Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
7answers
11k views

How can I prevent explorer starting as a shell in a kiosk setting?

I'm using an alternative shell (a simple program that restarts a kiosk application if it dies) for a project I'm working on. I've set it via the Shell value in the registry, and I'm not using ...
-5
votes
1answer
101 views

Does a tool like ansible make it possibly to get a secure server, without knowing a lot about security? [closed]

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure? sovereign: A set ...
9
votes
6answers
667 views

DDoS. Are we that helpless? [duplicate]

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of ...
0
votes
0answers
19 views

IIS 7.5 and above - enable schannel cipher DHE_RSA_AES_128_GCM following patch KB2992611 - Is this safe?

I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS); TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ...
0
votes
0answers
21 views

How can I setup a High-availability cluster [on hold]

I am looking to improve security for the system on my webserver, I have been told to look into 'HA SETUPS' I have done some research and I am still no closer to actually achieving this setup... I am ...
0
votes
0answers
27 views

Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy

I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
0
votes
0answers
9 views

Rogue external service showing up in New Relic that I can't track down

I am working on a CentOS 5.1 dedicated server that uses WHM/cPanel to host 75'ish sites. There is an external service, matvsub.wang, that is showing up in New Relic external services that has a ...
6
votes
2answers
666 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
3
votes
4answers
4k views

Unknown and strange RDP successful logins in EventViewer

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details: They are not similar to ...
0
votes
1answer
4 views

Secure elasticsearch but allow remote CRUD

I'm going to run a bit of software on server A to add and remove entries from elasticsearch on server B. How can I allow these remote create and delete operations, but still keep ES secure? Is ...
-1
votes
0answers
16 views

My VPS sends huge spam :( [duplicate]

since I am not tech guy I am trying to find someone who can help me but with no success so far. My VPS sends spam. Like a lot. 1,4TB in two days even though we restart immediately it when we see huge ...
-5
votes
0answers
15 views

Using our own web application to login other web application [on hold]

Is it possible to login directoly on webmail.mailhostbox.com account by our own web application login form i am not use webmail.mailhostbox.com login page
1
vote
2answers
38 views

How can I stop ansible from writing passwords to the logfiles?

I am setting up a MySQL server and want Ansible to set the mysql-root password during installation. With the help of the internet I came up with this solution: - name: Set MySQL root password before ...
0
votes
2answers
4k views

Windows: disable remote access of local drive, even by domain admin

We have a network of Windows 7 PCs that are managed as part of a domain. What we want is for the domain admin to be unable to view the PC's local drive (C:) unless he is physically at the PC. In ...
5
votes
4answers
917 views

Giving SSH access to a user, and security issues

Okay, so I have a VPS and I made an account for a friend so he can host his own domains (using the reseller features in DirectAdmin). He's asking for SSH access, and I know that this is probably a bad ...
1
vote
0answers
401 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
0
votes
1answer
16 views

Data security for PII

I have a question regarding data security. I have an application that dumps a flat Excel file on a Windows server from an SAP database. The file is edited, then the application writes the edited ...
0
votes
0answers
15 views

Fail2Ban is not working for ssh

Iptable status:- ubuntu@ip-address:~$ sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A fail2ban-ssh -j ...
2
votes
2answers
2k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
-1
votes
0answers
17 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
0
votes
0answers
13 views

Frame-relay protocol and security [closed]

My actual network is based on the frame-relay protocol. It is an entreprise network linking between many distant sites. How can I change this protocol to ensure a more secure network?
-3
votes
1answer
30 views

Windows File Shares inside an Organisation [on hold]

I came across to a security weakness that potentially can put information at risk in my organisation. Whenever I access other's computer in the network through the command: \\192.168.20.4\c$ I ...
1
vote
2answers
43 views

How do I drop requests from dig?

Basically I'm getting tons of request to my named/bind service, basically those requests are being rejected by named, Those are the messages i get, from tons of ips., How extacly can I drop those ...
3
votes
1answer
29 views

Restrict postqueue access to admin user

I'm running postfix on Gentoo as mailer daemon. During investigation of some queue pileup I found that /usr/sbin/postqueue is executable by all users on the system, it happily outputs the current mail ...
0
votes
2answers
34 views

Protecting mysql instance on Linux Azure VM

I have mysql running in a Linux Azure VM. It's currently bound to the "Internal IP Address" of the VM as looked up in ifconfig and the Azure Dashboard. I've turned on logging to see who and what is ...
2
votes
2answers
37 views

Does DNSSec NSEC3 require support from the Registrar, DNS Server or both?

