Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
0answers
34 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
3
votes
0answers
20 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
2
votes
0answers
138 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
2
votes
0answers
37 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
2
votes
0answers
222 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
2
votes
0answers
102 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
136 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
272 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
767 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
16 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
45 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus ...
2
votes
0answers
229 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
2
votes
0answers
400 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
278 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
132 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
10 views

Weird `lastb` output

Recently I got weird output from lastb on my VPS: root ssh:notty 122.10.102.42 Thu Aug 27 11:19 - 11:19 (00:00) root ssh:notty 122.10.102.42 Thu Aug 27 11:18 - 11:18 (00:00) ...
1
vote
0answers
8 views

iis 7.5 ipSecurity denyAction=NotFound causes 500 error instead of 404

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config: <ipSecurity allowUnlisted="false"> <add ...
1
vote
0answers
30 views

Allow Execution, Deny Interactive login by GPO

Problem: Accounts to log into work stations are locked down tightly and unable to run nessesary applications on windows 7 stations. Saving an admin accounts credentials to elevate access is currently ...
1
vote
0answers
23 views

Frequent SIGTERM Apache

I suspect sometims is going wrong in my webserver (maybe possible DoS attack). In fact I see a lot of such entries: [Sun Jul 19 10:36:21 2015] [error] [client 141.212.122.18] client sent HTTP/1.1 ...
1
vote
0answers
60 views

What is the best way to configure an iDRAC/dell server in a public data center such that the idrac doesn't have to be exposed public facing

I have a server right now in a data center behind an OpenVPN using the client on the box to connect to the vpn server. I'm going to install the iDRAC and want to know how to best configure the ...
1
vote
0answers
62 views

Configurable ftp-proxy with LDAP authentication

I am looking for solution for following situation. I have bunch of ftp account (many servers) and many users. They need access to that servers. I don't want to give every user passwords to every ...
1
vote
0answers
61 views

How to copy locked swap files in ESXi?

Based on this question : How to disable swap files in ESXi?. The main answer states that it is possible to extract data from the swap files (for exemple using strings) so I tried to make a simple ...
1
vote
0answers
144 views

Restrict hostapd wireless client from talking to eachother

How can I keep a wireless client of hostapd from talking to a wired client on the same network or another wireless client on the same network? Here's my network topology: [wired client] --> ...
1
vote
0answers
35 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
0answers
68 views

Owncloud - Proxy changes certificate

I'm running an owncloud server 7.0.2 with apache(Ubuntu host) and configured it to use a self-signed ssl certificate. Everything works fine on my home-PC On an other machine I would like to use the ...
1
vote
0answers
45 views

Most secure way to encrypt critical data to be shared, edited and seen (must ALWAYS be secure)

This question does not rely on time... so it's not about keeping data on tape or anything similar. I have 3 distinct PCs with critical information. PCs are running Windows OS. They all hold critical ...
1
vote
0answers
202 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
1
vote
0answers
220 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
1
vote
0answers
176 views

CIS benchmark: How to define the BUILTIN\Administrator account within GPOs?

I am responsible for configuring GPOs according to the latest CIS benchmark policy. However the test for "Impersonate a client after authentication" always fails, although everything seems to be ...
1
vote
0answers
544 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
1
vote
0answers
242 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
1
vote
0answers
176 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
1
vote
0answers
334 views

Non-admin users can't run mmc on Domain Controller on Windows Server 2008 (ok for Enterprise not for Standard edition)

I have created some delegation for IT administrators. One of the groups of people have some Active Directory permissions but is not server administrators or domain administrators. They also are ...
1
vote
0answers
316 views

permissions for VBScript/ADSI remote local account password change

I am using the IISADMPWD pages on IIS8/Windows 2012 and have found that administrative rights on a remote server for password changes is not required. I am hoping somebody can shed some light as to ...
1
vote
0answers
441 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
253 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
182 views

Restrict windows server 2008 R2 remote mmc

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort. Server is in domain and there is big amount of other ...
1
vote
0answers
140 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
1
vote
0answers
155 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
0answers
51 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
1
vote
0answers
990 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
798 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
1
vote
0answers
145 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
1
vote
0answers
89 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...
1
vote
0answers
58 views

Difference between “Security Configuration Manager” and “Security Configuration Wizard”

I want some clarifications about differences between SCW and SCM. strictly Speaking when I use SCM baseline for specific Server Role (domain controller, ftp server, ...), I get for example 200 gpo's ...
1
vote
0answers
61 views

Restrict users to certain applications only

We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us ...
1
vote
0answers
304 views

Blue Coat - Blacklist list import

Is there a way to mass import domains into Blue Coat blacklist ? I get daily feeds from various sources and I was thinking whether I can modify the input file to a format to meet Blue coat ...
1
vote
0answers
303 views

Securing iis 8 nt permissions

I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible. I have moved the websites to "c:\sites\mysiteA\", ...
1
vote
0answers
187 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
555 views

security group not allowing connection to postgres ec2 aws

Hey im having some trouble allow remote connections to postgres from other ec2 instances using the named security group feature to rules. I have set the listens directive in postgres.conf to "*" and ...