Tag Info

Hot answers tagged

9

First of all, I will recommend you to allow login as root to mysql only from localhost. If you have to connect to mysql from another server - create new user and grant only needed permissions to it. Also, you can use fail2ban or similar to add hackers IPs to black-list after a number of failed connection attempts. And lastly, you may change your mysql port ...


5

I am with Maxim and knowhy, allow login as root to MySQL only from localhost. I would go even further allowing login for localhost or specific ips for all users. Something you can do to connect to your remote MySQL server as a local user is ssh tunneling. Something like this Should work for UNIX systems: ssh -fNg -L 9999:127.0.0.1:3306 user@yourhost.com ...


5

First of all, you don't install any backdoors on your customer's system. It would be amoral, most likely illegal, and possibly a breach of contract. If the customer ever found out, it would be a really good reason for them not to pay you. You can configure the system such that you have root access through a number of methods which are generally regarded as ...


5

Your add_header Strict-Transport-Security ... in server block removes add_headers from upper level. proxy_redirect is superfluous. You just used default value, and moreover if you happen to change proxy_pass and forget to change proxy_redirect you'll get strange errors. proxy_set_header X-Frame-Options is meaningless. proxy_set_header X-Forwarded-Ssl on ...


4

Just put the additional rules in a second security group. Apply both groups to the instances - they're additive.


3

@dawud's comments are incorrect. DAC permissions are checked first. If they deny access, then the process receives permission denied. If DAC allows access, then the selinux MAC policy is checked. If DAC allows access but MAC denies access, then access is denied. DAC can never override MAC. Diagram Your Wordpress plugin should be labeled with ...


3

There are several things you an do Use permissions to ensure that only the user who owns the cron job can execute the file e.g. 700 (rwx------) Have the script check to see if who it is being run by and continue appropriately (whoami) have mysql only allow the user who can run the cron job interact with the relevant database (grant permissions). Have the ...


3

Disabling anything in the registry only affects what uses the Windows components for RC4 (IIS/IE). IIS Crypto is not related either - as you are not using IIS. But you are using the node.js built in https.createServer. All settings related to RC4 will then happen within node.js (as node.js does not care about the registry). Newer better ciphers has been ...


3

Since you're going to shut down the servers, boot one of them with a live CD/USB key, mount the root filesystem and chroot into it. Then change the root password and check if there are other users presents and change their password too. Then you can reboot it, connect to the network and procede with the same procedure with the other server.


3

This is how I would do: First I would consider the system compromised. This means I would not trust the data, configs, etc unless is carefully checked. I would prepare a live CD and an empty HDD (can be an uncompromised network storage) I would reset the system (not system reboot, but reset button) and I would make an image of the disk. This image should ...


3

The security of your current setup against interception, and consequently possible disclosure and modification, of your mails on their way from your server to the destination mailbox, depends on the security of your server's DNS resolution. If an attacker is able to forge DNS replies to your server she can divert your mails to her own TLS-enabled SMTP ...


3

You should block mysql with your iptables. This snippet will block mysql from any host other than localhost: iptables -A INPUT -i lo -p tcp --dport mysql -j ACCEPT iptables -A INPUT -p tcp --dport mysql -j DROP Be aware that these settings in your iptables wont be persistent. Depending on your distribution you should edit your iptables configuration. For ...


2

Webmin's integrated miniserv doesn't AFAIK have a feature like this. It seems to be a job for a proper reverse proxy with name-based virtual host support. This isn't hard to configure and is well described in Webmin documentation. A good choice for a proxy is ie. Apache httpd.


2

To paraphrase @reaces from another answer earlier today, if you don't trust your customer to pay you, you've got bigger problems. If you had a backdoor, what would you do with it? Disable the customer's site until they paid you? That's going to be a criminal offence in pretty much any jurisdiction on earth, and a pissed-off customer is not, in general, ...


