Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

How to secure an apache webserver without the mpm_itk module?

I want to setup a new webserver for public shared hosting under Rocky Linux 9 with apache. Our old webservers (CentOS 7) have the mpm-itk module installed which assigns a userId and groupId to every ...
M46's user avatar
  • 101
0 votes
0 answers
17 views

CA root and CA subordinate administrator

I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains. I would like to be able to delegate the administration between several administrators ...
Santyuste's user avatar
0 votes
1 answer
24 views

How to disable interactive login of local admin user on win11

I have a few users who need admin rights on their win11 PCs to install/remove exotic softwares without asking for IT help. Is it possible to let them know the local admin user account/pwd but force ...
MM VA's user avatar
  • 1
0 votes
0 answers
21 views

Secure location of PHP files used in LAMP stack

I'm setting up a LAMP stack on Ubuntu 20.04, and had this recent discussion with a colleague about the fact that it's better to not keep the PHP scripts of all of your stack (classes, API Controllers ...
DevelJoe's user avatar
  • 145
0 votes
1 answer
65 views

Best practice for storing personal information on AWS that we shouldn't be able to see

We store customer information that we shouldn't have access to, and don't want to inconvenience users by making them lose information if they forget their passwords, is there a good way to solve this ...
ze234we23's user avatar
-1 votes
2 answers
30 views

Splitter switch with multiple network

With an increase in informatics insecurity in companies, I try to increase the security of my network, but I encountered a problem trying to set up my ideas. Right now, each person in my company is on ...
Partodiam's user avatar
0 votes
0 answers
38 views

Force close port 22 on GCP VM

For security reasons, I want to close port 22 (ssh) of my VM that is on GCP. Currently, if I execute the command telnet xx.xx.xxx.xxx 22 the server responds to me: Trying xx.xx.xxx.xxx... Connected to ...
Juan Ignacio Portilla Kitroser's user avatar
-1 votes
1 answer
41 views

Possible to identify the application that is causing these entries in IIS Log?

I'm wondering if it's possible to identity the program that is causing these log entries in IIS. Could that be CuppaCMS that the program is looking for, hoping to exploit a vulnerability if it's ...
Tim's user avatar
  • 173
0 votes
2 answers
72 views

apache server not responding due to HTTP CONNECT requests how to block them?

Apache server is getting this kind of traffic. Due to that server is not responding. Please suggest how can we handle this issue. 78.135.85.252 - - [07/May/2023:16:08:33 +0000] "\x16\x03\x01"...
Yogesh Prajapati's user avatar
0 votes
0 answers
17 views

Does google colaboratory save code in local computer when using local runtime

When running python code from google colab into local computer (local runtime), does the code is saved in the local computer or not ?
rocket's user avatar
  • 1
-1 votes
1 answer
35 views

Does ssh save the code in the remote computer?

When running python code using ssh on remote computer by a sudo user, does it save the code in the remote computer ? does the root user can see actual python code? ssh user@remotehost < python /...
rocket's user avatar
  • 1
0 votes
0 answers
32 views

How does pandora.x86 infect cloud servers?

We have a cloud server instance hosted at vultr. A previous instance at this provider has been infected by pandora.x86 a few weeks ago, causing 100% CPU load and over 1TB of traffic. (We believe it is ...
merlin's user avatar
  • 2,083
0 votes
1 answer
46 views

Configure Windows Firewall to block IPs listed in Spamhaus.org

Since having suffered a hack twice on my email server, the last one VERY severe, I have been VERY proactive in monitoring my logs and taking appropriate action when I see attacks. I've installed ...
Prescott Chartier's user avatar
-3 votes
1 answer
73 views

Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]

I've managed to find a lot of closely related information, but not an answer truly addressing my question. I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
MJHd's user avatar
  • 107
0 votes
0 answers
17 views

Hyper-V (Windows 11) - Disable all network access on host but not VMs

Is it possible to create a setup where the Windows 11 Hyper-V VM host has all network access completely disabled, but the VMs running on it still retain full access? In a model similar to what Qubes ...
Ruslan's user avatar
  • 243
0 votes
0 answers
19 views

DISA STIG False Positives and Tailoring Profile

we currently use oscap to run security scans to validate configurations in DISA STIG for our Linux machines. We are seeing a lot of false positives and we are trying to figure out if there is a way to ...
Matthew Hane's user avatar
0 votes
1 answer
27 views

AD Security by OU?

