Tag Info

New answers tagged

1

Already An error occurs when different security context is given to the port you want to add. If you are using Tomcat The fundamental HTTP port 8080, the port is http_cache_port_t type. If you are using nginx was built 8081 and it transproxy_port_t or both context apache web server generates an error because it can not connect. If you need to change the ...


0

EC2 security groups exist outside of the CentOS instance. IPTables runs inside the instance. The two are not mutually exclusive and will not conflict with one another. Using both means you have to maintain firewall rules in two places, but if you're okay with that, there's no harm in doing so. To give you an example, if you want to allow SSH (TCP port 22) ...


0

Security groups in AWS are way more comfortable AND even better from the security point of view (as the traffic you want to block doesn't reach your instance at all). So turn off the iptables and configure the security groups as limited as you can.


0

I believe I stopped logging logon/logoff events by: Opening local security policy Security Settings->Advanced Audit Policy Configuration-> System Audit Policies->Logon/Logoff: By default both Audit Logoff and Audit Logon are not configured. Right click each-Properties. Check Configure the following audit events. Do not check Success or Failure. After I ...


1

The benefit of this is to know that if I choose to disable some specific cipher, which clients is it likely to affect, just like the SSL labs tests show for web clients. You don't need to restrict yourself to a specific cipher, but instead simply enable all ciphers which are acceptable to you and in the order you prefer them. The resulting cipher then ...


1

If it's a one-off thing, you can use my tool: http://tanin.nanakorn.com/labs/secureMessage It uses Javascript to do RSA encryption. Therefore, your password never leaves your or your friend's machine. Please see FAQ in the above page for more info. To do it regularly, you'd be better off using PGP or SSH keys, so that you don't have to generate a new pair ...


0

You should use either Security Groups or iptables - I advise you against using both at the same time. It makes administration more complex, error-prone and you'll often find your self in situation where things you expect to be working are having problems. So, in short, turn of iptables: chkconfig iptables off service iptables stop


0

For most of the log lines you can find the explanation in the apache wiki about proxy abuse. The fifth and fourth from the end, that are 408 as response code are timed out request. Nothing to worry about too much, they are scanning.


8

It's an RFC thing as detailed by Apache. By default, Apache will accept requests even if they contain invalid URIs, but instead the user will be redirected to your server's main page. The CONNECT requests being refused is proper behavior. As detailed in the link above, you can manually block these requests, but there's no immediate need to.


1

It almost looks as if the server is being used as a web proxy. Try disabling port 80 outbound from that IP(internal to external) and see if the logs keep showing up. If not it might be time to look into tightening down your security...


0

I ended up using iptables to block the ips. From the root linux shell I typed iptables -A INPUT -s 217.69.133.13 -j DROP iptables -A INPUT -s 217.69.133.12 -j DROP iptables -A INPUT -s 217.69.133.10 -j DROP iptables -A INPUT -s 217.69.133.11 -j DROP iptables -A INPUT -s 217.69.133.14 -j DROP iptables -A INPUT -s 217.69.133.15 -j DROP iptables ...


2

I see two points in your question: "access control for the whole server": you already knows the solution, as per-directory limits can be applied with Directory directive in server-config context (so, system-wide and not related to particular virtual-host) up to "/", so server-wide, for the whole filesystem. As an example, it's common, within httpd.conf, to ...


0

You could use: RewriteCond %{HTTP_USER_AGENT} ^p\.mail [NC,OR] RewriteRule ^.* - [F,L] or block the IP address, but like Michael said, maybe it's a search engine.


3

There should be no charge for either of those things. It's a bit of a stretch to call them "resources." In the world of AWS, and in contrast to the other items on that list, those items are more like "metadata." (The same logic applies to Placement Groups.) You'll potentially need them if you launch future instances, but they aren't consuming anything ...


14

Do not attempt to do this with .profile because it provides no security whatsoever and restricts exactly nothing! It doesn't matter what you put in .profile, since you can bypass it by simply giving a command to run on the ssh command line, like this: ssh user@host command. You can still get normal shell access by doing ssh -t user@host bash. Disabling the ...


26

As others have mentioned, disabling sftp isn't anywhere near sufficient - a user with unrestricted ssh access can view any file that their account has permissions to view, can modify anything they have permission to modify, and can easily download anything they can read to their own machine. The only way to stop them from doing this is to actually restrict ...


