Security is not a product, but a process.

learn more… | top users | synonyms (2)

296
votes
12answers
51k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
261
votes
21answers
48k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
241
votes
3answers
238k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I'm pretty much a n00b at system administration and I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I google for tutorials and beat ...
170
votes
9answers
26k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
83
votes
6answers
25k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
79
votes
7answers
18k views

How does CTRL-ALT-DEL to log in make Windows more secure?

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination ...
78
votes
1answer
3k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
73
votes
16answers
8k views

How do I protect my company from my IT guy? [closed]

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT. Of course, I'll interview carefully, check references, and run a ...
72
votes
4answers
42k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
72
votes
7answers
25k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
69
votes
19answers
14k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
58
votes
5answers
7k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
57
votes
13answers
27k views

What steps do you take to secure a Debian server?

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
55
votes
8answers
62k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
54
votes
6answers
11k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
47
votes
15answers
7k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard ...
47
votes
2answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
44
votes
40answers
4k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
44
votes
8answers
3k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
43
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
41
votes
19answers
2k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
40
votes
11answers
5k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
40
votes
6answers
3k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
38
votes
15answers
4k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...
35
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
35
votes
3answers
5k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
34
votes
9answers
8k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
34
votes
10answers
12k views

Securing a fresh Ubuntu server [closed]

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
34
votes
12answers
8k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
34
votes
11answers
2k views

Got Hacked. Want to understand how

Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over. The ...
32
votes
5answers
23k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
32
votes
5answers
2k views

Will everyone having Globally Accessible IP's in IPv6 be kind of a security nightmare? [duplicate]

Possible Duplicate: Switch to IPv6 and get rid of NAT? Are you kidding? I'm thinking about the way that in IPv4 most of the time you have a single point to configure a firewall on, mainly ...
31
votes
6answers
3k views

Is it safe for a production server to have make installed?

During the setup of my virtual server instances I require some applications to be built using make. Are there any security risks associated with having make installed? Or should I clean it up before ...
30
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
30
votes
6answers
18k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
29
votes
8answers
12k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
29
votes
4answers
59k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
29
votes
3answers
18k views

What's best practice for communication between Amazon EC2 instances?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far: Web Server -- Apache Database Server ...
28
votes
3answers
2k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
28
votes
4answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
28
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
28
votes
8answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
27
votes
5answers
2k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
27
votes
8answers
3k views

What are best practices for managing SSH keys in a team?

I work with small teams (<10) of developers and admins with the following characteristics: Most members of the team have >1 personal computer, most of which are portable Team members have access ...
26
votes
8answers
1k views

Is there a danger in fake OpenID providers?

I've been wondering. Since anybody can start an OpenID provider, and since there is no central authority that approves OpenID providers, why won't fake OpenID providers become a problem? For example, ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
25
votes
9answers
2k views

Is packet sniffing for passwords on a fully switched network really a concern?

I administer a number of linux servers that require telnet access for users. Currently the user's credentials are stored locally on each server and the passwords tend to be very weak and there is no ...
25
votes
5answers
5k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
25
votes
7answers
3k views

MITM attacks - how likely are they?

How likely are "Man in the Middle" attacks in internet security? What actual machines, apart from ISP servers, are going to be "in the middle" of internet communications? What are the actual risks ...
25
votes
8answers
17k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...