In our AD environment we maintain the Description field to help identify our computers. I found that I and others on my team can update some system in certain OUs but cannot update them in others. I ...
Ben Worrell's user avatar
0 votes
0 answers
39 views

Modsecurity block access from all countries except from a specific IP or specific remote host

I have the below 3 rules in modsecurity. Rule 1: Block all countries defined as high risk except US: SecAction \ "id:900600,\ phase:1,\ nolog,\ pass,\ t:none,\ setvar:'tx....
BradG's user avatar
  • 101
0 votes
1 answer
51 views

How to perform security updates of Docker Alpine

I stumbled upon a tricky situation: I read on the Docker Alpine main page that the image is getting updated every month for minor versions/security fixes. Packages with CVE are not updated for the ...
Kaymaz's user avatar
  • 241
0 votes
1 answer
63 views

Strange attempted emails from Cron

I use Zoho for my email client and last night I got a couple of notifications saying: Warning! Unverified sender. The system could not verify if this email was sent by root@servername.com. Do not ...
Steve K's user avatar
  • 125
0 votes
0 answers
21 views

How to configure osquery with auditd

Who has expertise on how to work with osquery (or maybe you solved this problem): Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
Nullbyte42's user avatar
0 votes
1 answer
148 views

Best way to handle directory/path traversal attacks on a Nginx http site

I have a Node.js-driven site running in a Docker container, and there's a public-facing proxy site driven by Nginx server that redirects traffic to the dockerized Node.js site. Studying the Nginx logs,...
Passiday's user avatar
  • 155
0 votes
1 answer
91 views

Limiting outbound traffic to AWS Management Console or other Amazon consoles

I've a network whose outbound traffic is strictly limited to a whitelist of sites or domains. I searched and couldn't find any documentation about how could I allow stations on this network to use AWS ...
Cat Mucius's user avatar
-1 votes
2 answers
59 views

Disabling SHA in IIS

My company has a web server running IIS 6, and was asked to help disable SHA on it. Specifically this cipher: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA I found these instructions https://www.namecheap.com/...
AndyD273's user avatar
  • 207
0 votes
1 answer
61 views

Zsh function for checking for duplicate PATH entries and for occluded executables

This occurs on many systems and I expect someone has a solution for it. The PATH environment variable is a major part of security issues. For sanity's sake, the path portion of the .zshrc looks like: ...
Charles Merriam's user avatar
1 vote
1 answer
56 views

Hardening the security of a backup shell script of a web-server with mysql database

In the case of a simple web-server with a MySQL database, the script has to dump the database, copy the web-server files and tar everything together. Then a NAS server Rsync the tar file via a "...
Danilo Steps's user avatar
0 votes
2 answers
117 views

apache remove wget for better security

Im no expert at IT or apache but I have used linux for years. Ive done my best to harden/secure my server online which I use for a mobile app which needs to serve up its content etc. Ive noticed some ...
Tim's user avatar
  • 203
0 votes
0 answers
22 views

How do TOR nodes select the CircID's when creating, or extending, a circuit?

I am coding my own version of TOR and I am trying to set up circuit management. I looked at the TOR spec and it says: To prevent CircID collisions, when one node sends a CREATE/CREATE2 cell to ...
saarmz's user avatar
  • 1
1 vote
2 answers
73 views

What can you do when auditd halts the system?

I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
Dave's user avatar
  • 111
0 votes
1 answer
57 views

Internet-facing port 443 in Azure - security concerns

I want to deploy a microservice on Azure Ubuntu VM using one of following stacks: docker-compose/AKS using Traeffic as reverse proxy. I'm looking for cheapest but reasonable in terms of security ...
rethon012's user avatar
0 votes
1 answer
35 views

How to show a password-containing automated generated image, whose "content" is "copyable"? [closed]

I'm responsible for a MediaWiki in my company. That Mediawiki contains information, like passwords. Currently those passwords are stored on the server, hosting the MediaWiki, but when a person surfs ...
Dominique's user avatar
  • 123
-1 votes
1 answer
31 views

Does blocking all output connections protect us from exploits on our server?

Let's say a hacker found a way to execute a vulnerability in my container and he can execute any code there (for example he has upload a bash file with HTTP protocoll). Let's make it more dangerous: ...
Simon's user avatar
  • 109
0 votes
1 answer
183 views

How to take ownership of all contents in CSC folder?

