Security is not a product, but a process.

learn more… | top users | synonyms (1)

4
votes
0answers
31 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
4
votes
0answers
958 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
4
votes
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
2
votes
0answers
123 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
2
votes
0answers
35 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
2
votes
0answers
204 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
2
votes
0answers
95 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
132 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
261 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
725 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
16 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
37 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
2
votes
0answers
45 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus ...
2
votes
0answers
214 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
2
votes
0answers
379 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
270 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
131 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
8 views

I can installa “Ossec” on xenserver host?

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
1
vote
0answers
63 views

SSH Passwords are working using IP address, but not when using the server name

We recently rebuilt one of our servers using Ubuntu 12.04 LTS and experienced something we haven't seen before. When we attempt to ssh into the box, we are able to ssh into the box if we use the ip ...
1
vote
0answers
25 views

Tracing namespace mining culprit

I have a Centos 6x box with these installed: CXS + CSF + LFD. I'm trying to figure out how to effectively trace what MS is claiming namespace mining on my IP. From Microsoft: We have completed ...
1
vote
0answers
22 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
1
vote
0answers
49 views

What is the best way to configure an iDRAC/dell server in a public data center such that the idrac doesn't have to be exposed public facing

I have a server right now in a data center behind an OpenVPN using the client on the box to connect to the vpn server. I'm going to install the iDRAC and want to know how to best configure the ...
1
vote
0answers
61 views

Configurable ftp-proxy with LDAP authentication

I am looking for solution for following situation. I have bunch of ftp account (many servers) and many users. They need access to that servers. I don't want to give every user passwords to every ...
1
vote
0answers
61 views

How to copy locked swap files in ESXi?

Based on this question : How to disable swap files in ESXi?. The main answer states that it is possible to extract data from the swap files (for exemple using strings) so I tried to make a simple ...
1
vote
0answers
31 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
0answers
67 views

Owncloud - Proxy changes certificate

I'm running an owncloud server 7.0.2 with apache(Ubuntu host) and configured it to use a self-signed ssl certificate. Everything works fine on my home-PC On an other machine I would like to use the ...
1
vote
0answers
43 views

Most secure way to encrypt critical data to be shared, edited and seen (must ALWAYS be secure)

This question does not rely on time... so it's not about keeping data on tape or anything similar. I have 3 distinct PCs with critical information. PCs are running Windows OS. They all hold critical ...
1
vote
0answers
174 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
1
vote
0answers
24 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
1
vote
0answers
206 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
1
vote
0answers
158 views

CIS benchmark: How to define the BUILTIN\Administrator account within GPOs?

I am responsible for configuring GPOs according to the latest CIS benchmark policy. However the test for "Impersonate a client after authentication" always fails, although everything seems to be ...
1
vote
0answers
526 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
1
vote
0answers
235 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
1
vote
0answers
165 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
1
vote
0answers
321 views

Non-admin users can't run mmc on Domain Controller on Windows Server 2008 (ok for Enterprise not for Standard edition)

I have created some delegation for IT administrators. One of the groups of people have some Active Directory permissions but is not server administrators or domain administrators. They also are ...
1
vote
0answers
290 views

permissions for VBScript/ADSI remote local account password change

I am using the IISADMPWD pages on IIS8/Windows 2012 and have found that administrative rights on a remote server for password changes is not required. I am hoping somebody can shed some light as to ...
1
vote
0answers
416 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
240 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
170 views

Restrict windows server 2008 R2 remote mmc

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort. Server is in domain and there is big amount of other ...
1
vote
0answers
132 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
1
vote
0answers
151 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
0answers
51 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
1
vote
0answers
928 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
92 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
1
vote
0answers
144 views

What are recommended permissions for files in /var/log?

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
1
vote
0answers
781 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
1
vote
0answers
131 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
1
vote
0answers
87 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...
1
vote
0answers
56 views

Difference between “Security Configuration Manager” and “Security Configuration Wizard”

I want some clarifications about differences between SCW and SCM. strictly Speaking when I use SCM baseline for specific Server Role (domain controller, ftp server, ...), I get for example 200 gpo's ...
1
vote
0answers
61 views

Restrict users to certain applications only

We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us ...