2

I'm assuming that this means, for example, not logging in with your domain administrator credentials in order to do your daily work on your workstation. If so, you would have a "normal" user account to do your "normal" work and a domain admin account that you use specifically for domain admin activities. For your DNS admin example, same thing--there's a ...


17

Edit: In case it's not obvious, the following answer isn't intended as a secure method of prefenting SFTP from being used by anyone with shell access to the server. It's just an answer that explains how to disable it from external visibility. For a discussion about security, see answers from @cpast and @Aleksi Torhamo. If security is your focus, this answer ...


1

I would look to see if the connections were coming from some kind of web crawler. There has been a spike in the amount of connections that come from applications like http://www.majestic12.co.uk/ This particular service acts like SETI@Home or Folding@Home and aggregates crawled data from the distributed users back to a central location. Majestic12 uses ...


0

The logon type 3 occurs due to accessing a computer from elsewhere on the network (i.e Remote Desktop sharing tool), or accessing other resources like Network Share from elsewhere on the network by passing credentials. One of the most common sources of logon events with Logon type 3 is connections to shared folders or printers. But also other ...


4

In response to your comment: Your comment is valid if the data I want to protect is some kind of business deeds with sensitive financial figures. But, consider I am doing it for a software company that wants to protect their programmers to upload their software source files to their private cloud storage (they are usually 1000+ files). and your ...


3

Please check the free script written by the firm where one of the highly qualified folks at Security SE works: https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/ ssl-cipher-suite-enum identifies the following common security issues relating to SSL: ...Support of key exchange algorithms that don’t support forward secrecy – or equivalently, cipher ...


2

As secure as going directly to HTTPS from HTTPS? No. More secure than not redirecting? Yes. The attack vector when redirecting from HTTP to HTTPS is that a MITM could modify the redirect to redirect the user to a non HTTPS version instead (aka. SSL stripping or a HTTPS downgrade attack). Navigating directly to HTTPS (or being taken there from a HTTPS page) ...


1

Before the https got place, they are simple HTTP over TCP connections. Yes, it can be snooped, but really not easily. Maybe a little bit of dns spoofing can be usable in most such cases. A naive sloop were hard, the TCP has session id which is maybe not very long, but obstacles such tries. AFAIK in such cases the dns spoofing is a viable alternative. ...


-1

A professional system administrator doesn't work in an environment standing up from hardware and software. The work environment of a professional system administrator stands up from a partially human hierarchy, which means, he must optimize his work in a such heterogeneous system. This is essentially different, and much fewer enjoyable, as optimizing ...


5

<form action="http://example.com/"> would post data insecurely, even if the page the <form> is on is itself HTTPS. Data sent in this manner can be intercepted / MITMed. For the same reasons, <form action="https://example.com/"> on a HTTP page is sent securely. However, the page the <form> is hosted on in this situation can itself be ...


1

Personally I use syslog-ng to forward syslogs and cacti with SNMP and syslog plugin , to achieve this functionality - this allows for prioritising/highlighting of specific event types etc, and emailing upon certain events etc. Edit: if you do go down the cacti route, you may also find the threshold plugin useful; it can be configured to notify you when ...


0

At high level and functionally they're mostly equivalent. In both cases the functionality will allow you to block or grant access to certain network ports to/from remote networks, regardless of how the server itself is configured. The underlying technology could be fundamentally different i.e. rather than the state-full packet inspection that is the more ...


1

Event 4624 null sid is the valid event but not the actual user's logon event. The reason for the no network information is it is just local system activity. Windows talking to itself. The "anonymous" logon has been part of Windows domains for a long time--in short, it is the permission that allows other computers to find yours in the Network Neighborhood ...


1

Without extra effort nothing is preventing a (dubiously determined) attacker from initiating a man-in-the-middle attack during the first key exchange and all subsequent connections. This is the same risk inherent in any key exchange over the internet. You can verify the fingerprints of both the master and the minion. On master: sudo salt-key -F On minion: ...


0

If you disabled root login, you're not going to be able to login as root (which includes scp). Try undoing that step.


1

Converting my earlier comment into an answer, to popular demand ;) From the you-learn-something-everyday department: I saw Dan Walsh give a presentation yesterday, in which he explained the new way of disabling confinement for applications in newer releases of Fedora and EL6. You no longer set a boolean to disable transition (which sometimes ...


