Tag Info

Hot answers tagged

28

I think I might be in the minority on this (based on my limited experience dealing with IT departments at school and work), but I think mandatory, time-based password change policies are worthless at best, and harmful at worst. People tend to be very bad at choosing good passwords and keeping them secret. Password expiration policies are designed to mitigate ...


23

These are bots trying to send you spam, or worse, trying to exploit your contact form to send spam to others. For example, there are several well-known exploits for the PHP mail() command commonly used by contact forms that can cause the TO address you put in your code to be overwritten by POSTed data, if you aren't careful how you handle the data coming ...


21

The question doesn't provide specific information about load, features needed etc, so as such any answer is at best a guess. Pound is a good choice for smaller / midsized sites. It offers HTTPS support and easy setup. HAproxy can scale to saturate 10G Ethernet pipes, and offers connection limiting, i.e. sending only the number of simultaneous requests to ...


17

Here are the basic steps. The specific details depend on what kind of router you have, but the concepts still apply: Install IIS on the machine you want to be a web server. It is okay to leave it on the standard port 80 in most cases (we'll remap the port later through the firewall since most ISPs disallow incoming traffic on port 80). Go to DynDns.org and ...


17

Commercial Products: Atlassian Jira (which ties in nicely with Confluence (the wiki)) - Surprisingly good for commercial software. Open Source: Edgewall Trac - (Wiki, Ticketing, and more) Drupal (+plugin) Best Practical RT - I've heard good things about this, but have never used it myself


14

That's like asking if there's a preferred type of car for driving across country. It's all about your preference (I like gentoo personally). Pick the one you know best. If you don't know any of them, I might go with Ubuntu for its large support base. I would add that you should read up on securing the server because with an entire VPS, you have a large ...


14

My large organization (15000+ users) implemented "password changes" every 120 days in the Fall of 2009. It's a huge IT headache and waste of support resources. Every time that 120 day window rolls around we have thousands of users forced to change their password....which many of them either do incorrectly and lock their account....or forget the next day. ...


13

According to the episode 27 of the StackOverflow podcast, the Reddit guys really seem to like HAProxy. Here's a brief tutorial showing HAProxy being used with Amazon's EC2. You can find much more information at the HAProxy web site.


11

Most answers are going to say: Whatever you feel most comfortable with. But here's a few real answers: CentOS Ubuntu Server Why these distros? Active communities. Server focused. Free. Patches and stability need to come before features. Especially if your next meal is coming from the money you hope to be making from this application/server. Next you ...


11

There's definitely a preferred flavor. It's the distro you know best, so that your maintenance costs will be as low as possible. Do not listen to people that will tell you "Distro X is the best". They just happen to know this distro best, therefor they are probably using a lot of the convenience tools that come with the distro to manage it. So use the ...


11

This solution does not describe how to strip a header on HTTP only, as asked in the question title. A safe solution for your problem is to add proxy_set_header X-Forwarded-Protocol $scheme; It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests. This makes sure that this header is overridden if the client set it, as ...


10

No. My personal opinion is that it's unnecessary and even counter-productive. I ranted on my blog, but you can hunt that down if you're interested. In short, it comes down to two reasons: 1. Forcing a user to constantly change their password leads to bad passwords. There will be no shortage of anecdotal evidence on this, but it makes sense that if I'm ...


10

That's a very, very involved question that lots of smart people spend lots of time thinking about. That said, there are a few tried and true mechanisms you can introduce that will help with scalability. Ultimately, though, it boils down to your application and how it should specifically be scaled. For example, you would scale Oracle differently than you ...


9

These bots are blindly trying every form they find in order to send spam mail. Some of them may have historical data of forms and even if it's not currently listed on search engines, these bots can post data to that URL. Let's say a web site contains a HTML form for sending a recommendation to a friend, typically "Tell a fried" or "Send greeting card", ...


