The web-security tag has no wiki summary.
0
votes
0answers
7 views
Disabling Server Header from Groupwise Mobility
My Groupwise Mobility server application sends a server header with name and version. Is there a configuration possibility so I can disable it somehow? I couldn't find anything helpful so far.
-6
votes
2answers
53 views
Secure authentication as protection against rogue instructions and theft of hardware, would this scenario work? [closed]
I want to find a way for client machines to authenticate that they are talking to the correct server, not something hijacked, or just the wrong product server. I was thinking the client could send its ...
0
votes
1answer
38 views
How to block an IP, if it is making many http/apache/mysql requests in a second?
If some one tried force burst attack on my website, how can i block their IP address?
I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
0
votes
0answers
50 views
How to securely audit passwords using John the Ripper [migrated]
When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...
0
votes
1answer
49 views
Global Authority for Blacklisting IPs
I know that there are few common ways to block attacking IPs (such as deny in htaccess). Additional to that, we could get a huge list of IPs to block from misc sites such as :
...
0
votes
1answer
73 views
Security issue on Nginx, PHP & fastcgi_split_path_info
According to this post [1], it was said that if I am using PHP/Nginx, for better security, I should either
cgi.fix_pathinfo = 0
or
if ( $fastcgi_script_name ~ \..*\/.*php ) {
return 403;
}
In ...
-1
votes
1answer
39 views
Finding how the attacker creates malicious files [duplicate]
I am dealing with a troubling LAMP server which runs Apache 2.2, MySQL 5.1 and PHP 5.2.7 (runs as nobody) and most of its sites using vulnerable versions of known scripts such as Joomla, Wordpress ...
0
votes
1answer
46 views
Tomcat vulnerability patching
I had a tomcat vulnerability scan in my linux server and report came as Important: Authentication bypass and information disclosure (CVE-2011-3190) .My apache tomcat is of version 6.0.24.
tomcat ...
0
votes
2answers
92 views
Webhosting on virtual sever vs physical server: Security vulnerability
In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites?
For example, can the fact that there is not any hardware ...
1
vote
2answers
34 views
Checking for Joomla or wordpress sites needing updates
Is there any software that I can run on either a Linux or a Windows server to check for domains that have out dated WordPress installations. I have seen a rise in hacked sites and in all cases the ...
0
votes
1answer
34 views
handing out client certificates
I'm building a webapp and for the first time I need to look in to security, because some
actions should only be done by registered users.
of course these parts of the app operate trough https ...
1
vote
1answer
57 views
How to secure communications inside Azure? [closed]
I'm interested in knowing best practices for securing communications between a Linux VM and a Windows VM/Web Role.
So in the end, i need to communicate securely like so--
Linux VM < -- > Windows ...
0
votes
0answers
20 views
Better security: three layer application vs Apache ProxyPass
i had to configure an external (DMZ)apache with ProxiPass (mod_proxy) directive that points to an internal (LAN) web application that speaks with an internal db server.
The original project had to be ...
0
votes
0answers
44 views
Unable to set .ddl extension rules for IIS 7.5 (AppLocker)
The working environment
Windows Server 2008 R2
IIS 7.5 (With a website that runs on classical mode)
.NET 3.5
Certificate (Code signing certificate (to sign files)
What I am trying to achieve:
The ...
1
vote
2answers
212 views
Possible DNS hack or Unknown reason causing some users to redirect to a porn website?
I have website, which is a very popular website, but from last two weeks several customers complain to me that my site was hacked and redirected to a porn website,
but whenever i check the website i ...
1
vote
2answers
274 views
Should apache have write access to the web root? [duplicate]
Possible Duplicate:
What are the best linux permissions to use for my website?
I'm trying to get a canonical answer on how to set up permissions for apache vis-a-vis the web root ...
0
votes
1answer
367 views
How do I set up Tomcat 7's server.xml to access a network share with an different url?
I have Apache Tomcat 7.0 installed on a Windows 2008 R2 Server. Tomcat has access to a share '\server\share' that has a documents folder that I want to access using '/foo/Documents' in my web ...
0
votes
1answer
158 views
Fix Fatal Error Condition showing system path Magento get.php
I've noticed there are a large number of servers running Magento Commerce that will return a fatal error showing the system path:
Fatal error: Uncaught exception 'Exception' with message 'File ...
0
votes
1answer
63 views
How to connect to a SINGLE colocated server - is StrongSWAN sufficient?
I am thinking of colocating a SuperMicro 1022G-URF (16-way 1u server, 16 GB RAM) at a "place that does server colocation. I am running CentOS 6. The server will be a web server and an email server ...
1
vote
1answer
34 views
Protecting Python Data Apache2
i have a doubt about protection of Python Code. I'm not meaning just "Obfuscation", so, i've read a lot of topics about this subject, and i choose to put my application behind a web interface. So, ...
2
votes
2answers
288 views
Is it more secure to close port 80 to IIS?
Our software runs on 443 (https) on IIS and our network administrator insist on closing port 80 on the firewall. Port 80 would be used to redirect to 443.
The problem is that the users now need to ...
3
votes
1answer
200 views
Using nginx and Drupal, how do I serve a 404 error for static files and directories that exist?
I deploy a Drupal web site using git (well, OK, the developers deploy it; I try to keep them out of trouble), and for that reason the site has a directory .git and a file .gitignore in the document ...
