Security is not a product, but a process.

learn more… | top users | synonyms (1)

-3
votes
0answers
26 views

1 Central Interface— to Multiple 2k12 VM windows servers not in a domain controller, how to patch and secure [on hold]

I am new to the networking. I am looking for help or a GUI tool on automating tasks on multiple (21 VM's) Windows 2k12r2 servers at a hosting site... From an SMB perspective I have the following ...
2
votes
0answers
36 views

SSH: Security of Pubkey Authentication vs Password [migrated]

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and ...
1
vote
1answer
555 views

nginx - deny all *.php requests except index.php for security reasons

os: CentOS 7 nginx: 1.6.2 httpd: apache 2.4.6 cms: Drupal 7 After my server was compromised I removed all from server, reinstalled OS and soft, and restored data from backup. Now I configure all ...
0
votes
1answer
103 views

Is setting a Content Security Policy incompatible with Joomla's admin page?

I'd like to set a content security policy header for a Joomla website running on Apache 2.4. Using this configuration from h5bp and setting Header set Content-Security-Policy "script-src 'self'; ...
1
vote
1answer
32 views

Single row user security in MS SQL 2008 R2

I have a SQL Server 2008R2 question regarding making a single row in an odd way. situation: I have a student records database in which ~ 100 students might in-process in a given day. They enter a ...
1
vote
2answers
1k views

Bitlocker drive encryption on AWS Windows instance

I'm trying to figure out how best to protect the data of a single Windows Server 2012 instance on AWS and according to "AWS_Securing_Data_at_Rest_with_Encryption.pdf" it says: "Encrypting Amazon ...
2
votes
5answers
1k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
31
votes
7answers
1k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
0
votes
2answers
257 views

how limit php script to access parent host directory

I've a debian linux server with apache2.2 & php5 installed. I've created many virtual hosts on my apache server, each virtual host has a separate root directory & php is enabled for all of ...
2
votes
1answer
28 views

Concealing an RDP service with a website

Is there a way (using a proxy or otherwise) to conceal an RDP service listening on port 443, such that HTTPS requests made from a browser serve a website while RDP requests connect as normal?
2
votes
1answer
34 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
-1
votes
0answers
19 views

Files placed on server used for phising, how to find source / break-in [duplicate]

Appearantly my server has been used as a phishing host for attacks against PayPal. There were files placed inside different folders accross the server and the files get executed from various IPs ...
1
vote
0answers
44 views

SSH Passwords are working using IP address, but not when using the server name

We recently rebuilt one of our servers using Ubuntu 12.04 LTS and experienced something we haven't seen before. When we attempt to ssh into the box, we are able to ssh into the box if we use the ip ...
0
votes
1answer
450 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
3
votes
2answers
103 views

Secure with TLS/SSL

Is there any way to secure network traffic between any two applications with SSL even both applications don't support SSL mode? Diagram: (Host X (Application A) ) --------unsecured connection----- ...
1
vote
0answers
20 views

Tracing namespace mining culprit

I have a Centos 6x box with these installed: CXS + CSF + LFD. I'm trying to figure out how to effectively trace what MS is claiming namespace mining on my IP. From Microsoft: We have completed ...
3
votes
2answers
1k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
6
votes
2answers
2k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
-1
votes
0answers
15 views

Ghost platform compromised? [duplicate]

Digital Ocean reported that they detected Brute Force attack launched from my server. So when I did a lsof -i, I see lots of ghost user ssh2 connections. I have killed all the processes from the ...
0
votes
0answers
14 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
-1
votes
1answer
31 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
8 views

Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?