I'm interested in getting NSEC3 support for my domain getvalid.com, so that I can prevent name traversal. DYN doesn't seem to support NSEC3, and it's clear that BIND and the DNS server require the ...
1
vote
1answer
3k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
-3
votes
0answers
19 views

Proper way to set up an user in NGINX (?) [on hold]

I am using NGINX and I need to set up an user, I see in the config file something like #user nobody;, so, I want to know how to configure it, and how should I use it ? I just change that and put user ...
-1
votes
0answers
77 views

Server hacked; how? [duplicate]

It looks as if our CentOS LAMP server has been compromised today. It appears malicious files have been uploaded into the webroot and requests are being made to upload these files to other servers. I ...
15
votes
1answer
15k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
1
vote
0answers
13 views

Managing IAM security credentials for multiple docker containers

Within plain EC2 environment, managing access to other AWS resources is fairly straightforward with IAM roles and credentials (automatically fetched from instance metadata). Even easier with ...
0
votes
1answer
2k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
10
votes
2answers
14k views

How to check if a RSA public / private key pair matched

I have two files, id_rsa and id_rsa.pub, what command can be used to validate if they are the valid pair.
-2
votes
1answer
49 views

How to secure OwnCloud? [closed]

I am not literate when it comes to servers, but I like the idea of having my own cloud storage for privacy reasons. OwnCloud is targeting (at least a little bit) the "DIY-home-user" so it seemed to be ...
4
votes
2answers
1k views

How found suspect connection in a netstat output?

It seems some ssh brute force are outgoing from my debian 7.1. I'm searching how to find the source of these brute force. I'm searching in netstat output, but how can i identify trace of this hack ? ...
1
vote
1answer
1k views

Disabling weak ciphers

Does anyone have any experience disabling weak ciphers on Windows Registry? Server doesn't have IIS installed. Below is the results of my security scan but not 100% what registry entries should be ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
1answer
1k views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
0answers
14 views

Warnings in Tiger auditing reports (process is listening on socket)

I get email logs like the ones below emailed daily from my server. I don't really know what does it mean and thinking about disabling them, but I guess this is not a good idea and it's better to learn ...
14
votes
7answers
4k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
0
votes
2answers
1k views

Passed SSL checker, but browser doesn't show secure?

I've set up my SSL certificate following the instructions at http://splittingelectrons.wordpress.com/2012/02/24/how-to-configure-an-ssl-certificate-for-apache-on-amazon-ec2/ I've checked my website ...
0
votes
2answers
43 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
1
vote
2answers
49 views

Where are MySQL users and passwords stored?

When I delete 'mysql'.'user' table I'm still able to log in as any user I've created before. How is this possible?
0
votes
2answers
1k views

Disabled IPV6 but still showing in netstat

newbie here, for security best practice I want to disable IPV6 (not to deal with IPV6 firewall settings). I use Hetzner root server Ubuntu 12.04 . /etc/sysctl.conf file already have a setting from ...
8
votes
9answers
4k views

What should I do about someone trying to brute force attempt to login to our SQL Server 'sa' account?

Looks like someone or something is trying a brute force attempt at logging into our production SQL Server instance with the 'sa' account. They haven't been successful because our 'sa' account is ...
0
votes
1answer
60 views

Blocking SSH Brute force from a HAProxy LB

We're trying to grant access to an internal SSH server using a HAProxy setup on a public DMZ. This works as expected however connections into the server are originated from the HAProxy (tproxy won't ...
0
votes
1answer
1k views

How to enable connection security for WMI firewall rules when using VAMT 2.0?

I want to use VAMT 2.0 to install product keys and active software in remote machines. Everything works fine as long as the ASync-In, DCOM-In, and WMI-In Windows Firewall rules are enabled and the ...
0
votes
1answer
1k views

Most secure: Authentification point at Citrix Access Gateway, or Web Interface

At our company we have XenApps accessible through Citrix Access Gateway. I am looking through the settings and i can see under the Web Interface settings that the authentication point is set to be "at ...