9

Wow, that's an enormously broad question :) It's quite off-topic for serverfault, so it'll probably be closed in a bit. But as it's saturday afternoon, I'm in a storytelling mood, so here's an answer, roughly based on a simplified version of how we grew the company I currently work at. The abbreviated answer is my favourite: It depends. There is no "this is ...


8

I've used webmin which offers a comprehensive set of administration tools for everything from process management, apache, BIND DNS, bandwidth monitoring, command shell, DHCP server, various mail servers, RAID, IP tunnelling, MYSQL (etc etc!) to a java based file manager - plus a shed load of 3rd party modules. It's available in RPM, deb, TAR, and solaris ...


7

I would suggest Request Tracker (RT) with the AssetTracker plugin. RT: http://bestpractical.com/rt/ Plugin: http://wiki.bestpractical.com/view/AssetTracker


7

Have you looked at roundcube?


7

curl --user admin:admin http://localhost:8080/manager/text/reload?path=/myapp Doc here: Manager App HOW-TO, Reload An Existing Application The manager-script role is required for the user as the documentation says: It would be quite unsafe to ship Tomcat with default settings that allowed anyone on the Internet to execute the Manager application on ...


7

Presuming that a 'web application' runs on a server (like apache, nginx, etc) and is written in some dynamic scripting language (like PHP, Ruby, etc), you have a misunderstanding in who the 'user' is. The user is not the person who is logged into your application - that, and their role in the application (admin, etc) is completely irrelevant to the ...


7

Never rely on whether your app will be internal or external. Always develop as though the audience of the app will be outside your control (because it is). Go with ENV.APPNAME.DOMAIN.TLD With www. as the alias for "production".


6

This often happens when a browser is using Keep-Alive and reaches the keep alive timeout. It's quite normal. If you see 400 errors with a URI / path / method such as GET or POST, etc, then you have a legitimate problem with a user making a bad request. But those should be rare.


6

I am not sure what most vendors provide, personally I think it would be a good idea for you to verify everything, even if they do some of the work for you. Here is a general answer that you maybe able to use as a checklist. It covers most of the major topics of what you'll find in almost every standard security reference. Also please remember that while ...


6

I've had good results from wapiti - it scans your web forms and attempts injections and XSS attacks against them. If you have the time, I'd suggest getting the backtrack distribution - it's a modified ubuntu liveCD that's been loaded up with nikto, wapiti, openVAS (a fork of nessus) and hundreds of other great security audit tools; I've used it in a few ...


6

My advice for doing releases is to have Feature Releases and Maintenance Releases. Feature Releases would be the releases that get new features. These get added to your subversion trunk. When you think these are feature complete, you branch these into a release branch. Once your QA process is happy with this release, you tag the release and deploy the code ...


6

I work at a mid sized University, and we also have MyStorage folders for our 30k users. We're using WebDAV. We know it is a dying protocol. That said we haven't found anything else that replicates its functionality as easily or cheaply. It does require IIS and another download from Microsoft. Here is some documentation that might get you pointed in the ...


6

Have you considered Eucalyptus? It's free and is pretty simple to set up on a couple boxes you may have. From their site: EUCALYPTUS - Elastic Utility Computing Architecture for Linking Your Programs To Useful Systems - is an open-source software infrastructure for implementing "cloud computing" on clusters. The current interface to ...


6

If you don't use SSPI, you're hardcoding the username and password into the source files. If you're hardcoding the username and password into the source files, all your employees have access to it. This is relatively insecure. A disgruntled ex-employee could use the information maliciously. A visitor might see the code up on a screen somewhere. Or the ...


6

The other answers so far have been good, but I'll throw in another one: management. Sooner or later, you're probably going to end up with multiple SQL Servers. Managing the SQL authentication between your app and multiple SQL Servers gets to be a little painful, especially when you run into security problems. If you change a Windows authentication ...



Only top voted, non community-wiki answers of a minimum length are eligible