Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
0answers
91 views

How well does haproxy scale for handling client certificate authentication?

As this is a performance-based question about a security issue, some folks at Information Security suggested I post here: My IoT company would like to use client certificate authentication to secure ...
3
votes
0answers
30 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
2
votes
0answers
40 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 ...
2
votes
0answers
15 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
2
votes
0answers
27 views

Protect cached content in apache

I'm facing an issue where I have some cached contents in a disk and I want to protect it with a token url. I can protect my files via htaccess, once they are not cached (direct access), but now I ...
2
votes
0answers
32 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
2
votes
0answers
39 views

Securing config file containing plain-text passwords only with file-system permissions?

I have read a lot of posts and questions about the safest way to secure your server configuration files, which contain sensitive information, such as passwords. The 3 main recommendations I have found ...
2
votes
0answers
33 views

Forced to change expired password when using ssh key

I am working in an environment where I have an account on multiple linux machines where accounts and passwords are managed independently (no active directory/LDAP/etc) and passwords expire every 30 ...
2
votes
0answers
155 views

Spring Shiro is not authenticating login screen in SpringMVC web application

I am trying to use Apache Shiro framework 1.2.4 for security requirements of our Spring MVC web application. I have included configuration details in the application context, pom.xml and web.xml ...
2
votes
0answers
49 views

Certificate can only be used by network service account

Issues : Our service is using one certification for partner service call. It worked well in IIS site which is running as network service account. But when we run test the code as administrator ...
2
votes
0answers
383 views

Display port security state of an HP 3COM 5120 switch port

I'm using an HP-A5120-24G-SI switch and I'm asking how to obtain the current state of the port-security module for a certain port. I'm able to view the current settings using display port-security ...
2
votes
0answers
128 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
407 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
2
votes
0answers
227 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
2
votes
0answers
154 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
2
votes
0answers
403 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
2
votes
0answers
1k views

Audit access to USB drives

Is there a way to audit access to USB drives with built-in windows logging? We already do GP based auditing on our server's NTFS file system, but how do we extend that to workstations? There are no ...
2
votes
0answers
16 views

How are redirects to a special page explaining page moves a security Hole

I've been hearing at work that once we move our web platform, that unhanded redirects that could go to a spcial page telling the user where their requested page has moved to would present a security ...
2
votes
0answers
53 views

Is it possible to enable WLM for Stored Procedures through DB2 on z/OS

If core WLM is not available for all built-in Stored Procedures in a DB2 on z/OS, would it be at all possible for a DB2 user with all privileges to setup the core WLM environments through a CLPPlus ...
2
votes
0answers
8k views

OpenVPN daemon fails to start — starting server manually returns no output

I am setting up an openvpn server on my network for the purposes of accessing devices remotely. I have generated crts and keys with the easy-rsa scripts and have configured server.conf correctly ...
2
votes
0answers
619 views

Restricting access through ODBC to only schema views SQL 2008

I'm pretty green to SQL security, so maybe someone can help me. We've got a database application that, when installed, by default grants the public role access to all the tables in the database. When ...
2
votes
0answers
335 views

Cross Domain access of self hosted WCF services?

I have developed a WPF application which communicates with a set of self hosted WCF services which are under same domain and I use the following setup in the config files. <security ...
2
votes
0answers
132 views

Can encryption be disabled for the login handshake in SQL Server 2005 or 2008

When a client Application connects to SQL Server the login credentials are sent over the network in a TLS Encrypted Handshake Message. For testing purposes I would like to have the login credentials ...
1
vote
0answers
15 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
0answers
21 views

How I can look from that script runs sendmail?

my problem is that some script in php or some other script or program is sending spam. I am not able to trace where this program runs. do the following: ps aux | grep sendmail nginx 28286 0.0 ...
1
vote
0answers
15 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
44 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN ...
1
vote
0answers
35 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...
1
vote
0answers
75 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
1
vote
0answers
22 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
1
vote
0answers
40 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
0answers
36 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
1
vote
0answers
46 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
1
vote
0answers
22 views

How to protect nginx proxy from being spoofed by other reverse proxies?

I've recently noticed that one of my sites that's running behind nginx proxy became accessible via bunch of random domains. Some of them are proxies generated by sites like http://unblocksit.es and ...
1
vote
0answers
17 views

Directly accessing files through reverse proxy

With my web app I've got to provide files to third party apis that unfortunately only accept file names. The files can be located anywhere, local or on network shares. The files are actually stored on ...
1
vote
0answers
88 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
1
vote
0answers
88 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
1
vote
0answers
66 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
1
vote
0answers
21 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
1
vote
0answers
11 views

Securing APIs with oAuth

I've been reading up on oAuth the last few days but there is one thing that is not totally clear to me. So I've got this oAuth Authorization Server which (skipping a few steps in between here) in the ...
1
vote
0answers
23 views

Allow log on locally custom message

I recently moved into a new position and we have a few computer labs that are currently restricting access by running a script on logon that checks the user's group membership and if not in the ...
1
vote
0answers
36 views

Best practices / settings to create “Read-Only” Admin role for auditors and similar

I am trying very diligently to remove as many over-privileged accounts/roles in our Active Directory and Windows (server and desktop) environment. This means retiring as many users as possible from ...
1
vote
0answers
16 views

Should each task/process/role run as its own user on a Windows server?

I know that on Linux servers, it's widely considered best practice to run each task/role/process/server/program as its own user and usually in its own group. How should separate tasks be handled on a ...
1
vote
0answers
60 views

any problems with UseLogin yes? /(workaround on no system information safe?)

this is about the system information, shown to the user after login on an ubuntu-server. by default, an ubuntu-server is showing you system information, when logging in, such as the servers ...
1
vote
0answers
174 views

Haproxy disable Secure Renegotiation

I want to disable secure renegotiation in HAproxy-1.5.2, but can not find anything about it on the official documentation: http://www.haproxy.org/download/1.5/doc/configuration.txt My SSL HAproxy ...
1
vote
0answers
61 views

Encrypt credentials JNDI authenticating to JBoss 7.1.1.Final

In my JNDI Lookup, connecting to JBoss 7.1.1.Final from remote clients with plain text password is working fine. Now, I am trying to encrypt credentials in the form, but it's not working. ...
1
vote
0answers
257 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
1
vote
0answers
59 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
1
vote
0answers
148 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
0answers
83 views

iis 7.5 ipSecurity denyAction=NotFound causes 500 error instead of 404

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config: <ipSecurity allowUnlisted="false"> <add ...