Questions tagged [security]

Security is not a product, but a process.

Filter by
Sorted by
Tagged with
2352
votes
30answers
484k views

Our security auditor is an idiot. How do I give him the information he wants?

A security auditor for our servers has demanded the following within two weeks: A list of current usernames and plain-text passwords for all user accounts on all servers A list of all password ...
604
votes
13answers
139k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
363
votes
21answers
61k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
323
votes
6answers
413k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. /var/...
203
votes
9answers
31k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are ...
196
votes
22answers
92k views

Is it normal to get hundreds of break-in attempts per day?

I just checked my server's /var/log/auth.log and found that I'm getting over 500 failed password/break-in attempt notifications per day! My site is small, and its URL is obscure. Is this normal? ...
180
votes
5answers
21k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
146
votes
3answers
62k views

Possible to change email address in keypair?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.) I've now changed my email address. Is it possible to change the email address on ...
122
votes
5answers
33k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
121
votes
7answers
31k views

How does CTRL-ALT-DEL to log in make Windows more secure?

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination ...
118
votes
11answers
94k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
110
votes
8answers
36k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
105
votes
20answers
26k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
104
votes
5answers
34k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
98
votes
5answers
96k views

“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
96
votes
6answers
20k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
94
votes
17answers
49k views

Does drilling a hole into a hard drive suffice to make its data unrecoverable?

We have a lot of PCs in the company and nobody wants to wipe a multitude of hard drives. We also have many apprentice toolmakers who really want to destroy things. Thus, every couple of months, our ...
93
votes
7answers
120k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
88
votes
8answers
44k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
85
votes
9answers
74k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
85
votes
3answers
157k views

How to check if an RSA public / private key pair match

I have two files, id_rsa and id_rsa.pub. What command can be used to validate if they are a valid pair?
82
votes
11answers
89k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
80
votes
6answers
63k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
76
votes
5answers
9k views

How do I protect my company from my IT guy? [closed]

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT. Of course, I'll interview carefully, check references, and run a ...
76
votes
7answers
119k views

OpenVPN vs. IPsec - Pros and cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPsec". So here's my question: I need to set up a private LAN over an untrusted network. And as far as I know, ...
71
votes
3answers
40k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
70
votes
11answers
27k views

Does changing default port number actually increase security?

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
69
votes
11answers
24k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
68
votes
3answers
210k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
67
votes
8answers
15k views

A previous IT worker probably left some backdoors. How can I eliminate them? [duplicate]

I started working for a company that fired a previous IT worker for leaking data. I can only say the following things: We use a Firebird DB with an application written by another company, Proxmox, ...
66
votes
15answers
14k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard system-...
66
votes
13answers
9k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
66
votes
8answers
58k views

What steps do you take to secure a Debian server? [closed]

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
65
votes
6answers
13k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
63
votes
3answers
102k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
63
votes
4answers
23k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
61
votes
4answers
163k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other services....
59
votes
40answers
6k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...
59
votes
8answers
7k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
59
votes
9answers
9k views

Is it OK to set up passwordless `sudo` on a cloud server?

I love the idea of accessing servers via keys, so that I don't have to type in my password every time I ssh into a box, I even lock my user's (not root) password (passwd -l username) so it's ...
58
votes
6answers
5k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
57
votes
2answers
14k views

Why does AWS recommend against public S3 buckets?

"We highly recommend that you never grant any kind of public access to your S3 bucket." I have set a very granular public policy (s3:GetObject) for one bucket that I use to host a website. Route53 ...
56
votes
2answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
56
votes
4answers
128k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
54
votes
10answers
34k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
53
votes
3answers
55k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
51
votes
19answers
4k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
51
votes
2answers
7k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
51
votes
2answers
58k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file /etc/apache2/...
51
votes
4answers
3k views

Linux: set up for remote sysadmin

Every now and then I get the odd request to provide remote support, troubleshooting and/or performance tuning on Linux systems. Larger companies often already have well established procedures to ...

1
2 3 4 5
127