Questions tagged [security]

Security is not a product, but a process.

894 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10
votes
1answer
3k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request interface ...
9
votes
0answers
349 views

Can Asterisk's phoneprov module be used securely?

I'm using Asterisk 13.1.0 as packaged by Ubuntu Server 16.04 to run a pure-VoIP phone system. Asterisk has a module – phoneprov – that allows it to template out configuration files for ...
8
votes
1answer
168 views

Can Samhain monitor for a file that does not exist, but might in future?

I would like Samhain to monitor a file, say for example, /root/somefile. This file does not currently exist, but I would like to be notified if it gets created at any point. I add this to samhainrc: ...
8
votes
0answers
1k views

CentOS 6 local update repository and security updates

I know that official CentOS 6 (even 7) update repositories does not provide security information. The consequence is thatyum-plugin-security plugin and yum check-update --security command does not ...
5
votes
2answers
8k views

Windows 2008 R2 Server Security Log filling with event 521

I understand that status code 0xc0000008 means Invalid Handle. How do you resolve this issue (besides a restart)? What is the best way to determine the cause for this? Log Name: Security ...
5
votes
1answer
1k views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
4
votes
2answers
1k views

Remote Desktop Authentication without NTLM - How to Configure from non-Windows clients?

Background This has been bugging me for quite a while (and no amount of internet searching has amounted to a decent solution), so I'm hoping someone can offer some sage advice. When I try and start a ...
4
votes
0answers
80 views

Dynamically set the screen lock timeout depending on network interface

We need to configure the screen lock timeout on our laptop machines so that the inactivity time dynamically changes according to the connection: if the laptop is directly connected to the corporate ...
4
votes
2answers
213 views

Stop Google forcing a password change on newly created accounts

I'm in the process of implementing Google's GSuite Password Synch on a Windows Server 2016 AD system. I've installed the Cloud Directory Sync software which successfully creates new users in GSuite ...
4
votes
0answers
139 views

Erase GPU memory

We have Nvidia GPU cards that can be used by different users in an OpenStack environment. A first user creates a VM with access to a GPU card, then deletes the VM when done. Another user then creates ...
4
votes
0answers
542 views

Why are WSUS shared folders shared out to entire network?

I set up a Server 2012 R2 instance as a WSUS server and went through initial set up. But now, from another computer on LAN, when I type explore to the server via UNC path I see Wsuscontent and ...
4
votes
0answers
90 views

Does the default Apache build not have PIE (position independent executable)?

I just built Apache from source, not something I usually do, and noticed that one of the build options was: --enable-pie This builds httpd as a Position Independent Executable which as I understand ...
4
votes
0answers
104 views

Jenkins: How to verify downloaded plugins against security threat or corruption?

I am running a Jenkins 2.67 on a Red Hat 7 inside a corporate network. It can only access internet over a forward proxy restricting requests to HTTPS URLs only. By default Jenkins downloads the ...
4
votes
1answer
724 views

How well does haproxy scale for handling client certificate authentication?

As this is a performance-based question about a security issue, some folks at Information Security suggested I post here: My IoT company would like to use client certificate authentication to secure ...
4
votes
0answers
736 views

Non-admin users can't run MMC on Windows Server 2008 domain controller

I have created some delegated privileges for IT administrators. One of the groups of people has some Active Directory permissions but is not server administrators or domain administrators. They also ...
3
votes
1answer
876 views

How to assign a Windows service least privileges to provision new accounts

We have a Windows service which currently runs as LOCAL_SYSTEM - effectively a local administrator. One of the functions of the service is to provision new local accounts and add them to a specific ...
3
votes
0answers
176 views

Shared hosting: Apache RewriteRule [P] flag security concern

I want to setup PHP-FPM with Apache in a shared hosting environment. The recommended way is to use mod_proxy_fcgi. Each customer has his own FPM pool, running PHP processes under his own system user. ...
3
votes
0answers
34 views

How to filter external HTTP requests using on remote host location and GET parameters with Tomcat8?

I have a tomcat 8 web applications server and it has a running application (/app). This /app can be accessed from both internal and external HTTP GET requests but 1 request from external should be ...
3
votes
0answers
72 views

Are there risks / downsides to creating users who are required to login with the LogonType of “Batch”

I am a vendor providing instructions to my users to cover of the situation where they want to create users on a windows server simply for the purpose of authentication. Note: Active Directory is ...
3
votes
0answers
46 views

Chroot SFTP Group

I have a CentOS 6.9 file server set up. Everyone in the company is given access as a member of the staff group. They're dropped into /home/sharedfolder when they connect, however they're able to jump ...
3
votes
1answer
68 views

Spamassasin user - disable shell

I recently discovered that spamassasin added the following line to my passwd file: debian-spamd:x:115:122::/var/lib/spamassassin:/bin/sh. Why does spamassasin need shell access? Is it safe to disable ...
3
votes
0answers
1k views

Constant Audit Failures in Event Viewer from Users not logged on

Let me start off with some details on my environment: Windows Active Directory Domain Environment Domain Controller: Windows Server 2003 R2 Problem Workstation: Windows 7 Professional 64-bit Lately ...
3
votes
1answer
1k views

how to disable run via search on Windows 10?

We are trying to prevent our users from running various commands that we don't specifically approve. We have implemented Applocker, but that doesn't prevent the user from running commands beginning ...
3
votes
0answers
71 views

User friendly way to secure a legacy application over the Internet?

