The tag has no wiki summary.

learn more… | top users | synonyms (1)

1
vote
3answers
147 views

Why do we really need apache + php if php can run as web server?

A few months ago i did an experiment that kinda went out very well, today we have an intranet portal using the following technologies: JeasyUI phpgrid Kibana So, based on our tests why do we need ...
1
vote
0answers
50 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
0
votes
1answer
41 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
6
votes
3answers
496 views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
0
votes
0answers
76 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
0
votes
0answers
126 views

How vulnerabilities in the Java affects application running in Tomcat/JBoss

I wonder what impact has Java vulnerabilities on application in Tomcat. For example Java 1.6u45 has many reported security bugs (Remote Security Vulnerability). You can easily exploit it on client ...
0
votes
1answer
69 views

Protect public directories from download via wget and curl

My users upload their profile images and I save them in a public folder. The file names are not predictable (they are based on md5 hash of user id with salt). When someone views the user's profile, ...
12
votes
1answer
3k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
1
vote
2answers
117 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user1000 to execute any shell (php, pl, exe). The shells ...
0
votes
0answers
103 views

Lighttpd reverse proxy authentication

I have configured lighttpd as a reverse proxy to an internal webserver (wthttpd) on the same device. However I need to authenticate users first using php. The content served will be non-static, ...
1
vote
2answers
447 views

Google searches in my apache access logs?

I'm quite familiar with the idea that of bots are probing my server for vulnerabilities, but today when I checked my access logs, I noticed a bunch of google searches appearing in the logs. What ...
2
votes
4answers
160 views

Apache Security Config - Ubuntu 12

I am running a LAMP stack on Ubuntu 12, with the primary function to serve a PHP based API. There is only one file I want to be exposed to the public called: api.php It needs to reference a config ...
1
vote
2answers
619 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
2
votes
1answer
39 views

SSLv2 in IIS 7.5?

Just found that SSLv2 is enabled in IIS 7.5 by default and to change it requires tweaking in registry. What is the design decision for it? Is there a disadvantage of disabling it?
0
votes
0answers
184 views

ADFS Transform Claim Rule in Claims Provider Trust

I have an ADFS 2.0 server acting as a Federation gateway (SP-STS) between my claims aware web application and an external identity server (IP-STS). I have: A Claims Provider Trust (CPT) set up with ...
0
votes
2answers
2k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
0
votes
0answers
18 views

Securely separated sites on Mac OS X as webserver

I suddenly inherited Mac OS X MiniServer with AMPPS on it. It used to be a development server, switched to a production role. So I created MySQL users for each site with this site's DB access only, ...
5
votes
1answer
541 views

`ps` and `bin/bash su` in ps aux output

I have a shared server (amazon ec2 micro powered by bitnami) with a web application (Wordpress), which is showing low performance lately (with relatively stable traffic and usage). The only suspitious ...
1
vote
2answers
452 views

Locating Rogue Perl Script

I've been trying to source the location of a perl script which is causing havoc on a server which I control. I'm also trying to find out exactly how this script was installed on the server - my best ...
2
votes
1answer
143 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
0
votes
2answers
1k views

how to enable TLSv1.1 and TLSv1.2 on nginx Debian squeeze?

For security I have to setup a nginx server with TLSv1.1 or TLS v1.2. By default, nginx configuresTLSv1. Reading the documentation I see that nginx has to set the following directive: ssl_protocols ...
0
votes
2answers
177 views

How can we restrict access to a web service to specific client computers?

We have a web application (Apache/PHP) that currently uses username/password authentication and is currently accessible from anywhere. It has server-side SSL enabled. Our client program is a version ...
-1
votes
1answer
168 views

You don't have permission to access /on this server

I created a form in joomla with 2000 fields but when I submit the form it gives me: error-- You don't have permission to access /en/soccer-player-update on this server. Additionally, a 404 Not Found ...
0
votes
1answer
830 views

How can I setup an IP whitelist for a subdirectory?

A client of mine complained of an attack. I checked the access log and found a massive number of requests for the admin login page from seemingly random IP addresses. I created an .htacces file in the ...
-1
votes
1answer
74 views

Is it possibel to get that “Padlock” symbol in the address bar for a localhost https connection that uses a self signed certificate? [closed]

I am currently implemented SSL for my Web App in tomcat using a self signed certificate using java Keystore tool. I am using the web app in my machine as localhost. When I visit the url ...
0
votes
1answer
109 views

file permissions for scripts that need write access

This question helped me quite a bit: What's the best way of handling permissions for apache2's user www-data in /var/www? I would like to take the above question further, I want to be able ...
0
votes
1answer
71 views

Securing nginx (user/file permissions)?