I have a interface where traffic is flowing from internet to NGINX server to application server. I want to monitor (IDS) the traffic flowing between Internet and NGINX at L3,4 and IPS the traffic ...
2
votes
1answer
42 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
-3
votes
0answers
173 views

How to fix LogJam vulnerability in Nginx [closed]

Could you please post a detailed anser on how to fix LogJam vulnerability in Nginx? A checker can be found here: https://weakdh.org/sysadmin.html Thank you.
9
votes
6answers
506 views

Security Admins toolkit? What's in yours? [closed]

Resource question :- I need to collate a list of security admin tools For: Web Network Wifi Server unix/Linux/windows/macosx SQL Xss Please state -links/version/os used/free v buy
0
votes
1answer
29 views

Windows server 2008 Admin password changes after logout

I have windows server 2008 with two administrator accounts and I have a fixed IP for it. I access the server with remote desktop but every time I logout of any of the 2 admin accounts i can't login ...
1
vote
1answer
988 views

403 forbidden error going through aws load balancer

I am running a IIS 7 Server behind an aws load balancer. I am using a Verisign SSL certificate which is installed properly but whenever I put in the URL, or the DNS name of the load balancer I get a ...
1
vote
1answer
56 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
40
votes
10answers
10k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
2
votes
1answer
57 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
0
votes
1answer
80 views

Security implications of running Apache with php5-fpm as user:user

I just set up VPS to run Apache with php5-fpm which is set to run every user pool as user:user. Reason for this is simply to allow users to actually own their own files created by various CMS ...
1
vote
1answer
41 views

how to block all requests from URLs with MSDOS device name using isapi filter cve 2007-2897

I recently had an audit report on my windows server 2008 R2 and it failed with the error/vulnerability: Microsoft asp.net ms-dos device name DoS www (443/tcp). I have not been able to find any ...
-1
votes
2answers
25 views

Creating Virtual Proxy Server

I know this is not this kind of forum, but I can't find anything in google that really answers my question. Is there possible to create a Proxy server running in a Virtual Machine using only 1 ...
3
votes
4answers
2k views

WMI permissions: Select CommandLine, ProcessId FROM Win32_Process returns no data for CommandLine

I am gathering performance data via WMI and would like to avoid having to use an account in the Administrators group for this purpose. The target machine is running Windows Server 2003 with the latest ...
5
votes
7answers
5k views

Why would you use EAP-TTLS instead of PEAP?

As I understood EAP-TTLS and PEAP share same level of security when implemented in wireless networks. Both only provide server side authentication via certificate. The drawback of EAP-TTLS can be ...
1
vote
1answer
50 views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...
0
votes
2answers
3k views

Allow service to interact with desktop

DC OS - Windows Server 2008 R2 Std Client OS - Windows XP, Windows 7 I have implemented Security policy through Network Policy Server and enabled Wired AutoConfig Services Automatically. While ...
0
votes
1answer
914 views

McAfee ePO server not displaying updated Product version number

I have recently been given Administrative rights to help maintain ePO on my companies network. From the group of machines that I am in charge of keeping up-to-date, a small amount of these machines ...
-2
votes
0answers
16 views

UFW deny all outgoing except to certain IP's [duplicate]

I need to secure my server by making sure it can only communicate with a certain set of IP's (both incoming and outgoing). Setting up the incoming rules is easy enough, but I can't seem to find any ...
-3
votes
1answer
92 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
11
votes
7answers
2k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
0
votes
1answer
15 views

Is is possible to have an Admin account manage both Exchange 2013 (on prem) and Office 365?

We are in hybrid mode and a few people are asking me to create an additional account for them so they can administer O365 and use a different account for on prem exchange. After troubleshooting on my ...
0
votes
0answers
16 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...
2
votes
2answers
2k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
0
votes
1answer
1k views

Account lockouts not in Event Viewer

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1. I am able to find Audit Failure events (ID ...
0
votes
0answers
18 views

Assigning random IPv6 ranges to ISPs as a security measure [migrated]

Pinging all the IPv4 address space takes about 5 hours (and can generate beautiful maps). Port-scanning doesn't take much longer and can reveal vulnerable services, such as remote administration of ...
1
vote
2answers
2k views

windows 2008 R2 TS printer security - can't take owership

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server. If the user opens a cmd ...
3
votes
5answers
67 views

Should I enable automatic security updates on a Ubuntu server? [closed]

I can't seem to find an agreed answer on this anywhere, so I figured I'd ask it myself. I have five Ubuntu servers running either 12.04 or 14.04, should I enable automatic security updates on these ...
0
votes
1answer
2k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
1answer
3k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...