I have files that was saved as offline files from a Synology server to the CSC folder on my computer that I would like to delete. I cannot delete the files unless I individually take ownership of ...
smithalysia92's user avatar
0 votes
1 answer
147 views

I cannot find where 0002 umask is being set on Ubuntu 20.04

My user account has a non-standard umask setting of 0002, and I cannot find the config file where this is being set. I have searched in /etc and ~/.bash* with sudo grep -iIr umask. Running umask in ...
Lisanna Dettwyler's user avatar
0 votes
0 answers
76 views

PHP-FPM + Apache2 security

I have configured my server (an Ubuntu 22.04 machine) so that it is managed by Apache (v2.4.55) and php7.4-fpm. The current configuration allows every vhosts to be divided into specific php-fpm pools, ...
MrL's user avatar
  • 1
0 votes
0 answers
488 views

Content-Security-Policy frame-ancestors not working

I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
harvey's user avatar
  • 101
0 votes
0 answers
142 views

Adding process to cgroup returns error "write error: Invalid argument"

On Red Hat 8.7 on x86_64 I would like to restrict process to be allowed to use only 50% of CPU time. I tried to limit a process with cgroups following Red Hat tutorial Setting CPU limits to ...
folow's user avatar
  • 1
0 votes
0 answers
18 views

Security updates for linux server with only local network access

I am using Compute Engine and VPC Networks in Google Cloud Platform. I have a "classic" frontend - backend server setup inside Google Cloud with two VPC Networks which are connected trough ...
robot2022's user avatar
1 vote
1 answer
82 views

(copy from Stackoverflow) Google Secret Manager- allow Compute Engine to auto-renew the certificates

Below is what I've posted at stackoverflow here that is not getting attention. I hope someone here is able to guide me to find the right answer. I come with Azure background. In Azure, I could ...
k8yun's user avatar
  • 11
0 votes
1 answer
34 views

How to protect Jenkins from super users?

Any super user who has access to the Jenkins running on a Linux server can easily disable security authentication from config.xml file; then log in and can also decrypt sensitive passwords from ...
user avatar
0 votes
0 answers
71 views

How to stop Windows Server 2022 successful anomymous RDP logins

I have a Windows Server 2022 server with IPBAN installed to make hacking it more difficult but in the logs occasionally I see: 2023-02-20 03:59:23.5304|WARN|IPBan|Login succeeded, address: XX.XXX.XXX....
Lil Cyanide's user avatar
0 votes
1 answer
71 views

Permission for Users group successfully modified via code, but change is not reflected in Security tab for the Users group

I have C# code (at the end) which: Creates a file Prints the current ACL Gives the builtin users group "write permissions" to the previously created file Prints the current modified ACL ...
Legenda's user avatar
  • 89
0 votes
1 answer
40 views

What is the proper way to configure Tripwire to handle automatic log rotations?

I installed tripwire by following this online documentation on a fresh ubuntu 22.x server. I followed the above documentation exactly and did not add any custom mods to either the cfg or the pol ...
Chris Pappalardo's user avatar
0 votes
0 answers
78 views

sshd allows login with no authentication all accounts

This morning I was logging into an Ubuntu 18 machine that luckily we use for testing and is not on the Internet. When my SSH client got to the authentication point I accidentally hit 'ESC' which means ...
ZCT's user avatar
  • 13
0 votes
1 answer
186 views

how to SSH to Wireguard server from Windows client with active VPN connection?

I have Wireguard server on Rocky 8.7, when I connect to the server I route all client traffic through Wireguard this is quotes from setup script, of course all variables is set (and all works good) ...
it_buddha's user avatar
1 vote
1 answer
55 views

EXSi Arg Server attack

I have a very basic question. From what I have read, it seems these unpatched servers were directly attacked remotely through the internet via port 427. So unlike other ransomware attacks, the malware ...
GreenAsGrass's user avatar
0 votes
1 answer
48 views

FortiGate Next Gen Firewall AWS security groups

I'm new to AWS using a FortiGate in front as the gateway. Would you need to utilize the security groups, or could I make one to permit all traffic and attach it since the fortigate handles everything.
SGNjH's user avatar
  • 3
1 vote
0 answers
90 views

how to use PAM auth for ssh key clients?

How to unlock ssh private keys with PAM, so I can use fingerprintd module? There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side. Also, ...
gcb's user avatar
  • 303
0 votes
0 answers
42 views

backup /home over sftp - root

My current task is to set up a (remote) backup (using rsync/rsnapshot) over sftp of /home (linux). Obviously some files are read only for the owner (ie -r-------; and should stay that way) so i guess ...
ropchain's user avatar
0 votes
2 answers
84 views

fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning

I make few similar jails for different ports... jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny here firewalld and fail2ban settings for http_https_deny(other almost same, ...
it_buddha's user avatar

1
2 3 4 5
137