Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
0answers
734 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
3
votes
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
2
votes
0answers
62 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
2
votes
0answers
32 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
2
votes
0answers
137 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
2
votes
0answers
76 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
38 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
2
votes
0answers
125 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
206 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
592 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
16 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
37 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
2
votes
0answers
172 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
2
votes
0answers
336 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
242 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
126 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
32 views

Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy

I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
1
vote
0answers
31 views

Managing IAM security credentials for multiple docker containers

Within plain EC2 environment, managing access to other AWS resources is fairly straightforward with IAM roles and credentials (automatically fetched from instance metadata). Even easier with ...
1
vote
0answers
22 views

Strange file structure on surveillance DVR

I have a 2TB HDD (WD Purple) from a client's surveillance DVR (Night Owl) with a puzzling file structure. The drive has 7,451 256MB files all dated 1/10/2098 23:02. The files are named 0001-7451 with ...
1
vote
0answers
31 views

What is the best way to configure an iDRAC/dell server in a public data center such that the idrac doesn't have to be exposed public facing

I have a server right now in a data center behind an OpenVPN using the client on the box to connect to the vpn server. I'm going to install the iDRAC and want to know how to best configure the ...
1
vote
0answers
24 views

Single row user security in MS SQL 2008 R2

I have a SQL Server 2008R2 question regarding making a single row in an odd way. situation: I have a student records database in which ~ 100 students might in-process in a given day. They enter a ...
1
vote
0answers
48 views

Configurable ftp-proxy with LDAP authentication

I am looking for solution for following situation. I have bunch of ftp account (many servers) and many users. They need access to that servers. I don't want to give every user passwords to every ...
1
vote
0answers
50 views

How to copy locked swap files in ESXi?

Based on this question : How to disable swap files in ESXi?. The main answer states that it is possible to extract data from the swap files (for exemple using strings) so I tried to make a simple ...
1
vote
0answers
45 views

Restrict hostapd wireless client from talking to eachother

How can I keep a wireless client of hostapd from talking to a wired client on the same network or another wireless client on the same network? Here's my network topology: [wired client] --> ...
1
vote
0answers
23 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
0answers
182 views

OpenVAS 7 failing to SSH into a test server

My local machine is hosting a Kali VM. I am trying to run local security tests using the VM's OpenVAS 7 on a server running Ubuntu 12.04.5. When I run SSH Authorization Test I get the following ...
1
vote
0answers
55 views

Meraki Z1: protection of corporate devices from personal devices

My company employees about 600-700 remote employees, each of whom is issued a corporate IP phone an a thin client compute endpoint. In our current deployment, both devices are configured (defaults ...
1
vote
0answers
56 views

Owncloud - Proxy changes certificate

I'm running an owncloud server 7.0.2 with apache(Ubuntu host) and configured it to use a self-signed ssl certificate. Everything works fine on my home-PC On an other machine I would like to use the ...
1
vote
0answers
38 views

Most secure way to encrypt critical data to be shared, edited and seen (must ALWAYS be secure)

This question does not rely on time... so it's not about keeping data on tape or anything similar. I have 3 distinct PCs with critical information. PCs are running Windows OS. They all hold critical ...
1
vote
0answers
138 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
1
vote
0answers
24 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
1
vote
0answers
169 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
1
vote
0answers
125 views

CIS benchmark: How to define the BUILTIN\Administrator account within GPOs?

I am responsible for configuring GPOs according to the latest CIS benchmark policy. However the test for "Impersonate a client after authentication" always fails, although everything seems to be ...
1
vote
0answers
413 views

Nginx error: “File not found”…coming from someone else's domain

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log: ... ...
1
vote
0answers
204 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
1
vote
0answers
149 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
1
vote
0answers
284 views

Non-admin users can't run mmc on Domain Controller on Windows Server 2008 (ok for Enterprise not for Standard edition)

I have created some delegation for IT administrators. One of the groups of people have some Active Directory permissions but is not server administrators or domain administrators. They also are ...
1
vote
0answers
229 views

permissions for VBScript/ADSI remote local account password change

I am using the IISADMPWD pages on IIS8/Windows 2012 and have found that administrative rights on a remote server for password changes is not required. I am hoping somebody can shed some light as to ...
1
vote
0answers
373 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
201 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
148 views

Restrict windows server 2008 R2 remote mmc

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort. Server is in domain and there is big amount of other ...
1
vote
0answers
120 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
1
vote
0answers
129 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
0answers
44 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
1
vote
0answers
794 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
78 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
1
vote
0answers
118 views

What are recommended permissions for files in /var/log?

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
1
vote
0answers
722 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
1
vote
0answers
114 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
1
vote
0answers
77 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...