0
votes
0answers
10 views
Malicious script in webroot folder [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My web server just recently got attacked. Basically someone managed to put a php script in the root folder and execute that to add ...
0
votes
2answers
81 views
Is there a way to disable certain cipher and protocols at openssl level?
At application level there is sometimes no (easy) way to, say, disable SSLv2 etc.
What about at openssl level (of course for applications that use the openssl shared libs) ?
0
votes
3answers
177 views
Designing a persistent asynchronous TCP protocol
I have got a collection of web sites that need to send time-sensitive messages to host machines all over my metro area, each on its own generally dynamic IP. Until now, I have been doing this the way ...
2
votes
1answer
73 views
why does adding a DNS root zone to the URL sometimes result in security errors?
Disclaimer: I've only witnessed this behaviour on chrome.
adding the rightmost dot to a URL as in facebook.com. should result in a fully qualified domain name (FQDN) and hence I wouldn't expect any ...
2
votes
2answers
161 views
WebDAV Security and Hardening
What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
19
votes
8answers
2k views
How to prevent zero day attacks
Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks.
Therefore, what can be done to prevent ...
3
votes
1answer
463 views
How to make TLS the preferred secure connection in IIS 7
I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
1
vote
1answer
248 views
Should Jetty always be behind another webserver (eg nginx, apache) to improve security?
For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have ...
2
votes
1answer
69 views
hosting people asking for my account username and password to enable curl and socket function only for me
I have hosted my site in a shared environment.
My hosting people disabled socket function all together.
and they said that we can enable only for you if i given a written statement.
I did but they ...
-2
votes
1answer
49 views
2
votes
1answer
81 views
What options exist to prevent Google Chrome Frame from rendering external URLs?
What options exist to prevent Google Chrome Frame (GCF) from rendering external URLs?
I'd like to deploy GCF within our organization to allow some intranet sites to use modern html features.
How can ...
0
votes
1answer
884 views
Is a local-only MAMP installation secure?
I just installed a basic MAMP server (on a Macbook Air 11" running OSX Lion) with no settings changed except for some php.ini things like "memory", "file_upload", etc that are more script related.
I ...
4
votes
2answers
268 views
Attack on my web server - What could this mean
My provider informed that there is an outbound attack on my web server. On further inspection I saw this in my Apache error.log file:
--2012-02-04 04:40:59-- ...
0
votes
1answer
153 views
Rule to block IP address not working
Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
1
vote
2answers
774 views
Is it possible to use IIS 7 Application Pool Identities on a 2008 Domain Controller
So, let me put the disclaimer in first: I wouldn't typically piggy-back IIS on a domain controller, but that's what I've got and I can't change that in this instance.
I've got a WCF web service I ...
1
vote
1answer
107 views
How to ensure my connection is secure to Google [closed]
Blogspot blogs are banned in Iran, they redirected to a page that says you can't access that site. But when I try to open a blog via HTTPS prefix I get this error:
This is certification detail:
...
0
votes
3answers
2k views
What are perfect unix permissions for usual web project directories?
What are the perfect minimal permissions in octal format for the followings in a web application written?
A directory where user uploaded static files (images/swf/js files) will reside
A directory ...
2
votes
1answer
164 views
How can I verify a client's identity using an SSL handshake to allow access to certain website pages?
I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL ...
0
votes
2answers
1k views
Securing Nginx proxy
I'm using Nginx as a proxy for a Java web service.
My config looks like this:
location /webservice {
proxy_read_timeout 240;
proxy_connect_timeout 240;
proxy_pass ...
0
votes
1answer
382 views
Managing user's roles in Glassfish
I'm developing a small web-application for study. I want to use controller servlet in order to redirect users' requests and control them. To do this I'm doing the following mapping in web.xml:
...
2
votes
2answers
543 views
Block IPs that try to exploit common webapp vulnerabilities
Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities?
I have an nginx web server that serves only static content. I routinely ...
7
votes
1answer
2k views
Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune
Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true?
I know that TLS 1.1 ...
1
vote
2answers
84 views
More safety than standard HTTPS settings [closed]
It maybe sounds strange, but if you can correct me and provide the right solution, please do it.
I heard that Ettercap can sniff HTTPS open encryption key and user's data. So, how to make server with ...
4
votes
3answers
841 views
SSL - should I just make my entire site secured?
I'm planning on building an application wherein my users can create accounts on it, email other users, etc. The site will also have forums, chat, etc. It will also need to process credit cards. I'm ...
-1
votes
1answer
548 views
Apache2 mod_security simple default deny rules for specific directory
How to configure the simplest useful default-deny rule set for mod_security?
I want to configure mod_security to allow only very specific queries to single directory:
In short: I use Apache as a ...
1
vote
1answer
53 views
Web Server security — webapp + website?
I am setting up a tiny, static website for a company. I am also building a rather complex and highly customized webapp for this same company. The webapp will only be used by the staff of the company ...
4
votes
2answers
314 views
How to secure your Linux server from pass-the-hash attacks
I was just reading this article: http://www.infoworld.com/d/security/stop-pass-the-hash-attacks-they-begin-167997?page=0,2&source=IFWNLE_nlt_daily_2011-07-26
He talks about pass-the-hash attacks ...
0
votes
1answer
94 views
Security & Malware Protection for Windows 2008 Server (with RDP)
I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
