
windows 2008 R2 TS printer security - can't take owership
I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server.
If the user opens a cmd ...
0
votes
1answer
36 views
Restrict access to SQL Server backups based on user?
Let's say I have MS SQL Server 2012 Standard installed on Windows Server 2008 R2 Standard. It's a single SQL instance that runs under the windows domain account DOMAIN\sql_user. There's two databases, ...
-1
votes
0answers
13 views
fail2ban being attached with false IP address [closed]
I am wondering if this could be possible:
The hacker send TCP/IP packets with "false IP address" to the server with fail2ban installed. Those false IPs will be banned by fail2ban program so those ...
