Tag Info

New answers tagged

0

A way to know this is to have a look at the Ubuntu Security Notices (USN) which are released each time a vulnerability is fixed in Ubuntu. In such case, the release of the package in which it is fixed is written. For instance, for heartbleed, the USN was the USN-2165-1 (http://www.ubuntu.com/usn/usn-2165-1/) which states that it has been fixed in ...


0

I'm not exactly how sure the script works and how your network it setup but how about filtering via something in front of the IIS server (even if it's just a virtual device in a virtual machine)? Namely, you setup an IPS with a rule that specifically drops traffic pertaining to that particular issue?


2

The actual version of affected OpenSSL version in Ubuntu 12.04LTS is 1.0.1-4ubuntu5.11 and current version is 1.0.1-4ubuntu5.21 (the number at the end matters here). It's been patched a few times since and should not be affected by heartbleed bug. Here's a link from which you can see affected version numbers in different distributions: ...


0

Unfortunately the only way to really deal with this is an annoying set of gyrations, depending on your version of windows, disabling the ability to generate 8.3 names. For your version of Windows: To disable 8.3 name creation on all NTFS partitions, type fsutil.exe behavior set disable8dot3 1 at an elevated command prompt, and then press Enter. Source: ...


0

Finally I got this issue resolved using Location and Require directives. Below is the first few lines of /etc/phpmyadmin/apache.conf that I have changed: Alias /Padmin /usr/share/phpmyadmin <Location /Padmin> Require ip 202.41.76.236 111.43.116.70 202.41.76.238 #only allow these IP </Location> Then # service apache2 restart


0

Eventually I got it working. Issue 1: The issue I faced was there is very few documentation available to configure TACACS+ server for a non CISCO device. Issue 2: The tac_plus version that I am using tac_plus -v tac_plus version F4.0.4.28 does not seem to support service = shell protocol = ssh option in tac_plus.conf file. So eventually I used ...


1

Spoofing the "Referer" header is really easy, and I have seen many times scrapers and bots doing that. It would be great if you could sniff that TCP traffic and show us how these HTTP requests look like. Tcpdump can do the trick; It depends on your environment, but give it a try: $ tcpdump -i eth0 -A -vvv -s 500 'tcp port 80 and ip[2:2] > 40 and ...


0

I agree with starting over with the server option, but if you want more security and control, a dedicated server is a better idea. As for your situation, the first thing I suggest is to disable every running service except for shell access. This means stop the FTP service, the web server (HTTP), email, etc etc. Next go into the shell and navigate to the ...


0

An attacker got root on your system. You can't trust ANYTHING on the system, at all. The scope of what can be done by a rootkit is vast. If you have backups of your content somewhere, then use them. Otherwise, you can hope the attacker didn't mess up your data. Dump your SQL tables and copy that along with your other stuff (jpgs, pdfs, html, but NOT any ...


1

In spite of all these changes, another user is always able to change files, rename folders, and upload another hacked file. If the parent directory of your web root is owned by the same user who runs the web server, then those parent directory permissions would override any permissions set to child files and directories. For example, open up a ...


7

If you can avoid it, you should not be running the web server processes as the root user, since that means the compromise of any vulnerability in the web service will completely compromise the server. With where you are now, I'd recommend starting from scratch on a new server - the attacker could have given themselves persistent root access through any ...


0

That log is controlled with config/main.inc.php directive: // Log sent messages to <log_dir>/sendmail or to syslog $rcmail_config['smtp_log'] = true;


0

There are loads of ways to test for sql injection at various levels and some useful tools that do this automatically. Netsparker and Acunetix both provide software solutions to test your site and web apps but are pricey. To do some basic testing yourself try the excellent firefox addon: https://addons.mozilla.org/en-us/firefox/addon/sql-inject-me/ The ...


0

On my system, changing the value of IEHarden (REG_DWORD) to 0 in this key appears to have corrected the problem for all new accounts (and possibly some existing accounts): HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\ Internet Settings\ZoneMap This is ...


3

(This answer is specific to the use of key-direction for tls-auth keys. For static key mode, please always use key-direction.) The advantage of using different keys for each direction is that packets originating from one peer can never be replayed back to that peer by a man-in-the-middle attacker. Of course the underlying TLS and OpenVPN protocols should ...


