The tag has no wiki summary.

learn more… | top users | synonyms (1)

1
vote
1answer
436 views

Should Jetty always be behind another webserver (eg nginx, apache) to improve security?

For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have ...
2
votes
1answer
69 views

hosting people asking for my account username and password to enable curl and socket function only for me

I have hosted my site in a shared environment. My hosting people disabled socket function all together. and they said that we can enable only for you if i given a written statement. I did but they ...
-2
votes
1answer
50 views

How do I respond to a buffer/stack overflow [closed]

How do I respond to a stack/buffer overflow
2
votes
1answer
120 views

What options exist to prevent Google Chrome Frame from rendering external URLs?

What options exist to prevent Google Chrome Frame (GCF) from rendering external URLs? I'd like to deploy GCF within our organization to allow some intranet sites to use modern html features. How can ...
0
votes
1answer
2k views

Is a local-only MAMP installation secure?

I just installed a basic MAMP server (on a Macbook Air 11" running OSX Lion) with no settings changed except for some php.ini things like "memory", "file_upload", etc that are more script related. I ...
4
votes
2answers
306 views

Attack on my web server - What could this mean

My provider informed that there is an outbound attack on my web server. On further inspection I saw this in my Apache error.log file: --2012-02-04 04:40:59-- ...
0
votes
1answer
181 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
1
vote
2answers
2k views

Is it possible to use IIS 7 Application Pool Identities on a 2008 Domain Controller

So, let me put the disclaimer in first: I wouldn't typically piggy-back IIS on a domain controller, but that's what I've got and I can't change that in this instance. I've got a WCF web service I ...
1
vote
1answer
112 views

How to ensure my connection is secure to Google [closed]

Blogspot blogs are banned in Iran, they redirected to a page that says you can't access that site. But when I try to open a blog via HTTPS prefix I get this error: This is certification detail: ...
1
vote
3answers
5k views

What are perfect unix permissions for usual web project directories?

What are the perfect minimal permissions in octal format for the followings in a web application written? A directory where user uploaded static files (images/swf/js files) will reside A directory ...
2
votes
1answer
213 views

How can I verify a client's identity using an SSL handshake to allow access to certain website pages?

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL ...
0
votes
2answers
2k views

Securing Nginx proxy

I'm using Nginx as a proxy for a Java web service. My config looks like this: location /webservice { proxy_read_timeout 240; proxy_connect_timeout 240; proxy_pass ...
0
votes
1answer
501 views

Managing user's roles in Glassfish

I'm developing a small web-application for study. I want to use controller servlet in order to redirect users' requests and control them. To do this I'm doing the following mapping in web.xml: ...
2
votes
2answers
809 views

Block IPs that try to exploit common webapp vulnerabilities

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities? I have an nginx web server that serves only static content. I routinely ...
7
votes
1answer
2k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
1
vote
2answers
88 views

More safety than standard HTTPS settings [closed]

It maybe sounds strange, but if you can correct me and provide the right solution, please do it. I heard that Ettercap can sniff HTTPS open encryption key and user's data. So, how to make server with ...
4
votes
3answers
1k views

SSL - should I just make my entire site secured?

I'm planning on building an application wherein my users can create accounts on it, email other users, etc. The site will also have forums, chat, etc. It will also need to process credit cards. I'm ...
-1
votes
1answer
772 views

Apache2 mod_security simple default deny rules for specific directory

How to configure the simplest useful default-deny rule set for mod_security? I want to configure mod_security to allow only very specific queries to single directory: In short: I use Apache as a ...
1
vote
1answer
55 views

Web Server security — webapp + website?

I am setting up a tiny, static website for a company. I am also building a rather complex and highly customized webapp for this same company. The webapp will only be used by the staff of the company ...
4
votes
2answers
566 views

How to secure your Linux server from pass-the-hash attacks

I was just reading this article: http://www.infoworld.com/d/security/stop-pass-the-hash-attacks-they-begin-167997?page=0,2&source=IFWNLE_nlt_daily_2011-07-26 He talks about pass-the-hash attacks ...
0
votes
1answer
111 views

Security & Malware Protection for Windows 2008 Server (with RDP)

I am running an ASP.NET site on a windows 2008 server with RDP access to the server. Installing or enabling firewalls shuts off my RDP access and multiple other issues. My hosting provider is very ...
4
votes
2answers
230 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
1
vote
1answer
191 views

Is it possible to capture traffic to the remote web server

I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark POST /***URL*** HTTP/1.1 Host: ***DNS NAME*** ...
0
votes
1answer
803 views

IIS 7.x client certificate mapping to ApplicationPoolIdentity

In IIS 6 I was able to use the following technique: Turn on requirement for client certificates Using adsutil.vbs figure out what IUSR_Server user password is Create a one-to-one mapping of the ...
0
votes
2answers
464 views

Allow php and python script with apache but still have a secure server

problem "solved"? after backtracking where the permission first stops, the permission denial suddenly went away for no reason. I am building a webpage where the user must have the possibility to send ...
0
votes
3answers
311 views

What should I do to increase security on my server

I have recently purchase VPS2 package from knownhost. I created support ticket with authentic information of the account too for setting up the server and fixing some issues. I have been long with it, ...
1
vote
4answers
140 views

Do I need a hardware firewall for Win 2003?

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to ...
0
votes
1answer
64 views

Recover Index File + Overwrite or Hacked by SomeOne + Linux Server

Some body overwrites my index file of every folder at linux server. Is it possible to recover all the files from server to make website in running state.
2
votes
2answers
294 views

SQL Server Windows-only Authentication Strategy problem

I would like to use Windows-only Authentication in SQL Server for our web applications. In the past we've always created the all powerful 1 SQL Login for the web application. After doing some ...
9
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
1
vote
3answers
431 views

How to secure a server physically and the software?

We are creating a web application that will be installed on a server and sold to a client, similar to a Google Mini Search appliance. We are looking at various ways to secure the server from being ...
13
votes
12answers
570 views

An honest security ethics nondisclosure question I need help with

Three years ago I did a security audit for a large ecommerce website. When the audit was performed, I found several severe security issues that allow for access to data that should not be accessible ...
21
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
0
votes
1answer
60 views

Wondering about Acunetix

Does anyone have experience using Acunetix? Is it possible to . . . scan/probe all the web sites one has open in tabs in a browser? (I know there is a Firefox add-in, but I'm not familiar with what ...