Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

1,042 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
1 answer
5k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request interface ...
mark's user avatar
  • 755
10 votes
0 answers
2k views

CentOS 6 local update repository and security updates

I know that official CentOS 6 (even 7) update repositories does not provide security information. The consequence is thatyum-plugin-security plugin and yum check-update --security command does not ...
dsmsk80's user avatar
  • 5,937
9 votes
0 answers
626 views

Can Asterisk's phoneprov module be used securely?

I'm using Asterisk 13.1.0 as packaged by Ubuntu Server 16.04 to run a pure-VoIP phone system. Asterisk has a module – phoneprov – that allows it to template out configuration files for ...
Sam Hanes's user avatar
  • 391
8 votes
1 answer
344 views

Can Samhain monitor for a file that does not exist, but might in future?

I would like Samhain to monitor a file, say for example, /root/somefile. This file does not currently exist, but I would like to be notified if it gets created at any point. I add this to samhainrc: ...
Richard Downer's user avatar
5 votes
0 answers
190 views

Does the default Apache build not have PIE (position independent executable)?

I just built Apache from source, not something I usually do, and noticed that one of the build options was: --enable-pie This builds httpd as a Position Independent Executable which as I understand ...
Tyler Durden's user avatar
4 votes
1 answer
807 views

Will critical security updates get applied even with "auto minor version upgrade" disabled?

RDS offers an "auto minor version upgrade" setting, described in the docs, which causes AWS to automatically upgrade your database engine from time to time: If you want Amazon RDS to ...
Mark Amery's user avatar
4 votes
0 answers
3k views

List of all Permissions-Policy header keys and values?

Does someone have a list of all Permissions-Policy header keys and values? What I have: more_set_headers "Permissions-Policy: camera=(self), fullscreen=(*), geolocation=(self), payment=()"; ...
uav's user avatar
  • 564
4 votes
0 answers
3k views

Setup 2FA/MFA on Jenkins

I'm trying to find how to setup 2FA/MFA on users who login to Jenkins, with Google Authenticator. Everything I'm finding is about logins to servers/git/etc, but not for the actual USERS in Jenkins. ...
Nuno's user avatar
  • 633
4 votes
1 answer
624 views

Dynamically set the screen lock timeout depending on network connection

We need to configure the screen lock timeout on our laptop machines so that the inactivity time dynamically changes according to the connection: if the laptop is directly connected to the corporate ...
MXM's user avatar
  • 51
4 votes
0 answers
582 views

Shared hosting: Apache RewriteRule [P] flag security concern

I want to setup PHP-FPM with Apache in a shared hosting environment. The recommended way is to use mod_proxy_fcgi. Each customer has his own FPM pool, running PHP processes under his own system user. ...
Sebastian's user avatar
4 votes
2 answers
1k views

Stop Google forcing a password change on newly created accounts

I'm in the process of implementing Google's GSuite Password Synch on a Windows Server 2016 AD system. I've installed the Cloud Directory Sync software which successfully creates new users in GSuite ...
CatchAsCatchCan's user avatar
4 votes
0 answers
216 views

Erase GPU memory

We have Nvidia GPU cards that can be used by different users in an OpenStack environment. A first user creates a VM with access to a GPU card, then deletes the VM when done. Another user then creates ...
J. Chorin's user avatar
4 votes
0 answers
1k views

Why are WSUS shared folders shared out to entire network?

I set up a Server 2012 R2 instance as a WSUS server and went through initial set up. But now, from another computer on LAN, when I type explore to the server via UNC path I see Wsuscontent and ...
user1330287's user avatar
4 votes
0 answers
113 views

Jenkins: How to verify downloaded plugins against security threat or corruption?