I'm dealing with a proprietary, legacy VMS (Video Management System) that is connected to IP cameras for remote surveillance. The system is exposed on the public Internet on port 8016 and users are ...
3
votes
0answers
193 views

Open LDAP authenticates LDAP users as local admin account - Linux - Ubuntu 14

So, I thought my LDAP was working perfect, but today I went to log in, and its authenticating me, but its showing i'm the local Admin account, even whoami says so, and I have full root access like ...
3
votes
0answers
414 views

Strange hack attempt to postfix

Yesterday I got a email sent {@DOMAIN.ORG from my mailserver the mail was marked as spam. The body included scripts download commands like ftp://ftp.ugotownedz.org/upfile2.sh lines from syslog Aug ...
3
votes
1answer
93 views

Privacy concerns with windows 10 Pro

I don't need any of the Windows 10 enterprise features but enterprise is the only one that (legitimately) allows me to turn off the CEIP (Customer Experience Improvement Program); this is the ...
3
votes
0answers
327 views

Enforcing audit settings for all subfolders and files on NTFS

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS ...
3
votes
0answers
362 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 09:...
3
votes
0answers
86 views

security audit flags redhat/centos package version numbers despite patches

Redhat has this policy of backporting security fixes. But then when RHEL and CentOS sites get audited, the auditors invariably just list the package versions or ask ssh what it's version number is, ...
3
votes
1answer
405 views

My event log has corrupted DACL 'Write Attributes' in 4656 file audit events

I have been scripting a procedure in powershell to pull security event logs from my windows 2012r2 server. Investigating a bug in my procedure to parse the event into xml I discovered a very strange ...
3
votes
0answers
476 views

EC2 automatic windows updates disabled by default on Windows Server 2008 R2 - why?

I spun up an Amazon virtual instance for Windows 2008 R2 Datacenter Edition and when I went into Windows Updates in control panel, automatic updates were turned off. I turned them on and checked for ...
3
votes
1answer
215 views

How to secure an open proxy (mod_proxy) for demoing service

A client has a service that requires a bit javascript to be added to a customer's page. As a marketing tool to show prospective customers, I created a web app that demonstrates how the customer's page ...
3
votes
1answer
43 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
3
votes
0answers
873 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
3
votes
0answers
200 views

Creating an Openstack user with only reboot permissions

What is the best approach for setting up an Openstack user that is limited to only rebooting servers using the Web API. The user needs to be able to access servers under different tenants, by using ...
3
votes
1answer
690 views

Is Exchange protected from/allow back dated emails?

Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
3
votes
1answer
273 views

Grsecurity's RBAC policy for scripts

I have some problems with set right policy for my gentoo-based system. I have no idea how can I add permissions for everything which was started by /root/scripts/autosync. I am getting error like: [...
2
votes
0answers
24 views

Why is a AD Domain controller object set to “unconstrained delegation”? Can this be altered?

As part of identifying accounts with "unconstrained Delegation" , it came to our notice that all domain controllers are configured that way. Can i change "unconstrained delegation" setting on all ...
2
votes
1answer
144 views

Can an Active Directory CA issue certificates for one-way trusted domains?

Our network is composed primarily of Windows servers on our internal domain which is managed by Active Directory (natch). We also have a small population of Linux servers which, for reasons, are ...
2
votes
1answer
29 views

z/OS Protecting Master Catalog from AdHoc updates

I have a development system that multiple developers are working on. The current configuration allows any request for a new dataset to be catalogued in the Master catalog. To protect the master ...
2
votes
0answers
453 views

How to configure Content-Security-Policy for Nginx and Drupal 8?

I have a Nginx server with Ubuntu 18.04 and a Drupal 8 site. I have read on several articles that should not use 'unsafe-eval', 'unsafe-inline' I added headers for security but the pages of the site ...
2
votes
1answer
93 views

DMZ Setup Reality Check?

I'm currently doing some upgrades to servers and networking in our network and I'm looking for a reality check on our DMZ configuration. I put it together quite a long time ago and I'm wondering if ...
2
votes
0answers
254 views

hosts.allow, hosts.deny : One rule per service?

In quite a few places (some old, some recent) it's stated that the tcp-wrappers configuration files /etc/hosts.allow, /etc/hosts.deny allow only one rule per service. This looks wrong to me, I write ...
2
votes
0answers
128 views

Attempting to delete cron directory in docker gives “Invalid argument”

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image. docker run -it alpine:3.7 rm -rf /var/spool/cron rm: can't remove '/var/spool/cron': Invalid ...
2
votes
1answer
768 views

Securing NFSv4 WITHOUT Kerberos on a public cloud?

I've lost enough hair trying to setup this Kerberos nonsense. Is there any way to secure an NFS v4 setup without using Kerberos on a public cloud, i.e: all servers have a public IP (there is no ...
2
votes
1answer
361 views

Suricata: [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error Invalid argument

I set up suricata on my server (via docker container). It works really great on one of my interfaces. But If I create another container for another interface the container stops with exit code 0 and ...
2
votes
1answer
961 views

IMAP connections from Microsoft IP addresses when using Outlook

I run a Linux based mail server and use Dovecot to provide IMAP over TLS access. This server has been up and running for a bit more than 8 years now and it serves my email address along with those of ...
2
votes
0answers
172 views

AWS ElasticSearch on private subnet - safe to have no signed url/access policy?

I have an ES cluster setup within our VPC and attached to one of our private subnets. It's also attached to a security group allowing access from particular instances. I have the following policy ...
2
votes
0answers
67 views

Why a TCP connection fail faster on Linux closed ports than on Windows ones?

While trying the simple exploit described here I noticed that it doesn't works on Linux while it works on Windows (tried with several browsers). Apparently this is because, on Linux, the operating ...

1
2 3 4 5
18