Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
0answers
70 views

How well does haproxy scale for handling client certificate authentication?

As this is a performance-based question about a security issue, some folks at Information Security suggested I post here: My IoT company would like to use client certificate authentication to secure ...
3
votes
0answers
30 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
2
votes
0answers
31 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 ...
2
votes
0answers
14 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
2
votes
0answers
23 views

Protect cached content in apache

I'm facing an issue where I have some cached contents in a disk and I want to protect it with a token url. I can protect my files via htaccess, once they are not cached (direct access), but now I ...
2
votes
0answers
27 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
2
votes
0answers
38 views

Securing config file containing plain-text passwords only with file-system permissions?

I have read a lot of posts and questions about the safest way to secure your server configuration files, which contain sensitive information, such as passwords. The 3 main recommendations I have found ...
2
votes
0answers
31 views

Forced to change expired password when using ssh key

I am working in an environment where I have an account on multiple linux machines where accounts and passwords are managed independently (no active directory/LDAP/etc) and passwords expire every 30 ...
2
votes
0answers
143 views

Spring Shiro is not authenticating login screen in SpringMVC web application

I am trying to use Apache Shiro framework 1.2.4 for security requirements of our Spring MVC web application. I have included configuration details in the application context, pom.xml and web.xml ...
2
votes
0answers
47 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
2
votes
0answers
367 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
2
votes
0answers
127 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
389 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
2
votes
0answers
222 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
2
votes
0answers
154 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
391 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
1k views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
16 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
52 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus ...
2
votes
0answers
8k views

OpenVPN daemon fails to start — starting server manually returns no output

I am setting up an openvpn server on my network for the purposes of accessing devices remotely. I have generated crts and keys with the easy-rsa scripts and have configured server.conf correctly ...
2
votes
0answers
606 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
331 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
132 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
14 views

How to secure configuration management server

There are many configuration management software options nowadays (Chef, Puppet, CFEngine, Ansible...) which offer an architecture with their repository on a central server and clients communicating ...
1
vote
0answers
22 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
1
vote
0answers
19 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
1
vote
0answers
33 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
33 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
1
vote
0answers
42 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
1
vote
0answers
19 views

How to protect nginx proxy from being spoofed by other reverse proxies?

I've recently noticed that one of my sites that's running behind nginx proxy became accessible via bunch of random domains. Some of them are proxies generated by sites like http://unblocksit.es and ...
1
vote
0answers
17 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
1
vote
0answers
48 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
1
vote
0answers
70 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
63 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
0answers
21 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
1
vote
0answers
10 views

Securing APIs with oAuth

I've been reading up on oAuth the last few days but there is one thing that is not totally clear to me. So I've got this oAuth Authorization Server which (skipping a few steps in between here) in the ...
1
vote
0answers
23 views

Allow log on locally custom message

I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the ...
1
vote
0answers
31 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
1
vote
0answers
16 views

Should each task/process/role run as its own user on a Windows server?

I know that on Linux servers, it's widely considered best practice to run each task/role/process/server/program as its own user and usually in its own group. How should separate tasks be handled on a ...
1
vote
0answers
53 views

any problems with UseLogin yes? /(workaround on no system information safe?)

this is about the system information, shown to the user after login on an ubuntu-server. by default, an ubuntu-server is showing you system information, when logging in, such as the servers ...
1
vote
0answers
155 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
53 views

Encrypt credentials JNDI authenticating to JBoss 7.1.1.Final

In my JNDI Lookup, connecting to JBoss 7.1.1.Final from remote clients with plain text password is working fine. Now, I am trying to encrypt credentials in the form, but it's not working. ...
1
vote
0answers
229 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
0answers
58 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
1
vote
0answers
133 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
0answers
71 views

iis 7.5 ipSecurity denyAction=NotFound causes 500 error instead of 404

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config: <ipSecurity allowUnlisted="false"> <add ...
1
vote
0answers
55 views

Allow Execution, Deny Interactive login by GPO

Problem: Accounts to log into work stations are locked down tightly and unable to run nessesary applications on windows 7 stations. Saving an admin accounts credentials to elevate access is currently ...
1
vote
0answers
37 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
1
vote
0answers
542 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
1
vote
0answers
124 views

What is the best way to configure an iDRAC/dell server in a public data center such that the idrac doesn't have to be exposed public facing

I have a server right now in a data center behind an OpenVPN using the client on the box to connect to the vpn server. I'm going to install the iDRAC and want to know how to best configure the ...