I'm just setting up nginx on my web server, and I created a user account for it to use (nginx). However, it runs its worker processes by default as www-data. Is there any disadvantage to using ...
-6
votes
2answers
116 views

Authentication of both client and server in subscription based model [closed]

My current business model takes a loss upfront on hardware in the hopes that the service will be paid for continuously. When service is not paid for the instructions are sent to the client hardware to ...
0
votes
1answer
241 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
0
votes
1answer
118 views

Global Authority for Blacklisting IPs

I know that there are few common ways to block attacking IPs (such as deny in htaccess). Additional to that, we could get a huge list of IPs to block from misc sites such as : ...
2
votes
1answer
1k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
-1
votes
1answer
55 views

Finding how the attacker creates malicious files [duplicate]

I am dealing with a troubling LAMP server which runs Apache 2.2, MySQL 5.1 and PHP 5.2.7 (runs as nobody) and most of its sites using vulnerable versions of known scripts such as Joomla, Wordpress ...
0
votes
1answer
93 views

Tomcat vulnerability patching

I had a tomcat vulnerability scan in my linux server and report came as Important: Authentication bypass and information disclosure (CVE-2011-3190) .My apache tomcat is of version 6.0.24. tomcat ...
0
votes
2answers
201 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...
1
vote
2answers
98 views

Checking for Joomla or wordpress sites needing updates

Is there any software that I can run on either a Linux or a Windows server to check for domains that have out dated WordPress installations. I have seen a rise in hacked sites and in all cases the ...
0
votes
1answer
49 views

handing out client certificates

I'm building a webapp and for the first time I need to look in to security, because some actions should only be done by registered users. of course these parts of the app operate trough https ...
1
vote
1answer
101 views

How to secure communications inside Azure? [closed]

I'm interested in knowing best practices for securing communications between a Linux VM and a Windows VM/Web Role. So in the end, i need to communicate securely like so-- Linux VM < -- > Windows ...
1
vote
3answers
396 views

Possible DNS hack or Unknown reason causing some users to redirect to a porn website?

I have website, which is a very popular website, but from last two weeks several customers complain to me that my site was hacked and redirected to a porn website, but whenever i check the website i ...
1
vote
2answers
870 views

Should apache have write access to the web root? [duplicate]

Possible Duplicate: What are the best linux permissions to use for my website? I'm trying to get a canonical answer on how to set up permissions for apache vis-a-vis the web root ...
0
votes
1answer
865 views

How do I set up Tomcat 7's server.xml to access a network share with an different url?

I have Apache Tomcat 7.0 installed on a Windows 2008 R2 Server. Tomcat has access to a share '\server\share' that has a documents folder that I want to access using '/foo/Documents' in my web ...
0
votes
1answer
497 views

Fix Fatal Error Condition showing system path Magento get.php

I've noticed there are a large number of servers running Magento Commerce that will return a fatal error showing the system path: Fatal error: Uncaught exception 'Exception' with message 'File ...
0
votes
1answer
101 views

How to connect to a SINGLE colocated server - is StrongSWAN sufficient?

I am thinking of colocating a SuperMicro 1022G-URF (16-way 1u server, 16 GB RAM) at a "place that does server colocation. I am running CentOS 6. The server will be a web server and an email server ...
1
vote
1answer
45 views

Protecting Python Data Apache2

i have a doubt about protection of Python Code. I'm not meaning just "Obfuscation", so, i've read a lot of topics about this subject, and i choose to put my application behind a web interface. So, ...
2
votes
2answers
715 views

Is it more secure to close port 80 to IIS?

Our software runs on 443 (https) on IIS and our network administrator insist on closing port 80 on the firewall. Port 80 would be used to redirect to 443. The problem is that the users now need to ...
3
votes
1answer
406 views

Using nginx and Drupal, how do I serve a 404 error for static files and directories that exist?

I deploy a Drupal web site using git (well, OK, the developers deploy it; I try to keep them out of trouble), and for that reason the site has a directory .git and a file .gitignore in the document ...
0
votes
2answers
161 views

Is there a way to disable certain cipher and protocols at openssl level?

At application level there is sometimes no (easy) way to, say, disable SSLv2 etc. What about at openssl level (of course for applications that use the openssl shared libs) ?
2
votes
3answers
277 views

Designing a persistent asynchronous TCP protocol

I have got a collection of web sites that need to send time-sensitive messages to host machines all over my metro area, each on its own generally dynamic IP. Until now, I have been doing this the way ...
2
votes
1answer
81 views

why does adding a DNS root zone to the URL sometimes result in security errors?

Disclaimer: I've only witnessed this behaviour on chrome. adding the rightmost dot to a URL as in facebook.com. should result in a fully qualified domain name (FQDN) and hence I wouldn't expect any ...
2
votes
2answers
259 views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
19
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...