Security is not a product, but a process.

learn more… | top users | synonyms (2)

3
votes
0answers
94 views

Error connecting ESX 5.0.0 to domain

I am trying to connect an ESX 5.0.0 to our Domain Controler, in order to give a Domain group specific roles security. But I do not see any groups after the host connects to the domain. Under ...
2
votes
0answers
20 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
2
votes
0answers
112 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
109 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
402 views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
14 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
34 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
2
votes
0answers
141 views

selinux “Possible mismatch between this policy…”

How do I go about troubleshooting the following error below: type=AVC msg=audit(1365523330.609:4846): avc: denied { append } for pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 ...
2
votes
0answers
268 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
215 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
2
votes
0answers
124 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
19 views

Why does SYSTEM “Privilege Use” event cause another program to crash?

This is an odd one that I've been trying to track down for while. I am not a server administrator, but a programmer/developer, but, sadly, at my company, I probably have the most knowledge of how to ...
1
vote
0answers
34 views

Owncloud - Proxy changes certificate

I'm running an owncloud server 7.0.2 with apache(Ubuntu host) and configured it to use a self-signed ssl certificate. Everything works fine on my home-PC On an other machine I would like to use the ...
1
vote
0answers
16 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
1
vote
0answers
98 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
1
vote
0answers
305 views

Disabling HSTS for managed browsers

What are my options for disabling HSTS both for new sites and for those sites baked into the browser? The use of HTTPS inspection inherently changes the thumbprint of a site by acting as a man in ...
1
vote
0answers
107 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
1
vote
0answers
109 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
1
vote
0answers
246 views

Non-admin users can't run mmc on Domain Controller on Windows Server 2008 (ok for Enterprise not for Standard edition)

I have created some delegation for IT administrators. One of the groups of people have some Active Directory permissions but is not server administrators or domain administrators. They also are ...
1
vote
0answers
194 views

permissions for VBScript/ADSI remote local account password change

I am using the IISADMPWD pages on IIS8/Windows 2012 and have found that administrative rights on a remote server for password changes is not required. I am hoping somebody can shed some light as to ...
1
vote
0answers
271 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
156 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
121 views

Restrict windows server 2008 R2 remote mmc

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort. Server is in domain and there is big amount of other ...
1
vote
0answers
100 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
1
vote
0answers
99 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
0answers
36 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
1
vote
0answers
522 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
45 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
1
vote
0answers
103 views

What are recommended permissions for files in /var/log?

I am working on tightening the security for various servers (mainly Debian Linux), and one of the tasks is to tighten permissions on files in /var/log so that files are not world readable. But there ...
1
vote
0answers
392 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
1
vote
0answers
86 views

Windows Server 2012 - SSL Cypher Suite Order Not Long Enough

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => ...
1
vote
0answers
57 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...
1
vote
0answers
66 views

Ignoring auditing messages for particular PAM messages

I've got too many messages from PAM logging into audit.log, like this: type=USER_ACCT msg=audit(1378995943.792:867411): pid=4419 uid=0 auid=4294967295 ses=4294967295 ...
1
vote
0answers
35 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus ...
1
vote
0answers
49 views

Difference between “Security Configuration Manager” and “Security Configuration Wizard”

I want some clarifications about differences between SCW and SCM. strictly Speaking when I use SCM baseline for specific Server Role (domain controller, ftp server, ...), I get for example 200 gpo's ...
1
vote
0answers
53 views

Restrict users to certain applications only

We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us ...
1
vote
0answers
87 views

What's the meaning of “\x38\x01\x00\x00\x00\x00\x00\x00\x00” in openvpn connection using netcat?

I am testing my openvpn server by netcat, and I found this answer: How to check that an OpenVPN server is listening on a remote port without using OpenVPN client? by send a magic string ...
1
vote
0answers
207 views

Blue Coat - Blacklist list import

Is there a way to mass import domains into Blue Coat blacklist ? I get daily feeds from various sources and I was thinking whether I can modify the input file to a format to meet Blue coat ...
1
vote
0answers
236 views

Securing iis 8 nt permissions

I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible. I have moved the websites to "c:\sites\mysiteA\", ...
1
vote
0answers
144 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
435 views

security group not allowing connection to postgres ec2 aws

Hey im having some trouble allow remote connections to postgres from other ec2 instances using the named security group feature to rules. I have set the listens directive in postgres.conf to "*" and ...
1
vote
0answers
645 views

Disabling all write (cd burning) permissions for a specific group of users on all CD/DVD drives mounted in Windows XP Pro SP3

I want all users within 'Restricted' user group (Windows XP Professional SP3) to be able to read from CDs/DVDs they insert. I don't want these users to be able to burn any CDs/DVDs using CDRW/DVDRW ...
1
vote
0answers
239 views

disabling SSL / TLS Renegotiation on heroku

As the title sugests, is it possible to disable SSL / TLS Renegotiation when hosting a RoR application or Heroku? I ran the Nessus security tool on my website and the only serious warning showing up ...
1
vote
0answers
64 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
1
vote
0answers
467 views

Ubuntu 12.04 Server snort 2.9.2.3 not logging NMAP Scans after first VTR Rules update

I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file. Out of the box installation snort worked. ...
1
vote
0answers
102 views

How to secure tomcat manager for multiple instances

I have multiple instances of Tomcat setup using the CATALINA_BASE method. I need to enable the tomcat manager application for each of them, and to secure them all separately based on groups of users. ...
1
vote
0answers
652 views

Only allow domain logins using TeamViewer

TLDR How do I setup TeamViewer to only allow logins that authenticate through Windows (domain controller), while disallowing any other login method? I recently started a system administrator job ...
1
vote
0answers
1k views

How to client authentication in SSL

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers ...
1
vote
0answers
61 views

SELinux - Prevent users in the user_t domain from creating sockets

I need untrusted users to execute Ruby and Python scripts via SSH on a Fedora 17 machine with a minimal impact on system integrity and security. A SSH wrapper will ensure only Ruby and Python ...