Questions tagged [security]
For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE
6,849
questions
0
votes
0
answers
9
views
How to secure an apache webserver without the mpm_itk module?
I want to setup a new webserver for public shared hosting under Rocky Linux 9 with apache.
Our old webservers (CentOS 7) have the mpm-itk module installed which assigns a userId and groupId to every ...
- 101
0
votes
0
answers
17
views
CA root and CA subordinate administrator
I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains.
I would like to be able to delegate the administration between several administrators ...
- 11
0
votes
1
answer
24
views
How to disable interactive login of local admin user on win11
I have a few users who need admin rights on their win11 PCs to install/remove exotic softwares without asking for IT help.
Is it possible to let them know the local admin user account/pwd but force ...
- 1
0
votes
0
answers
21
views
Secure location of PHP files used in LAMP stack
I'm setting up a LAMP stack on Ubuntu 20.04, and had this recent discussion with a colleague about the fact that it's better to not keep the PHP scripts of all of your stack (classes, API Controllers ...
- 145
0
votes
1
answer
65
views
Best practice for storing personal information on AWS that we shouldn't be able to see
We store customer information that we shouldn't have access to, and don't want to inconvenience users by making them lose information if they forget their passwords, is there a good way to solve this ...
- 13
-1
votes
2
answers
30
views
Splitter switch with multiple network
With an increase in informatics insecurity in companies, I try to increase the security of my network, but I encountered a problem trying to set up my ideas. Right now, each person in my company is on ...
0
votes
0
answers
38
views
Force close port 22 on GCP VM
For security reasons, I want to close port 22 (ssh) of my VM that is on GCP.
Currently, if I execute the command telnet xx.xx.xxx.xxx 22 the server responds to me:
Trying xx.xx.xxx.xxx...
Connected to ...
google-cloud-platform
-1
votes
1
answer
41
views
Possible to identify the application that is causing these entries in IIS Log?
I'm wondering if it's possible to identity the program that is causing these log entries in IIS. Could that be CuppaCMS that the program is looking for, hoping to exploit a vulnerability if it's ...
- 173
0
votes
2
answers
72
views
apache server not responding due to HTTP CONNECT requests how to block them?
Apache server is getting this kind of traffic. Due to that server is not responding. Please suggest how can we handle this issue.
78.135.85.252 - - [07/May/2023:16:08:33 +0000] "\x16\x03\x01"...
0
votes
0
answers
17
views
Does google colaboratory save code in local computer when using local runtime
When running python code from google colab into local computer (local runtime), does the code is saved in the local computer or not ?
- 1
-1
votes
1
answer
35
views
Does ssh save the code in the remote computer?
When running python code using ssh on remote computer by a sudo user, does it save the code in the remote computer ? does the root user can see actual python code?
ssh user@remotehost < python /...
- 1
0
votes
0
answers
32
views
How does pandora.x86 infect cloud servers?
We have a cloud server instance hosted at vultr. A previous instance at this provider has been infected by pandora.x86 a few weeks ago, causing 100% CPU load and over 1TB of traffic. (We believe it is ...
- 2,083
0
votes
1
answer
46
views
Configure Windows Firewall to block IPs listed in Spamhaus.org
Since having suffered a hack twice on my email server, the last one VERY severe, I have been VERY proactive in monitoring my logs and taking appropriate action when I see attacks. I've installed ...
-3
votes
1
answer
73
views
Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]
I've managed to find a lot of closely related information, but not an answer truly addressing my question.
I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
- 107
0
votes
0
answers
17
views
Hyper-V (Windows 11) - Disable all network access on host but not VMs
Is it possible to create a setup where the Windows 11 Hyper-V VM host has all network access completely disabled, but the VMs running on it still retain full access?
In a model similar to what Qubes ...
- 243
0
votes
0
answers
19
views
DISA STIG False Positives and Tailoring Profile
we currently use oscap to run security scans to validate configurations in DISA STIG for our Linux machines. We are seeing a lot of false positives and we are trying to figure out if there is a way to ...
0
votes
1
answer
27
views
AD Security by OU?
In our AD environment we maintain the Description field to help identify our computers.