1

Confirm that your firewall on the CentOS server (internal zone if that where the tun0 device is located) has https available as a service. You should be able to ping the server on 10.8.0.1 from the Windows machine. If this works, then your VPN is up and working and it's probably the CentOS server's firewall blocking you. If the ping doesn't work, then you ...


0

At least on Server 2008 R2 this works fine: icacls.exe pack /T /grant "OWNER RIGHTS:(OI)(CI)(F)"


2

This seems like a good question to ask Linode. Why do they provide their own custom kernel? Does it somehow work better with their VPS? If you don't hear anything convincing, then it seems completely reasonable to switch to a stock Debian kernel and let apt-get handle the updates. If they do add value with their kernel, ask them if they can provide it in ...


0

Reboot the server to resolve this issue ms technet source


0

Change the network interface MTU to solve it. This is a bug for ubuntu 14.04. This worked for me: sudo ip li set mtu 1200 dev wlan0 ssh fails to connect to VPN host - hangs at 'expecting SSH2_MSG_KEX_ECDH_REPLY'


1

For a mail server, there are free services that will check the various security measures for your domain. Check this site as an example: http://mxtoolbox.com/ Check your domain and implement the recommendations that the site suggests and your mail server should be secure. Since you have other services running on the server (assuming Ubuntu, and exposed to ...


1

None of these aforementioned methods solved my Win7 remembering credentials problem. However, after many trials, I discovered that the problem was caused by the remote device's computer name coinciding with one of its local user names! I changed the computer name to something different than all of the local user names, then entered my remote credentials and ...


0

Did you by any chance tried: var RULE_PATH rules include $RULE_PATH/local.rules


1

That's fine but why not using the apache functionality to log failed logins ? Add these lines to your Apache Config (i.e:/etc/apache2/conf.d/phpmyadmin.conf) in the according VirtualHost Section: LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined CustomLog ...


0

Unless your kdc.conf has an acl_file entry pointing to a different location, you should create/edit /var/lib/krb5kdc/kadm5.acl, kadm5.acl(5). However, this is for plain MIT-krb5. FreeIPA probably has its own methods for this.


2

I realize this is an older question, and that you resolved the issue a different way, however, the reason it wasn't working originally was due to "Audit: Force audit policy subcategory settings" being enabled. As explained in this article on Technet: The lack of Object Access auditing is expected: as soon as you start applying Advanced Audit ...


2

Looks like you just became quite popular. Someone must have placed a link to some of your articles. this is one of the largest russian professional communities this is one of the largest russian entertainment sites this is mobile subsite of p. 1. this is the most popular russian social network


0

Actually it does. ./configure --help I would not worry about aio in the beginning. I would experiment with it while fine-tuning the server. Anyway you should compile it in. nginx proxy module is one of the essential modules, you should really keep it in. PHP is for parsing PHP script languages, and nginx is the web-server that can work with PHP via fcgi ...


1

You cannot set "modify" to a folder for a user without having "execute" permission on it for that user... and, as suggested by another answers here, it's not even possible do deny execution preserving modify so the solution may be this: a Group Policy for Disallowing Execution by default then whitelisting may be the choiche: Computer Configuration > ...


0

CentOS Open the file ~/.bash_profile in a text editor. Append the following lines IP="$(echo $SSH_CONNECTION | cut -d " " -f 1)" HOSTNAME=$(hostname) NOW=$(date +"%e %b %Y, %a %r") echo 'Someone from '$IP' logged into '$HOSTNAME' on '$NOW'.' | mail -s 'SSH Login Notification' YOUR_EMAIL_ADDRESS If you are using Ubuntu/Debian add the same content to ...


0

For this you can use tcp_wrapper, in /etc/hosts.allow you can use something like this. sshd : ALL : spawn (echo -e "Connected from IP %h with user %u" | mail -s "SSH Connection" info@example.com) : ALLOW For more information. man 5 hosts_access But with this method you need to be careful if your servers are exposed to internet, because every time ...


2

Okay, thanks for answering the question. However, I have done it slightly differently, I have an one-line command in the global bashrc file. Here's my solution echo "Login on" `hostname` `date` | mail -s "Login on `hostname` `who am i | awk '{print $5}' | sed 's/[()]//g' | cut -f1 -d "." | sed 's/-/./g'`" admin@example.com Assuming that you have the ...


1

Judging by the access log you have posted, they are not doing anything abnormal. No weird queries or questionable POST requests. If the volume of requests from this host is very high, you should consider firewalling or rate limiting them. You can try to rate limit them with the following iptables rule: iptables -I INPUT -p tcp --dport 80 -s 37.156.33.207 ...


