Tag Info

Hot answers tagged

17

The rule I've always worked from is that once an attacker has physical access to your host, they can eventually break into it - unless, as kasperd says, you use strong all-disk encryption with a boot password, and are willing to be there to enter it every time the host boots.


9

The solution I'm aware of is encrypt the disk and use a TPM: Trusted Platform Module In this way there's now way do decrypt the hard drive as: Full disk encryption applications [...] can use this technology [TPM] to protect the keys used to encrypt the computer's hard disks and provide integrity authentication for a trusted boot pathway (for example ...


6

Here's a simple solution: rebuild the kernel without single-user mode! More aptly put, edit the linux kernel you're using so that mode S is remapped to whatever your default mode happens to be (3,4,5). That way, any attempt to boot into single-user mode starts the system normally. You could probably do the same thing in the init scripts. That way there'd ...


6

Full disk encryption is a good idea for laptops and small home servers. Full disk encryption does not require a TPM. And even a TPM is unable to protect you against a sophisticated evil maid attack. So in order to really protect your small home Linux server (or a data center) you need appropriate other physical counter measures. For your home use case ...


5

Yes... probably... if you're talking about applications that call into schannel.dll. You mentioned "Servers" and you mentioned "SSlv3" which is a protocol. Changes to this registry key requires a reboot. Read this Microsoft article: https://support.microsoft.com/en-us/kb/245030 That's basically the bible of this topic. Notice that the article says ...


5

Your iptables rules are doing exactly what you want: they're blocking outbound port 25 connections: May 21 14:50:12 CentOS-70-64-minimal postfix/smtp[5484]: connect to mx.domen.tl[93.158.134.89]:25: Connection timed out Unfortunately, your server appears also to have a valid ipv6 address (I'm guessing it's a modern VPS, I've noticed most of these come ...


4

You use both, but in different locations. The first try_files goes in your location / and handles all requests coming into the server. It has nothing to do with security, and is a pretty common setup. The second try_files goes in the PHP location and prevents the attack. Note that this requires that nginx and PHP be reading the same files, on the same ...


3

For Linux servers I manage these attempts using fail2ban so that it will autoban the IPs that attempt to find vulnerabilities on the web server. IIS has some free plugins (Microsoft supported) that do the same thing. These tools allow you to restricts the types of HTTP requests that IIS will process and/or temporarily ban the IPs that make those requests. ...


3

Procmon out of the Microsoft Sysinternals suite should do the trick. You can filter the path or registry key or whatever you need.


3

It depends on what your machine does ultimately. Does it run mission critical applications that can not crash EVER? Probably not the best for auto updates then. Is it sitting on the egress point of your network? probably a good candidate. It comes down to weighing security vs stability and finding what your acceptable compromises are. Most likely you're not ...


2

If you create cloud-only accounts (i.e. not synchronized from local AD), they are completely unknown to your on-premises environment, thus they can't even log on to your local AD domain, and of course they can't manage anything in it. You can do the reverse: have a local admin account and grant Office 365 administrative rights to that account.


2

Go over and ask on the Electronics site. I am pretty sure there are embedded SOC designs which encrypt everything and once you fuse it, is "impossible" to reverse engineer. That said, I was at a DefCon presentation where the team showed exactly how they took it apart. In a lot of cases the chips hadn't been fused, or the chip design foolishly included an ...


2

If you don't zero out the disk with encrypted zeroes, an adversary could theoretically analyze your disk to determine where and how much encrypted data was written. Information can be gathered from that metadata, such as the kind of application writing information to the underlying filesystem and what kind of information could be present on the partition. ...


2

If all the folders are owned by one system user (somewhat implied by you suggesting you have a shell account that can see everything), and the PHP scripts are run as that user (any host worth their salt will be doing so), they can write into any directory you own/have write enabled (eg 777 isn't required - owner-write is enough). Each distinct website ...


2

It's fine to use PAM for authentication, but separate the user accounts for the administrative access and applications on user-level like mail. You have to either separate the user database and authentication of dovecot and postfix from PAM, the system one's, or you have to create another system account you use for administration via SSH and not for mail. ...


2

Yes. You should enable these automatic updates. You are far more likely to have your system compromised by missing or delaying an update than for these updates to impact your running system negatively.


2

This could happen to clients if you primary domain sends a Strict-Transport-Security response header with the includeSubDomains flag. Example header: Strict-Transport-Security: max-age=31536000; includeSubDomains If this header is present with includeSubDomains, compliant clients that later access your subdomain will change all HTTP references to HTTPS ...


1

I wrote up an extended blog post about how to do this with Apache 2.4 using OSSEC (a FOSS host-based intrusion detection system). Here's the TLDR: Use mod_remoteip to log client IPs in place of your load-balancer IPs. In your vhost config, use an IncludeOptional directive inside a RequireAll directive to source in a directory that will contain other ...


1

I'd like to offer a different approach, if you're willing to consider destructive preventative measures. Consider soldering a large capacity capacitor to your hdd and ram, which on tamper detection (you decide method/sensors) discharges destroying data. This "prevents" access in the empty sense of no one can access the system afterwards. So it answers the ...


1

A potential solution would be to use full disk encryption, put the key on an USB stick/memory card and put the computer in a metal box with a single door which has an opening switch, along with some environmental sensors. To boot the device once you put the USB drive in the port (on the outside of the "vault") and it reads the FDE key from there and boots ...


1

There is a security flaw because you are using a privileged account (sudo account) to perform a task a normal user (without being privileged) would normally perform. I would add a simple system account and use it to authenticate against roundcube to reach my emails. Furthermore, I don't believe you needa system account for this. There must be another way ...


1

Try adding a default for findtime under the [DEFAULT] section of jail.conf here is a snip from the default install I got on ubuntu 14.04 [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be # defined using space separator. ...


1

As far as I know, OSSEC itself doesn't delete logs. Look at the documentation Where are OSSEC’s logs stored?¶ On OSSEC server and local installs there are several classes of OSSEC logs. There are the logs created by the OSSEC daemons, the log messages from the agents, and the alerts. Agent installs do not have logs from other agents or ...


1

You should download & install - Command line interface for WordPress | WP-CLI [alexus@j ~/alexus.org/wordpress]$ wp --version WP-CLI 0.18.0 [alexus@j ~/alexus.org/wordpress]$ wp core verify-checksums Success: WordPress install verifies against checksums. [alexus@j ~/alexus.org/wordpress]$


1

Tell the auditor you aren't running IIS 6. There is nothing else you really need to do. This vulnerability only affected IIS 6 running on Windows XP and Server 2003. Of course, if they were competent they would have already known that...


1

You're being attacked by a botnet. Here's a specific solution for your nginx web app HttpLimitReqModule In general these are the steps you follow: -For specific attacked accounts, give them the option to allow login only from certain IP addresses. -Assign unique login URLs to blocks of users so that not all users can access the site from the same URL. ...


1

No, that event alone does not necessarily mean that an unauthorized person logged in to your server. Those events simply indicate that a TCP connection was established - it doesn't mean they entered valid credentials. When you expose any service to the internet, you will see tons of random attempts to connect. All day, every day. Personally, I don't think ...


1

Yes. Windows Server comes with a role called "Remote Desktop Gateway," or RD Gateway, formerly known as Terminal Services Gateway. It essentially behaves exactly as you've described, though I'd personally be hesitant to use the word 'conceal.' It is just an RPC/HTTP(S) proxy. In past deployments, I would often make the default web page say what this service ...



Only top voted, non community-wiki answers of a minimum length are eligible