I found that I and others on my team can update some system in certain OUs but cannot update them in others.
I ...
0
votes
0
answers
39
views
Modsecurity block access from all countries except from a specific IP or specific remote host
I have the below 3 rules in modsecurity.
Rule 1: Block all countries defined as high risk except US:
SecAction \
"id:900600,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx....
- 101
0
votes
1
answer
51
views
How to perform security updates of Docker Alpine
I stumbled upon a tricky situation: I read on the Docker Alpine main page that the image is getting updated every month for minor versions/security fixes. Packages with CVE are not updated for the ...
- 241
0
votes
1
answer
63
views
Strange attempted emails from Cron
I use Zoho for my email client and last night I got a couple of notifications saying:
Warning! Unverified sender. The system could not verify if this email
was sent by root@servername.com. Do not ...
- 125
0
votes
0
answers
21
views
How to configure osquery with auditd
Who has expertise on how to work with osquery (or maybe you solved this problem):
Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
0
votes
1
answer
148
views
Best way to handle directory/path traversal attacks on a Nginx http site
I have a Node.js-driven site running in a Docker container, and there's a public-facing proxy site driven by Nginx server that redirects traffic to the dockerized Node.js site. Studying the Nginx logs,...
- 155
0
votes
1
answer
91
views
Limiting outbound traffic to AWS Management Console or other Amazon consoles
I've a network whose outbound traffic is strictly limited to a whitelist of sites or domains. I searched and couldn't find any documentation about how could I allow stations on this network to use AWS ...
- 155
-1
votes
2
answers
59
views
Disabling SHA in IIS
My company has a web server running IIS 6, and was asked to help disable SHA on it.
Specifically this cipher: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
I found these instructions https://www.namecheap.com/...
- 207
0
votes
1
answer
61
views
Zsh function for checking for duplicate PATH entries and for occluded executables
This occurs on many systems and I expect someone has a solution for it.
The PATH environment variable is a major part of security issues. For sanity's sake, the path portion of the .zshrc looks like:
...
- 170
1
vote
1
answer
56
views
Hardening the security of a backup shell script of a web-server with mysql database
In the case of a simple web-server with a MySQL database, the script has to dump the database, copy the web-server files and tar everything together. Then a NAS server Rsync the tar file via a "...
- 11
0
votes
2
answers
117
views
apache remove wget for better security
Im no expert at IT or apache but I have used linux for years.
Ive done my best to harden/secure my server online which I use for a mobile app which
needs to serve up its content etc.
Ive noticed some ...
- 203
0
votes
0
answers
22
views
How do TOR nodes select the CircID's when creating, or extending, a circuit?
I am coding my own version of TOR and I am trying to set up circuit management. I looked at the TOR spec and it says:
To prevent CircID collisions, when one node sends a CREATE/CREATE2
cell to ...
- 1
1
vote
2
answers
73
views
What can you do when auditd halts the system?
I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again ...
- 111
0
votes
1
answer
57
views
Internet-facing port 443 in Azure - security concerns
I want to deploy a microservice on Azure Ubuntu VM using one of following stacks: docker-compose/AKS using Traeffic as reverse proxy.
I'm looking for cheapest but reasonable in terms of security ...
0
votes
1
answer
35
views
How to show a password-containing automated generated image, whose "content" is "copyable"? [closed]
I'm responsible for a MediaWiki in my company. That Mediawiki contains information, like passwords. Currently those passwords are stored on the server, hosting the MediaWiki, but when a person surfs ...
- 123
-1
votes
1
answer
31
views
Does blocking all output connections protect us from exploits on our server?
Let's say a hacker found a way to execute a vulnerability in my container and he can execute any code there (for example he has upload a bash file with HTTP protocoll). Let's make it more dangerous: ...
- 109
0
votes
1
answer
183
views
How to take ownership of all contents in CSC folder?
I have files that was saved as offline files from a Synology server to the CSC folder on my computer that I would like to delete. I cannot delete the files unless I individually take ownership of ...