0

Because you're working with a non-Microsoft program, there's no built-in way of controlling settings and preferences. In this case, you have to write your own. Creating a custom policy object for a third party application is fairly straightforward. Applications store settings in two places: files and registry keys. All you need to do is find where the ...


0

To ONLY provide the capabilities in the question, add the following to /etc/sudoers: tom ALL=(oracle) /bin/bash Then tom can: sudo -u oracle bash -i


2

This port is used for STUN (Simple Traversal of UDP for NAT), which is used by VoIP in some cases. It is also used by the Apple FaceTime application. It could also be used by malware. You may have unauthorized or incorrectly software on the workstations in question. It is also possible your firewall is blocking legitimate traffic for one of the above ...


1

It sounds as though you are describing an issue already within your network - in which case if I were you I'd be taking the workstations communicating with said IP offline for a full complement of virus/malware/etc detection, as well as of course uncovering what is attempting to communicate with the IP you mention - and if at all possible, trying to ...


0

Some versions of OpenSSL were broken in Ubuntu due to problems in OpenSSL, not Ubuntu itself and may have been broken in other distros as well, such as Amazon Linux, when connecting to an ancient server that can do no better than TLS 1.0 unless you explicitly force it, as @AndySmith was suggesting above (the openssl s_client -connect option to try to see it ...


0

As an alternative, look at the SIP related firewalls here: VoIP Firewalls


3

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to: Security There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more ...


2

Nowadays even limiting the ICMP packets in server side can create headache on DDoS attacks. Attacks mostly done by sending huge window ICMP requests to one server and if the server is trying to respond to each of it, guess what happens? Main thing that we have a teamspeak server that gets bad packets every single day, there was few days in two months that ...


1

edit: Actually it depends on what you really want to achieve. Provided you want to secure resources the task is accessing with ACL - here is the way: Ability in Windows 7 and Windows Server 2008 R2 to apply a SID to every scheduled task and use that SID to apply permissions elsewhere in the Operating System. ...


2

You can achieve this in a number of ways. Integrating quite directly with what you have in your config file, you may wish to simply include a section such as the following; location ~ \.php$ { try_files index.php @error; fastcgi_pass ...; fastcgi_param SCRIPT_FILENAME /path/to$fastcgi_script_name; ... } location @error { [config of however you want ...


2

This problem also occurs when you must let dovecot-lda talk with postfix. On this documentation, the author suggest two solutions Make dovecot-lda setuid-root Use sudo to wrap the invocation of dovecot-lda. Option one was well explained by coincoin. The second one will be explained below. For do that, you should have dedicated user to do sudo. Let ...


6

No, you can't tell if anyone is eavesdropping on your mails sent through SMTP if it is done properly. Any server administrator in the path of your message (it may travel through several hops) is technically able to copy away the content without any visible traces. The idea of hiding an image reference in the HTML part of the message will only work for very ...


5

Every email is like a plaintext postcard. The only solution to your primary problem is end-to-end encryption. Look for GPG. However, you are asking to 1) track the email on it's journey 2) find out who's reading your mails. These are 2 different questions and I have 2 discouraging answers for you. To find out the path, which the mails has taken to travel ...


0

Migrate your files to another server that you own... else its like keeping a safe in an airport walkway


4

The only way to prevent an administrator from accessing a file or files is by encrypting them with a key which the other administrator does not have. In that vein, you could look into using EFS to encrypt your Plesk files, but any permissions or access restrictions you place on the files in question can be undone by any user with administrator rights - ...


4

Unfortunately, as for as admin rights are concerned you either trust the person or you don't. You can change the NTFS permissions and ownership of the folders, but they can take ownership of the folder themselves and change the permissions, delete the folder, etc.


11

No. There is no way to prevent an admin from being an admin. You cannot simultaneously have your files encrypted in such a manner so as to keep them safe from the prying eyes of another administrator on the system, and have an application seamlessly decrypt and access those files in a way that an administrator could not also mimic. To suggest otherwise ...


2

Should I install that on all of my application servers Yes. or alternatively create a new certificate and sign it with the wildcard cert That will not be possible. ... that not all of the wildcard certificates can sign others No CA will give you a certificate to sign others (at least not unless you have lots of money and a solide knowledge ...



Top 50 recent answers are included