I am running a Jenkins 2.67 on a Red Hat 7 inside a corporate network. It can only access internet over a forward proxy restricting requests to HTTPS URLs only. By default Jenkins downloads the ...
Antoine Wils's user avatar
4 votes
1 answer
1k views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
sa289's user avatar
  • 1,338
4 votes
0 answers
922 views

Non-admin users can't run MMC on Windows Server 2008 domain controller

I have created some delegated privileges for IT administrators. One of the groups of people has some Active Directory permissions but is not server administrators or domain administrators. They also ...
daks's user avatar
  • 673
3 votes
0 answers
198 views

Why are docker permission errors not logged by selinux?

If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option....
x-yuri's user avatar
  • 2,280
3 votes
0 answers
3k views

User Rights Assignment for IIS APPPOOL

I need to deploy an IIS based web application in an environment that uses Group Policy to apply standard user rights assignment for all computers in the Active Directory domain. When the application ...
Paul H's user avatar
  • 141
3 votes
0 answers
3k views

Why AWS Cognito client secret is not "secret"

We are setting up SaaS server-to-server auth solution using AWS Cognito + API Gateway using oAuth2 Client credentials flow. And one thing is totally bugging me - I can access App client secret in ...
Lukas LT's user avatar
3 votes
0 answers
8k views

How to configure Content-Security-Policy for Nginx and Drupal 8?

I have a Nginx server with Ubuntu 18.04 and a Drupal 8 site. I have read on several articles that should not use 'unsafe-eval', 'unsafe-inline' I added headers for security but the pages of the site ...
Mathieu's user avatar
  • 31
3 votes
0 answers
457 views

hosts.allow, hosts.deny : One rule per service?

In quite a few places (some old, some recent) it's stated that the tcp-wrappers configuration files /etc/hosts.allow, /etc/hosts.deny allow only one rule per service. This looks wrong to me, I write ...
leonbloy's user avatar
  • 2,148
3 votes
0 answers
1k views

How to access database on Docker swarm without exposing ports to internet?

I had a really hard time coming up with a short and descriptive title for this... Let me explain: In classic Docker (no swarm mode) I had my system set up in a way that my PostgreSQL database would ...
MadMonkey's user avatar
  • 295
3 votes
0 answers
243 views

Why a TCP connection fail faster on Linux closed ports than on Windows ones?

While trying the simple exploit described here I noticed that it doesn't works on Linux while it works on Windows (tried with several browsers). Apparently this is because, on Linux, the operating ...
Giacomo Tesio's user avatar
3 votes
0 answers
100 views

How to filter external HTTP requests using on remote host location and GET parameters with Tomcat8?

I have a tomcat 8 web applications server and it has a running application (/app). This /app can be accessed from both internal and external HTTP GET requests but 1 request from external should be ...
Bằng Rikimaru's user avatar
3 votes
0 answers
229 views

Are there risks / downsides to creating users who are required to login with the LogonType of "Batch"

I am a vendor providing instructions to my users to cover of the situation where they want to create users on a windows server simply for the purpose of authentication. Note: Active Directory is ...
AnthonyVO's user avatar
  • 161
3 votes
0 answers
57 views

Chroot SFTP Group

I have a CentOS 6.9 file server set up. Everyone in the company is given access as a member of the staff group. They're dropped into /home/sharedfolder when they connect, however they're able to jump ...
Gray Loon's user avatar
3 votes
1 answer
126 views

Spamassasin user - disable shell

I recently discovered that spamassasin added the following line to my passwd file: debian-spamd:x:115:122::/var/lib/spamassassin:/bin/sh. Why does spamassasin need shell access? Is it safe to disable ...
koseduhemak's user avatar
3 votes
0 answers
264 views

Restricting query types in Bind9

The network is relatively straightforward: on the inside there is Active Directory, in the DMZ is a BIND9 DNS forwarder. The Active Directory domain controller is the internal DNS server for all ...
Joe Dohn's user avatar
3 votes
0 answers
2k views

Constant Audit Failures in Event Viewer from Users not logged on

Let me start off with some details on my environment: Windows Active Directory Domain Environment Domain Controller: Windows Server 2003 R2 Problem Workstation: Windows 7 Professional 64-bit Lately ...
OilyBusiness's user avatar
3 votes
0 answers
91 views

User friendly way to secure a legacy application over the Internet?