0
votes
1
answer
147
views
I cannot find where 0002 umask is being set on Ubuntu 20.04
My user account has a non-standard umask setting of 0002, and I cannot find the config file where this is being set. I have searched in /etc and ~/.bash* with sudo grep -iIr umask. Running umask in ...
0
votes
0
answers
76
views
PHP-FPM + Apache2 security
I have configured my server (an Ubuntu 22.04 machine) so that it is managed by Apache (v2.4.55) and php7.4-fpm. The current configuration allows every vhosts to be divided into specific php-fpm pools, ...
- 1
0
votes
0
answers
488
views
Content-Security-Policy frame-ancestors not working
I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
- 101
0
votes
0
answers
142
views
Adding process to cgroup returns error "write error: Invalid argument"
On Red Hat 8.7 on x86_64 I would like to restrict process to be allowed to use only 50% of CPU time.
I tried to limit a process with cgroups following Red Hat tutorial
Setting CPU limits to ...
- 1
0
votes
0
answers
18
views
Security updates for linux server with only local network access
I am using Compute Engine and VPC Networks in Google Cloud Platform.
I have a "classic" frontend - backend server setup inside Google Cloud with two VPC Networks which are connected trough ...
1
vote
1
answer
82
views
(copy from Stackoverflow) Google Secret Manager- allow Compute Engine to auto-renew the certificates
Below is what I've posted at stackoverflow here that is not getting attention. I hope someone here is able to guide me to find the right answer.
I come with Azure background. In Azure, I could ...
0
votes
1
answer
34
views
How to protect Jenkins from super users?
Any super user who has access to the Jenkins running on a Linux server can easily disable security authentication from config.xml file; then log in and can also decrypt sensitive passwords from ...
bsd-boo
0
votes
0
answers
71
views
How to stop Windows Server 2022 successful anomymous RDP logins
I have a Windows Server 2022 server with IPBAN installed to make hacking it more difficult but in the logs occasionally I see:
2023-02-20 03:59:23.5304|WARN|IPBan|Login succeeded, address: XX.XXX.XXX....
0
votes
1
answer
71
views
Permission for Users group successfully modified via code, but change is not reflected in Security tab for the Users group
I have C# code (at the end) which:
Creates a file
Prints the current ACL
Gives the builtin users group "write permissions" to the previously created file
Prints the current modified ACL
...
- 89
0
votes
1
answer
40
views
What is the proper way to configure Tripwire to handle automatic log rotations?
I installed tripwire by following this online documentation on a fresh ubuntu 22.x server. I followed the above documentation exactly and did not add any custom mods to either the cfg or the pol ...
0
votes
0
answers
78
views
sshd allows login with no authentication all accounts
This morning I was logging into an Ubuntu 18 machine that luckily we use for testing and is not on the Internet. When my SSH client got to the authentication point I accidentally hit 'ESC' which means ...
- 13
0
votes
1
answer
186
views
how to SSH to Wireguard server from Windows client with active VPN connection?
I have Wireguard server on Rocky 8.7, when I connect to the server I route all client traffic through Wireguard
this is quotes from setup script, of course all variables is set (and all works good)
...
1
vote
1
answer
55
views
EXSi Arg Server attack
I have a very basic question. From what I have read, it seems these unpatched servers were directly attacked remotely through the internet via port 427. So unlike other ransomware attacks, the malware ...
- 21
0
votes
1
answer
48
views
FortiGate Next Gen Firewall AWS security groups
I'm new to AWS using a FortiGate in front as the gateway. Would you need to utilize the security groups, or could I make one to permit all traffic and attach it since the fortigate handles everything.
- 3
1
vote
0
answers
90
views
how to use PAM auth for ssh key clients?
How to unlock ssh private keys with PAM, so I can use fingerprintd module?
There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side.
Also, ...
- 303
0
votes
0
answers
42
views
backup /home over sftp - root
My current task is to set up a (remote) backup (using rsync/rsnapshot) over sftp of /home (linux). Obviously some files are read only for the owner (ie -r-------; and should stay that way) so i guess ...
- 1
0
votes
2
answers
84
views
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
I make few similar jails for different ports...
jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny
here firewalld and fail2ban settings for http_https_deny(other almost same, ...