Tagged Questions
0
votes
1answer
17 views
What are the security implications of STARTING a reverse proxied origin server as an unprivileged user?
A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. ...
2
votes
2answers
426 views
How do I protect an Apache (in LAMP) install against the Apache Linux/Cdorked.A backdoor?
Just like the title asks, what can I do to protect against infection by the Apache Linux/Cdorked.A backdoor?
0
votes
1answer
45 views
Tomcat vulnerability patching
I had a tomcat vulnerability scan in my linux server and report came as Important: Authentication bypass and information disclosure (CVE-2011-3190) .My apache tomcat is of version 6.0.24.
tomcat ...
4
votes
1answer
51 views
What is this user name for and how did it get created?
When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose?
From what I have read the ApplicationPool runs under NetworkService ...
1
vote
1answer
76 views
Is opening port 80 for basic websites ok?
I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers.
The information inside them is important to some extent, but not like credit ...
0
votes
1answer
97 views
Mounting /home as noexec [closed]
Does mounting /home with noexec really add security?
All it does is disable binary execution right? So that means other scripts can still run and execute shell code into services.
Run shared ...
15
votes
5answers
596 views
What are the “to-do” on protecting Windows server facing the web?
I currently begin to deploy Windows servers facing the web.
And I would like to know what are you way of protecting your servers ? What softwares are you using ?
On Linux, i'm using Fail2ban to ...
1
vote
1answer
59 views
Which user account should I use for an intranet web-app service?
I've written a web-application to run on Windows (XP,7,2008, etc), not using MS tools (python/django/nginx, though it should not matter). To run the app I've created a Windows Service which installs ...
-1
votes
1answer
85 views
Where websites should live on a Linux server [duplicate]
Possible Duplicate:
Should websites live in /var/ or /usr/ according to recommended usage?
On a Linux server, sites are typically stored in /var/www. But recently I got to know that ...
1
vote
3answers
97 views
What consequences to take from what i read in logfiles?
Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs.
Where can i get information on when i have to act ...
1
vote
1answer
324 views
Protecting Apache and Nginx against slow read/write and similar attacks?
There are many articles explaining many ways to attack webservers (generic or specific) and even listing general rules for mitigating such attacks, e.g.:
Do not accept connections with abnormally ...
4
votes
3answers
152 views
Is there a downside to enforcing 128bit SSL for a website
On Windows Server 2008 R2 I can enforce 128bit SSL for a website by executing:
appcmd set config "Default Web Site" -section:access -sslFlags:Ssl,Ssl128 -commit:apphost
Is there a downside to that? ...
3
votes
1answer
118 views
running arbitrary, encrypted shell commands via http(s)?
I'd like to be able to encode maintenance scripts to run on-demand remotely.
edit: Good use-case: webhooks. e.g. trigger CI + staging deployment whenever someone pushes code to github.
If I was to ...
-3
votes
1answer
98 views
Protecting a chmodded 0777 cache directory?
A website I'm developing requires several directories to have their permissions set to 0777. The directories are used as cache directories for HTML and PHP files generated by the website.
The ...
1
vote
0answers
180 views
How to set linux permissions to allow Apache to have access to a file [closed]
Linux noobie here, I'm still figuring things out as I move along.
At my school we have a shared server environment where every student gets an account.
But we have very limited permissions.
I have a ...
-1
votes
1answer
171 views
what are the must have applications for an intermediate devop? [closed]
Over the past year my responsibilities have grown from managing 5 servers to 20+. Most all of these are either on EC2 or Linode and they all serve different purposes. Some are on CentOS and others on ...
1
vote
1answer
23 views
How to fix libxml2 vulneribilty
I am using ubuntu 12.04, as per ubuntu http://www.ubuntu.com/usn/usn-1447-1/ libxml2 needs to be patched, how can i achieve it without distro upgrade
1
vote
3answers
446 views
How to drop all requests using mod_security
I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
0
votes
2answers
34 views
Safely Execute Stored Procedure Via DMZ Server
I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a ...
0
votes
1answer
72 views
Securing Erlang / Ubuntu server
I have written a web service in Erlang using mochiweb and jiffy and now face the task of deploying it to production. Since it is going to be open to the public I was wondering how secure Erlang ...
0
votes
1answer
131 views
Http server security analyser and sanitizer proxy
I'm looking for software that will monitor all https request coming through our proxy server.
We currently use nginx that proxies to our application servers.
Ideally, the solution will sit between ...
2
votes
1answer
489 views
Where I can find ModSecurity Rules for Specific Applications
Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
1
vote
1answer
232 views
Block illegitimate traffic (hackers, scrapers, spammers) to your website
According to a recent report from ZDNet, 31% of traffic is illegitimate (hackers, scrapers, spammers). The challenge as a sysadmin is to find a way to block that traffic without blocking your real ...
0
votes
1answer
658 views
How to make sure www directory is secure?
I managed to order a new VPS account from linode
I have installed Ubuntu 10.04 LTS with 'LAMP Stack' StackScript.
I notice the website directory is located in /srv/www/ and I thought this is quite ...
1
vote
0answers
35 views
Tomcat security without a Web Server [closed]
Can anyone tell me, from his experience, if is a good approach leaving Tomcat alone (in PRD) and not "hidden" behind a real web server as Apache or IIS?
The application I am deplying on Tomcat is an ...
-1
votes
1answer
250 views
Need python script for vulnerability assessment? [closed]
How to scan my server remotely? I want to scan a website, so my server, and gathered information related to webserver and other software associated info. I got one named blindelephant . But it is not ...
1
vote
1answer
105 views
Can one rely on Apache sanitizing URLs?
