Security is not a product, but a process.

learn more… | top users | synonyms (1)

350
votes
13answers
64k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
281
votes
21answers
50k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
177
votes
9answers
28k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
117
votes
4answers
106k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. ...
93
votes
1answer
7k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
90
votes
7answers
22k views

How does CTRL-ALT-DEL to log in make Windows more secure?

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination ...
89
votes
6answers
28k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
76
votes
8answers
35k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
73
votes
19answers
15k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
68
votes
6answers
49k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
65
votes
5answers
10k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
63
votes
9answers
73k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
54
votes
6answers
12k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
53
votes
15answers
8k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard ...
51
votes
2answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
47
votes
8answers
4k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
46
votes
11answers
7k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
46
votes
40answers
5k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
46
votes
5answers
39k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
46
votes
6answers
4k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
44
votes
19answers
3k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
44
votes
8answers
4k views

Is it OK to set up passwordless `sudo` on a cloud server?

Sorry if the question is vague but I don't know a better way to ask and I didn't see the caveats/tradeoffs of the approach discussed here. I love the idea of accessing servers via keys, so that I ...
42
votes
3answers
12k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
39
votes
15answers
5k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...
39
votes
10answers
10k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
38
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
37
votes
6answers
23k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
35
votes
10answers
13k views

Securing a fresh Ubuntu server [closed]

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
35
votes
12answers
8k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
35
votes
5answers
81k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
35
votes
11answers
2k views

Got Hacked. Want to understand how

Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over. The ...
34
votes
9answers
17k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
34
votes
6answers
3k views

Is it safe for a production server to have make installed?

During the setup of my virtual server instances I require some applications to be built using make. Are there any security risks associated with having make installed? Or should I clean it up before ...
34
votes
8answers
55k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
32
votes
5answers
2k views

Will everyone having Globally Accessible IP's in IPv6 be kind of a security nightmare? [duplicate]

Possible Duplicate: Switch to IPv6 and get rid of NAT? Are you kidding? I'm thinking about the way that in IPv4 most of the time you have a single point to configure a firewall on, mainly ...
32
votes
3answers
2k views

What kind of network attack turns a switch into a hub?

I read an article today describing how a penetration tester was able to demonstrate creating a fake bank account with a $14 million balance. However, one paragraph describing the attack stood out: ...
32
votes
3answers
4k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
31
votes
3answers
22k views

What's best practice for communication between Amazon EC2 instances?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far: Web Server -- Apache Database Server ...
30
votes
4answers
20k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
30
votes
8answers
4k views

What are best practices for managing SSH keys in a team?

I work with small teams (<10) of developers and admins with the following characteristics: Most members of the team have >1 personal computer, most of which are portable Team members have access ...
30
votes
5answers
23k views

What are the exact protocol level differences between SSL and TLS?

This is a technical deep dive after this overview question was asked. What are the protocol differences between SSL and TLS? Is there really enough of a difference to warrant a name change? (versus ...
29
votes
7answers
7k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
29
votes
3answers
3k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
29
votes
4answers
4k views

Are self-signed SSL certificates secure?

I want to have a secure connection, when I log into my webmail, phpMyAdmin, etc. Therefore I signed my own SSL certificates with OpenSSL and told Apache to listen on port 443. Is this in fact ...
29
votes
5answers
2k views

Is a Self Signed SSL Certificate a False Sense of Security?

Is a Self Signed SSL certificate a false sense of security? If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
29
votes
22answers
2k views

Password best practices

Given the recent events with a 'hacker' learning and retrying passwords from website administrators, what can we suggest to everyone about best practices when it comes to passwords? use unique ...
29
votes
4answers
7k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
29
votes
5answers
2k views

Linux hardening - web servers

What are your checklist/routine when setting up a Linux web server? What do you recommend to achieve maximum security? Is there any preferred way to perform repeated maintenance?
29
votes
4answers
14k views

How useful is mounting /tmp noexec?

Many people (including the Securing Debian Manual) recommend mounting /tmp with the noexec,nodev,nosuid set of options. This is generally presented as one element of a 'defense-in-depth' strategy, by ...