Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
0answers
2 views

limit sites permissions on server

I am hosting multiple PHP sites on my linux server with LAMP, I want to restrict each sites' permissions not to modify any file outside site folder directory, like most shared hosting companies do, do ...
1
vote
2answers
23 views

safety of sshpass and sftp to dynamic host

I have a server with dedicated IP address A and a server with dynamic IP address B (routing via no-ip.org). A uploads a backup to B via sshpass: export SSHPASS=*** sshpass -e sftp **@** << ! ...
0
votes
0answers
3 views

Create a persistent mapping for a apppool identity

Can I create a persistent mapping for a apppool identity? For instance the IIS website "www.example.net" should access "\10.10.10.222\shared$" through F: My Website is MVC(5) so I think the ...
0
votes
0answers
14 views

How do I block all requests by default in vhost configuration?

I am setting up a site using standard apache vhost but I have multiple domains pointed at the server. I know the first vhost catches all the other names even if they are not listed under the vhost. ...
-1
votes
1answer
30 views

Check my own servers for vulnerabilities

We are a small early stage startup with not so much money to spend. We have less than 3 servers that we want to monitor for security issues. Our website is essentially on one server having: Ubuntu ...
0
votes
1answer
22 views

Enabling cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) on Windows Server 2003+ISA 2006

I have been given a task to disable all "weak" ciphers/protocols on our very old ISA server based on Windows Server 2003. I have disabled all protocols but TLS1.0, and all ciphers but RC2/128, RC4/128 ...
0
votes
1answer
14 views

How can I know where and how a security group is triggering a logon script for some users?

The organization I work for has implemented application access and scripts via Security Groups. This is, if a person needs to access some applications or have a script run when he logs on, we add ...
0
votes
1answer
37 views

Can I block inbound traffic from a certain ISP

The problem My server keeps getting DDoS attacks from IP's belonging to Ecatel in The Netherlands. I wrote them a month ago and still haven't heard anything, and keep blocking individual IP addresses ...
0
votes
1answer
24 views

Google Authenticator - generate new set of emergency codes

I use Google Authenticator on my SSH servers with Andoid app for generating codes. After I run $ google-authenticator application create set of emergyncy keys: ...
0
votes
0answers
37 views

Most secure reboot-to-restore solution? [on hold]

We have a few computers running Windows 7 that we need to lock down and so I have been doing some research on reboot-to-restore solutions. Here is what I've found out: Deep Freeze: "Deep Freeze is a ...
-2
votes
0answers
27 views

Questions about Homemade FTP Server [closed]

Im trying to make a secure FTP server on my house , I dont have enough knowledge to use unix distro like Debian/Ubuntu Server , so Im using Filezilla Server on Windows 8.1 right now (only for testing) ...
1
vote
2answers
366 views

POODLE: SSLv3 vulnerability (CVE-2014-3566) with Apache24 on FreeBSD-9.2

I'm using FreeBSD 9.2-RELEASE-p5 with apache24-2.4.10_2 package. According to CVE-2014-3566 (POODLE), I went ahead and disabled SSLProtocol -SSLv3 following by restart of apache24 service, yet after ...
-1
votes
0answers
9 views

Node.js vs Apache for a minimal server [closed]

I'm setting up a tiny, low-volume passthrough server to tie a couple of our company's internal APIs together. I want to stick with what I know, as far as technologies, so my main options are Apache or ...
0
votes
0answers
9 views

Apache HTTP server STIG rule

I am new to setting up Apache HTTP and have to STIG the Apache HTTP 2.2 I have running. (http://iase.disa.mil/stigs/app-security/web-servers/Pages/index.aspx). For one of the rules it says the ...
0
votes
0answers
7 views

Recomendation for server watchdog [closed]

I have an executable on a windows 8 machine, that I'd like to keep running. The problem is, the guy I share my dorm room (and said machine) with keeps shutting it off. Is there a watchdog application ...
-2
votes
1answer
45 views

How can I check if my server is using ssl 3? [duplicate]

How can I check if my server is using ssl 3? When I run openssl version command I get this. OpenSSL 1.0.1 14 Mar 2012 Thanks.
0
votes
0answers
39 views

Post wp-login.php flood [duplicate]

my wordpress website is very slow and i'm getting thousand of line like this in access.log of apache : 127.0.0.1 - - [15/Oct/2014:12:43:31 +0200] "POST /wp-login.php HTTP/1.0" 200 5297 "-" "-" ...
-2
votes
0answers
38 views

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption ) vulnerability in Apache 2.4.7 [duplicate]

how to find Poodle (Padding Oracle On Downloaded Legacy Encryption) vulnerability in Apache 2.4.7 and solution to fix the issue. when I use openssl how can find.
10
votes
2answers
3k views

How can I tell if my website is vulnerable to CVE-2014-3566 (POODLE)?