0

Have you considered manual rather than automated controls, and a policy that just says you can't deploy code you wrote yourself, but have to get someone else to do it? That gives you isolation of roles for each deployment, but not globally.


1

If you think about ssh when you talk about "logged" you can use syslog and rsyslog . For rsyslog check that : http://www.rsyslog.com/doc/ommail.html With some setup you can send log by mail or with log system stack (elk stack , graylog2 , splunk , etc).


3

The Linux login process is primarily ruled by PAM (Pluggable Authentication Modules for Linux) which is a suite of shared libraries that enable the local system administrator to choose how applications authenticate users. By default some PAM messages are already logged to syslog so by monitoring that you can trigger notifications. More specific you can ...


1

Every open port on your device or server increase the attack surface, certainly. That said, enabling HTTPS would be more secure than enabling a non-encrypted protocol like Telnet or HTTP. You mention changing the port number. Be careful with that, you may prevent the Cisco Network Assistant from finding/managing the device. (Does CNA let you specify a ...


3

One potential problem with HTTPS is that lazy people (like me) may not set up a Kerberos certificate on the device to ensure that connections to it are secure. Your certificate would have to come from one of 3 sources: a commercial certificate authority like Verisign (expensive), setup your own CA using a Windows or Linux server (not that hard, but time ...


5

As an Information Assurance (IA) principle, the less unnecessary services running on a device, the lower the attack surface. To mitigate issues, proper configuration and patching levels are key. Changing ports is one of many elements you can do to lower the potential security risk. Cisco has an excellent guide for proper implementation of the HTTP/HTTPS ...


2

Enabling HTTPS and changing the port number is actually very common practice. Using a secure password for the login will also increase the security. Of course, you should always use HTTPS over HTTP. But ultimately to answer your question, no it's not insecure. The web management interface is just a user friendly way to configure the settings, but if ...


0

oh sorry this is a old question, but i think this would work if anybody have a similar issue: Please try out the following: Instead of "Performance Monitor Users" try YOUR step 1 with "Performance LOG Users" and allow only "Execute Methods" and "Remote Enable" for the "Performance Log Users" Group. And apply the rights to "this and subordinate namespaces". ...


3

If you check the whois record for that IP, it tells you: Comment: To report suspected security issues specific to traffic emanating from Microsoft online services, including the distribution of malicious content or other illicit or illegal material through a Microsoft online service, please submit reports to: Comment: * ...


0

As far as I know, this must be done using the GINA dll. All windows operating systems (except VISTA) use this libary for login purposes. You can find more information on this page: https://msdn.microsoft.com/en-us/library/windows/desktop/aa375457(v=vs.85).aspx


-1

That depends on the type of attack you are getting.According to my experiences a Fortinet FortGuard 310B proves good enough for me.It mitigates attacks upto 8Gbps and requests upto 30K.


0

I wouldn't worry about that as much as you are. The threat could be a spammer or something, so it isn't indicating the severity of the threat. That's also a pretty low number of threats overall...


0

I bound elasticsearch to an openvpn tunnel: In /etc/elasticsearch/elasticsearch.yml: network.host: 172.16.xxx.xxx Where 172.16.xxx.xxx is the IP addresses assigned by openvpn.


1

this script of mine can do a NETWORK transfer between 2 remote points WITH ENCRYPTION ... http://slashusr.com/scripts/tarnet i used this back before AWS added support for snapshot transfers and still use it at times to go between AWS and other places like my non-cloud dedicated servers.


0

If your server has a connection to internet it is quite likely that it has been hacked. If this is a production service you should restore a previous clean backup because you don't know if you have identified all the malware/rootkit installed in the server. If you want search the cause of this problem you can try to follow this guide ...


1

After long discussions with RedHat I finally got the right files: https://access.redhat.com/downloads/content/rhel---4/i386/2996/glibc/2.3.4-2.57.el4.2/i386/db42a60e/package https://access.redhat.com/downloads/content/rhel---4/i386/2996/glibc-common/2.3.4-2.57.el4.2/i386/db42a60e/package ...


2

Look at the processlist what the command-line for process 4280(seen at the rightmost of the netstat output) is. This should give you location and name of the executeable. If you did not install or run any software using the IRC port, this is most likely a connection to a botnet master server. Those are frequently used to send control commands to servers ...



Top 50 recent answers are included