Tag Info

Hot answers tagged

69

Check local fire-codes. Really. In 2003 I was involved in setting up a new datacenter for work. My job was more moving the gear, not wrangling with the architects and contractors who were building it. Imagine my surprise when I found sprinkler heads in the datacenter during my first walk through. I got about a quarter of the way to indignant outrage before ...


40

It's bringing this thread back from the dead, but I wanted to add my two cents to this question. Novec 1230 from 3M is great stuff also. It's a liquid fire suppressant that's: Non-conductive Evaporates harmlessly (and is broken down by UV light as it evaporates) Doesn't damage paper It truly is amazing stuff. You can drop a textbook in it and it'll be ...


8

This cannot be done, in any true meaning anyway. If you don't trust the administrators you're out of options - there's always a way for them to get to the data in the described scenarios as they control your hardware (client and/or server) and your infrastructure. Regulate access through written policy.


8

Last time I used Fedora (this was Fedora 9, YMMV), I had everything encrypted with LUKS and cryptsetup in a ext3 volume in my lvm volumes, and it did this quite well. If you want a bootable system with encrypted data hidden until a user opts to mount the right container (instead of blocking the boot process at the sake of preventing any unauthorized use ...


6

All server rooms should have a Class C fire extinguisher outside the main door. You can grab it on the way in, or on the way out. Depending on the size of your server room, get another to stick on the far side as well. And keep them charged/inspected once a year. FM200 seems to be a popular choice, halon has been outdated over environmental and health ...


6

It's the price of fame. Every once in a while someone will try something against pretty much every site (I see a scan for vulnerable versions of phpMyAdmin every couple of days, for example). Since the machines involved are almost exclusively zombied end-user machines, "taking action" against them is useless (any sort of "active countermeasure" is, of ...


5

You can set a user-specific process limit with setrlimit() on Linux systems. If you are using Ubuntu, for example, you can change the limit in /etc/security/limits.conf


5

TrueCrypt is a free open-source alternative to Windows BitLocker. I would say that TrueCrypt is even better than BitLocker.


5

Disclaimer: I'm not a safety inspector, but I have been handling fiber-optics almost daily, without mishap, for nearly 20 years. The danger is there, but shouldn't be over-hyped. A laser-pointer is much more dangerous. As long as you don't look straight into an active transceiver (or a cable-ending that has an active transceiver on the other end) nothing ...


5

I think you have to assume that anything you send over the Internet unencrypted is not secure. Even then there's no guarantees as there are many man-in-the-middle type attacks and who knows what the security is of the system that's storing your data on the other end. If you need to get data securely from point a to point b then it's up to the end points ...


4

fail2ban will do the trick. http://www.howtoforge.com/fail2ban_debian_etch have fun.


4

The first solution would be to protect your webpages using HTTPS, and making sure that, on the front page, you warn the users that the URL MUST be https://www.website.com. If not, they should enter it manually. (That's what many banks to in such cases). Also, you could firewall the IP of the reverse proxy. You can detect the IP using the amount of traffic, ...


4

Buy one that is already waterproof. IP65 for example. http://en.wikipedia.org/wiki/IP_Code


3

Since you are also the developer, you might consider coding an appropriate error handler to ignore and/or maybe even trigger a "tar pit" response/handling.


3

The correct approach to this is not to block attempts by malicious bots to scan the contents of your web server. Focusing on blocking the scans to achieve security by obscurity will not yield any kind of protection against a real attacker, or really even against a bot that guesses well at a vulnerable URL in its first couple attempts before your ...


3

is there a way to stop others from using any email adresses registered with our domains? You can't stop them, but you can make it more difficult (i.e. increase the chance it will be caught and marked as spam). This is what SPF has been designed for (from Wikipedia): Sender Policy Framework (SPF) is an email validation system designed to prevent ...


3

Both Ubuntu 10.10 and Fedora 14 offer built-in disk encryption via dm-crypt/LUKS. I've used it on Fedora (to comply with my employer's mandated encryption for laptops), and found it happily painless and transparent. Basically, check the "encrypt this partition" checkbox in the installer, provide a passphrase, and there ya go. Documentation for this feature ...


3

Can service X be flooded? Yes. You have to ensure the services are configured such that if they do get flooded, your system's resources (CPU, memory, etc) won't be overcommitted. Since you're using mod_security, I assume you're running Apache and MySQL. For Apache, you'll want to look at the average memory utilization for each Apache process. Adjust the ...


3

Admin's need access to data. Even if for nothing else than backup and restore. What you need to do is trust your admins a certain amount, and make the consequences for abusing that trust high and definite. As an admin you have a lot of power and access, your trustworthiness is one of your job's requirements, gross misconduct/suspension/dismissal type charges ...


3

Would password protection work for you? Add this to the .htaccess file AuthUserFile /full/path/to/.htpasswd AuthType Basic AuthName "My Secret Folder" Require valid-user Then to add users to the password file: htpasswd -c /full/path/to/.htpasswd fred


2

Use the install utility - that's what it's for.


2

Put a password on that part of the site. Use simple http authentication through Apache. Any application behind it, unless it also uses http authentication, will just do its own thing.


2

One thing worth mentioning is that YOU NEED TO TEST THE SUPRESSANT SYSTEM. I know of two cases where a flooding was triggered and caused a lot of havoc. The reason seems to be that the outlet pressure is often much higher than assumed. At one place, it (the flooding from below the DC floor) sent old IBM terminals flying off the top of the racks into other ...


2

ASLR (Address Space Layout Randomization) for Windows was first implemented in Windows Vista beta 2 (see Michael Howard's MSDN blog archive for a brief look at the initial implementation). All subsequent workstation and server releases have included the feature (including Vista, Server 2008, Server 2008 R2, and Windows 7). Note that ASLR is only ...


2

There is no effective way to "protect" your server from a DDoS. Your best option is to contact your upstream provider and ask for their assistance in mitigating the attack before it reaches your gateway.


2

So, how do they run the program if they can't read the drive that it's on? In short - you can't do this the way that you're asking. For someone to execute a program, they have to have the credentials to be able to read it. Can you imagine what else would break if you really did explicitly deny users access to the C:\ drive? They wouldn't even be able to ...


2

If they are spoofing your domain in these emails, so they seem to come from your email domain, then you can try and prevent this using an SPF (Sender Policy Framework) record in your DNS. An SPF record allows you to specify which servers are allowed to send mail for your domain and so should help stop these spoof messages. An SPF record would look like: ...


2

This is really a question for Stack Overflow more than Server Fault (a SEO site would actually be best), but what you've got there is very unreliable. The googlebot could come from any numbers of IP addresses and thus reverse DNS lookups. There could be thousands of different options, and if one changes, then bam you've blocked a legitimate bot for almost 30 ...


2

In Ubuntu (or any other distro that has PAM module pam_limits enabled) you can limit the amount of processes a user can have. You can do this by editing /etc/security/limits.conf. For example to limit the amount (20 procs as a maximum) of processes user "foo" and group "bar" you would add foo hard nproc 20 @bar hard nproc 20 You can also ...



Only top voted, non community-wiki answers of a minimum length are eligible