2

Probably you ask how to prevent hotlinking? Nginx has built in functionality to do that: http://nginx.org/en/docs/http/ngx_http_referer_module.html See an example below: valid_referers none blocked server_names *.example.com example.* www.example.org/galleries/ ~\.google\.; if ($invalid_referer) { return 301 ...


2

Complete the hosts file on the mail gateway server with the servers you would have wanted to resolve by DNS.


2

No need to boot up with a live cd as suggested by @Mr Shunz, since the system is working. Just restart the server, in the boot manager select to edit the boot parameters and add an 1 to the end. The system will boot in runlevel 1 with no network and the root user already logged in. Eventually disable system management programs from starting up automatically ...


2

Software Restriction Policy is deprecated by Microsoft (technet effectively claiming SRP is not supported), since Windows 7 Enterprise/Ultimate introduced AppLocker. In practice SRP has certain pitfalls, for both false negatives and false positives. AppLocker has the advantage that it's still being actively maintained and supported. If AppLocker is ...


2

There were probably some control characters that file (which appears to be binary, not text. Maybe it is a zipped file that you cat'ed by mistake?) which altered the character set of your terminal. Logging out and back in should fix the character issue. As for the file, make sure you did not cat a binary file by mistake. If it ends in .bz or .gz, it is ...


2

You probably misconfigured something in your GPO, and the end result was removing admin rights to users which should have kept them; anyway, have you tried disabling the offending GPO and restarting the computer? This should revert it back to its previous configuration. You can also create another GPO and force the status of the local Administrator account ...


2


2

I know that you are looking for GUI, but there is no GUI with magic button "SHOW ME WHO HACKED ME". This isn't TV, this is system administration. You need to use proper tools. For starters, you can block all outgoing communication its destination port is 80 via iptables: iptables -t filter -A OUTPUT -p tcp --dport 80 -j DROP This will drop ALL ...


2

What happens if I loose my public key on the laptop. Am I locked out the server? If you don't have backups yes you'll be locked out, at least temporarily until you can restore your access. Some VPS providers have a method for replacing keys on server instances. Some provide console access. On others you'd have to spin up a second, temporary server ...


1

Yes, this is indeed a common practice. Using sudo instead of working as root is primarily about protecting you from yourself - if you have to sudo to do some dangerous thing, you are more likely to pay attention. About using it with SSH keys: Disabling password based login effectively prevents any brute force attempt to login to a SSH server by simply ...


1

No one has actually addressed your question yet. Disabling a password for sudo commands isn't much of a security risk, especially if you're using key-only SSH login. To do this, run: sudo visudo And edit the "sudo" group line to be as follows: %sudo ALL=(ALL:ALL) NOPASSWD: ALL The NOPASSWD is the key. With this you will no longer be asked for a ...


1

Yes, there is. Depending on how much control you're giving the user over the content, it could range from "user can do mischief" to "you're a total open relay". As an example more at the "mischief" end of the spectrum, Redis has a fairly "permissive" command parser. It will ignore any commands it doesn't recognise, and then wait for a command it does. ...


1

My apologies, but I think @wombies answer is wrong. The more logical answer (to what was probably meant) is this - You can allow SMTP communication on (almost) any port - the security does not come from the port, rather it comes from the access controls in the mail server to ensure only authenticated users can log in (be it by username/password or IP ...


1

That sounds like a bad idea for several reasons. First of all, negative results not only can be cached but normally are cached (with a TTL based on the SOA MINIMUM value). Do check this value and consider raising it if it is low. Then there's also the aspect of what adding a wildcard address record will do, and in this case a bad A record. The main problem ...


1

I would also like to propose "iftop", this can be usefull to get existing connections from your machine: It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts


1

TL;DR To answer your first question: You can certainly have a CentOS VM connected to the portion of your network that is treated as your DMZ, but the server itself is not a DMZ To answer your second question: Yes, placing a non-domain joined CentOS VM into a DMZ without disrupting the internal network is certainly possible if done correctly. A bit more ...



Only top voted, non community-wiki answers of a minimum length are eligible