I set up Apache with mod_wsgi in a default installation, with a very simple test application test.wsgi that goes like this:
def application(environ, start_response):
status = '200 OK'
output ...
1
vote
1answer
77 views
Securing php webserver from exploits? [closed]
We are running a PHP application on a linux apache webserver.
How can we secure the server, so if someone finds a hole in our application, they can only get access to the application (Files inside ...
28
votes
2answers
11k views
What are the best linux permissions to use for my website?
This is a Canonical Question about File Permissions on a Linux web server.
I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/.
...
2
votes
2answers
151 views
CentOS webroot Owner
I'm working with a dedicated CentOS server where the base exposed webdirectory is /var/www/html
For security, who should own the html directory "root" or "apache"?
The perms are drwxrwxr-x (are ...
1
vote
1answer
56 views
What is the best way to authenticate only certain computers/devices on a network for a web server?
Currently I'm trying to use Windows Firewall service and select 'only these accounts'...but that isn't working. Normal access to file shares works by selecting said accounts but not to the web server ...
0
votes
2answers
785 views
Analyzing Apache access logs to quickly identify abuse
So someone in China just loves abusing the crap out of my networking tools site up at yougetsignal.com.
I've been trying to analyze my access.log files to see exactly what they are so excited about. ...
5
votes
2answers
141 views
DDoS attack case study - Korean election watchdog's site [closed]
Is it possible to break only some of a web site services using DDoS?
For example, disabling only the search feature of a specific website.
I raise this question following a controversy in South ...
1
vote
3answers
330 views
Free security audit tool for LAMP server?
I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it.
Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic ...
1
vote
1answer
574 views
Hide/Replace Nginx Location Header?
I am trying to pass a PCI compliance test, and I'm getting a single "high risk vulnerability".
The problem is described as:
Information on the machine which a web server is located is sometimes ...
1
vote
1answer
92 views
Why would someone be doing a GETfor mail.live.com against my domain?
Just today I've started to see in my web-server logs lines like this:
IP_WITHHELD - - [19/Oct/2011:20:47:04 +0000] "GET /providers/bookings HTTP/1.1" 500 21975 ...
13
votes
2answers
629 views
how do i perform root actions from non-root account?
I want to be able to restart services from a php-script. running under the www-user account.
What's the preferred way to perform these actions?
I recon I can place create a file with que'd commands, ...
1
vote
1answer
1k views
How can I auto-block IPs attacking my server?
It seems that some script kiddie started attacking one of my servers by trying to fetch all sorts of URLs that may be related to Wordpress vulnerabilities. I don't even have WP installed on the ...
0
votes
1answer
172 views
My website keeps being hit by iPhones…am I being DDOSed?
66.65.71.240 - - [05/Aug/2011:21:56:09 -0700] "GET /api/account_verify?accesstoken=k198nrtc7flswo6qhimuv5pd0 HTTP/1.1" 500 2334 "-" "Geolo 1.0 rv:18 (iPhone; iPhone OS 4.3; en_US)" "at:-" "dt:-" ...
0
votes
1answer
73 views
Web Server sercurity (used only for web services)
I am using a Virtual Private Server for accessing Web-Services used only on the Mobile devices, there are many entries in the access and error log, even there is nothing on the web server.
I am ...
0
votes
4answers
236 views
Webserver and PHP File Security
I'm trying to figure the right security settings for the files on my shared webserver and I have a few basic questions that I've not figured out by looking around.
How do I stop people reading my PHP ...
0
votes
1answer
59 views
Staging and Development Server Accessibility Restrictions
I have some staging and development web servers on cloud hosting. I do not want them to be accessible to the general public. It's easy enough to restrict access by network or authentication.
The ...
1
vote
2answers
373 views
When is it not worth putting Apache in a chroot jail?
I don't mean to question the well established security precaution of putting apache in a chroot-jail in most scenarios but in my scenario I have doubts.
We have a virtual server hosting a single ...
2
votes
1answer
147 views
How rare is a man in the middle attack?
I was wondering if I should set up a secure connection for the db administration application (phpmyadmin) for my sites.
They don't store credit cards nor anything that could be valuable for a hacker.
...
2
votes
3answers
309 views
How do you deal with malicious IP's?
I'm trying to figure out how to protect my server against what it seems to be a botnet (I'm just guessing)
Everyday, more and more IP's fill my application logs with invalid request (eg: GET requests ...
0
votes
3answers
212 views
Good Firewalling practice for internet facing servers?
Does it make sense to firewall an internet facing server, say a webserver? Assuming I did not want to restrict anyone from accessing the webserver in its capacity to serve web pages, I would be ...
2
votes
2answers
92 views
General firewall / security procedures for webservers & databases
My webserver and database server are separate. All I've done to secure the webserver is used ufw and denied from all except ports 22, 80, and 443. What else really needs to be done there?
On my ...
0
votes
4answers
2k views
What Linux server distro is best for a dedicated webserver and a file server? [closed]
I just wanted to know which Linux server distro is most compatible/stable for a dedicated Web Server and a separate dedicated File server. And also please suggest me for a file server what would be ...
3
votes
4answers
321 views
Web server minimum password security based on 100 attempts per second
This insightful article proposes that passwords don't need to be very secure:
http://www.baekdal.com/tips/password-security-usability?
There is one specific line in here that I find troubling:
...
0
votes
2answers
366 views
Should I use my web server firewall to block all traffic from IP addresses that seem to be attempting attacks?
I’ve recently set up a tiny Debian VPS for hosting a couple of personal sites.
In the Apache access logs, I’ve noticed quite a few requests for URLs like /phpMyAdmin-2.6.4/scripts/setup.php coming ...