I'm dealing with a proprietary, legacy VMS (Video Management System) that is connected to IP cameras for remote surveillance. The system is exposed on the public Internet on port 8016 and users are ...
ItalyPaleAle's user avatar
3 votes
0 answers
481 views

Open LDAP authenticates LDAP users as local admin account - Linux - Ubuntu 14

So, I thought my LDAP was working perfect, but today I went to log in, and its authenticating me, but its showing i'm the local Admin account, even whoami says so, and I have full root access like ...
FreeSoftwareServers's user avatar
3 votes
0 answers
534 views

Enforcing audit settings for all subfolders and files on NTFS

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS ...
René's user avatar
  • 31
3 votes
0 answers
1k views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 09:...
Carl Bennett's user avatar
3 votes
0 answers
92 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
DigitalRoss's user avatar
3 votes
1 answer
545 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
EPJK1337's user avatar
3 votes
1 answer
277 views

How to secure an open proxy (mod_proxy) for demoing service

A client has a service that requires a bit javascript to be added to a customer's page. As a marketing tool to show prospective customers, I created a web app that demonstrates how the customer's page ...
Stan James's user avatar
3 votes
1 answer
4k views

Audit Logs for Environment Path Changes

Something (or someone) keeps changing our environment path variables on several of our servers. I have the Audit Policy (under local sec pol) set to Success, Failure for all but Process Tracking (...
John S.'s user avatar
  • 141
3 votes
1 answer
2k views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...
Robbie's user avatar
  • 163
3 votes
1 answer
61 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
Chris B. Behrens's user avatar
3 votes
0 answers
1k views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
asdf's user avatar
  • 31
3 votes
0 answers
253 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
eandersson's user avatar
3 votes
0 answers
77 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus (...
user avatar
3 votes
1 answer
784 views

Is Exchange protected from/allow back dated emails?

Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
David's user avatar
  • 1,293
3 votes
1 answer
282 views

Grsecurity's RBAC policy for scripts

I have some problems with set right policy for my gentoo-based system. I have no idea how can I add permissions for everything which was started by /root/scripts/autosync. I am getting error like: [...
user avatar
3 votes
2 answers
9k views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On http://www....
user211376's user avatar
2 votes
0 answers
36 views

Disable computer on a schedule

I'm looking for a way to disable end user access to a Windows 10 workstation during a given period, say, from 8pm to 8am. It doesn't need to be superuser-proof. It doesn't need to be reboot-proof. ...
entonio's user avatar
  • 185
2 votes
1 answer
486 views

Since S3 charges by request, couldn't a malicious hacker cause a huge AWS bill just by spamming requests?

What would stop them from doing so, against, say, a static website hosted using S3? Is there a good way to deny some requests such that one avoids getting billed for them? (Context: I want to host a ...
Asker's user avatar
  • 121
2 votes
0 answers
1k views

Is it possible to use MTA-STS in Postfix without overriding DANE?

The SMTP MTA Strict Transport Security RFC 8461, 2 clearly states that: However, MTA-STS is designed not to interfere with DANE deployments when the two overlap; in particular, senders who implement ...
Esa Jokinen's user avatar
  • 49.7k
2 votes
1 answer
875 views

How to use ext4magic in LVM?

I'm trying to recover using ext4magic.my partition was LVM. try to execute command ext4magic /dev/sda1 -J -f -s 2048 imges/ error /dev/sda2 Error 2133571347 while opening filesystem ext4magic : ...
Tamil's user avatar
  • 121
2 votes
1 answer
470 views

Can I rely on the 701 permissions to prevent users within the same group from messing with each other's data?

Some time ago I've learned that assigning all users to the same group and setting 701 to their home directories prevents them from messing with each other's data, yet lets a system program, such as a ...
Col. Shrapnel's user avatar

1
2 3 4 5
21