Google announced a vulnerability in the SSLv3 protocol that ... allows the plaintext of secure connections to be calculated by a network attacker. This vulnerability has been given the ...
0
votes
1answer
34 views

Cloud email security setup over single IP [closed]

I want to set up a cloud email security service for my clients. The one problem I am stuck on is how I would do the routing once it hits our location. Say we have two MX records: site.com. 14400 IN MX ...
0
votes
1answer
58 views

Powershell script for specifically OU

Need help with hte following, a script that can export all members of a specifically OU with in that multiple security groups. Location of the OU is; OU=Security Groups,OU=Public ...
0
votes
1answer
40 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
0
votes
0answers
12 views

do automatic updates (unattended-upgrades) still work with third party repository?

If I install nginx from the nginx repository by appending the following to the end of the /etc/apt/sources.list file: deb http://nginx.org/packages/mainline/debian/ trusty nginx deb-src ...
0
votes
1answer
26 views

SSH Failed password login - log password

today I checked the log of my sshd and I have discovered tons of lines like :Oct 12 Oct 12 12:31:34 my_user sshd[15324]: Failed password for invalid user admin from 104.194.25.135 port 2683 ssh2 ...
0
votes
4answers
46 views

where should the site root directory be? [closed]

Where should I put my site root directory "my_site"? Any best practice? /var/www/my_site/ /var/local/sites/my_site/ /usr/share/wwww/my_site/ /usr/local/my_site/ /opt/my_site/ /srv/my_site/
0
votes
0answers
15 views

how to run a web app: users/groups to use for each component?

How do you organize your users/groups to run the different components of your web app? Any best practices? The answer of this question (What permissions should my website files/folders have on a ...
-3
votes
1answer
27 views

Secure SSH access [duplicate]

I am making a website and I am using a droplet made in digital ocean as my dev server. (No stg or prd yet) The problem is that I am using Dynamic IP and if I blocked access on port 22 to my current ...
5
votes
1answer
33 views

W2K8R2 - A way to convert effecitve Group Policy settings to import on stand-alone machines for local policy?

If I have a relatively robust domain environment (e.g. 20 Security related Group Policy Objects) applying to my servers as a baseline set of policy settings and I have a stand-alone server that I want ...
0
votes
1answer
23 views

OpenBSD chroot for nginx/Apache file permissions

I haven't been able to find a satisfying answer on Goole or the various Stack forums: I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions ...
0
votes
0answers
15 views

Check Unix Credentials on Apache Server Web App

I am building a number of web apps served by apache for internal use and I really want to have them use unix credentials for access. I know a few ways I could do this but all of them seems to expose ...
1
vote
1answer
28 views

Ways to follow newly discovered vulnerabilities?

I happened to be in a situation where I am in charge for 100+ systems on top of my job as a programmer. Everything we run is Linux (Debian, Ubuntu, Centos) and gladly our sysadmin set everything with ...
0
votes
1answer
53 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
0
votes
1answer
70 views

Http 1.1 protocol detected

I have a CentOS server and we had a Retina security scan. I have no idea how to fix this vulnerability. Can you point me in the right direction? We are running nginx.
2
votes
1answer
33 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
0
votes
0answers
9 views

Exposing pm.status_path [migrated]

Do you think it's dangerous to publicy expose PHP-FPM pm.status_path? It displays "Pool Status", "Active Processes status" and "Idle Processes status", showing Script path and Request URI.
-2
votes
0answers
42 views

Apache was hited from localhost at the time the server was under attack [duplicate]

I have reasons to conjecture that my server was under some kind of attack last week. (The webserver wasn't responding during the time I was teaching students of computer science at university.) I was ...
3
votes
3answers
612 views

How is a private data center more secure than a public cloud?

I have customers in the financial services industry that insist that a SaaS hosted on public clouds like Amazon's are not as secure as colocation in a private data center. However, I can't find ...
1
vote
1answer
79 views

Security risks of using Google DNS to resolve names on a private net (192.168.x.x)?

Are there any known risks associated with using a public DNS versus a DNS which we or our partners control? Our solution involves a few embedded devices so using Google DNS would give us a degree of ...
-2
votes
1answer
93 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
-1
votes
1answer
32 views

IIS 8.5 Securing FTP [on hold]

I have a IIS installation on Windows Server 2012 R2. I need to provide FTP access to a website. Its only one person. The easiest way to make it secure is to make an ip-restriction and only ...
0
votes
0answers
28 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
0
votes
1answer
36 views

“File not found” from bash script executed by Apache (CentOS)

I have a bash script that sets up a classpath for accessing a series of JARs (it's tf, the cross-platform, command line tool for Team Foundation Server). The file structure is something like: ...
1
vote
1answer
53 views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
2answers
42 views

Is PHP 5.3.3 on RHEL 6.5 receiving security fixes?

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check: $ php -v PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08) However, the PHP website claims that ...
1
vote
1answer
37 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
5
votes
1answer
2k views

Why are some CentOS 5 boxes still vulnerable to ShellShock after upgrading Bash?

I have two CentOS 5.10 boxen where I have upgraded bash to the latest version. However, in one of the boxes, bash is still vulnerable to CVE-2014-7169 (I am using the test from this ServerFault ...
3
votes
1answer
103 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
1
vote
1answer
33 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
150 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [closed]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
1
vote
1answer
43 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...