Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
2493 votes
31 answers
555k views

Our security auditor is an idiot. How do I give him the information he wants?

A security auditor for our servers has demanded the following within two weeks: A list of current usernames and plain-text passwords for all user accounts on all servers A list of all password ...
user avatar
632 votes
13 answers
166k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
gunwin's user avatar
  • 6,420
378 votes
22 answers
67k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
Jason Berg's user avatar
  • 19.2k
373 votes
6 answers
577k views

What permissions should my website files/folders have on a Linux webserver?

This is a Canonical Question about File Permissions on a Linux web server. I have a Linux web server running Apache2 that hosts several websites. Each website has its own folder in /var/www/. /var/...
Nic's user avatar
  • 13.5k
207 votes
3 answers
116k views

Possible to change email address in keypair?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.) I've now changed my email address. Is it possible to change the email address on ...
Ram Rachum's user avatar
  • 5,291
204 votes
9 answers
33k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are ...
Jacob's user avatar
  • 9,242
202 votes
14 answers
256k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
pdeva's user avatar
  • 2,517
196 votes
22 answers
111k views

Is it normal to get hundreds of break-in attempts per day?

I just checked my server's /var/log/auth.log and found that I'm getting over 500 failed password/break-in attempt notifications per day! My site is small, and its URL is obscure. Is this normal? ...
Kyle Cureau's user avatar
  • 1,537
191 votes
5 answers
27k views

I am under DDoS. What can I do?

This is a Canonical Question about DoS and DDoS mitigation. I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all ...
Falcon Momot's user avatar
  • 25.3k
157 votes
5 answers
351k views

How to check if an RSA public / private key pair match

I have two files, id_rsa and id_rsa.pub. What command can be used to validate if they are a valid pair?
Ryan's user avatar
  • 6,011
140 votes
4 answers
46k views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
Make Mark's user avatar
  • 1,994
124 votes
7 answers
34k views

How does CTRL-ALT-DEL to log in make Windows more secure?

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination ...
Eddie's user avatar
  • 11.5k
123 votes
8 answers
56k views

How can I implement ansible with per-host passwords, securely?

I would like to use ansible to manage a group of existing servers. I have created an ansible_hosts file, and tested successfully (with the -K option) with commands that only target a single host ...
supervacuo's user avatar
  • 1,433
121 votes
7 answers
204k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
Mike B's user avatar
  • 12k
110 votes
20 answers
31k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
Ernie's user avatar
  • 5,352
107 votes
6 answers
117k views

"POSSIBLE BREAK-IN ATTEMPT!" in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
Mike B's user avatar
  • 12k
107 votes
5 answers
39k views

SSH keypair generation: RSA or DSA?

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?
Brad Ackerman's user avatar
103 votes
6 answers
24k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
Aditya Shukla's user avatar
102 votes
9 answers
107k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
Geo's user avatar
  • 3,081
99 votes
17 answers
88k views

Does drilling a hole into a hard drive suffice to make its data unrecoverable?

We have a lot of PCs in the company and nobody wants to wipe a multitude of hard drives. We also have many apprentice toolmakers who really want to destroy things. Thus, every couple of months, our ...
RubbelDieKatz's user avatar
96 votes
4 answers
170k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
88 votes
8 answers
47k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
Martijn's user avatar
  • 833
88 votes
1 answer
192k views

Explanation of nodev and nosuid in fstab

I see those two options constantly suggested on the web when someone describes how to mount a tmpfs or ramfs. Often also with noexec but I'm specifically interested in nodev and nosuid. I basically ...
Ivan Kovacevic's user avatar
82 votes
7 answers
138k views

OpenVPN vs. IPsec - Pros and cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPsec". So here's my question: I need to set up a private LAN over an untrusted network. And as far as I know, ...
jens's user avatar
  • 1,001
82 votes
11 answers
91k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
Saif Bechan's user avatar
80 votes
6 answers
65k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
gtirloni's user avatar
  • 5,795
77 votes
4 answers
293k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
Ian Boyd's user avatar
  • 5,373
75 votes
12 answers
37k views

Does changing default port number actually increase security? [closed]

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
Sam's user avatar
  • 975
75 votes
5 answers
10k views

How do I protect my company from my IT guy? [closed]

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT. Of course, I'll interview carefully, check references, and run a ...
Jesse's user avatar
  • 1,910
74 votes
11 answers
34k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
Septagram's user avatar
  • 937
74 votes
3 answers
49k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
Michael Hampton's user avatar
73 votes
6 answers
229k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
setatakahashi's user avatar
72 votes
4 answers
187k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
gharper's user avatar
  • 5,465
71 votes
9 answers
108k views

Cannot SSH: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY [closed]

We have a server on Amazon EC2 running SSH is on a standard (22) port. I placed my public key at the <username>/.ssh/authorized_keys file. The fun thing is that yesterday it was working great! ...
bakytn's user avatar
  • 1,287
71 votes
3 answers
71k views

How to use docker secrets without a swarm cluster?

Currently we im a running application on a single docker container, the application needs all sorts of sensitive data to be passed as environments variables, Im putting those on the run command so ...
Juan Sebastian's user avatar
70 votes
15 answers
16k views

Are IP addresses "trivial to forge"?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard system-wide ...
Jeff Atwood's user avatar
  • 13.2k
70 votes
3 answers
75k views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
Totor's user avatar
  • 2,996
69 votes
8 answers
15k views

A previous IT worker probably left some backdoors. How can I eliminate them? [duplicate]

I started working for a company that fired a previous IT worker for leaking data. I can only say the following things: We use a Firebird DB with an application written by another company, Proxmox, ...
user2265690's user avatar
69 votes
7 answers
224k views

Redis (error) NOAUTH Authentication required

I get the error: (error) NOAUTH Authentication required. When in redis-cli and trying to display the KEYS *. I've only set a requirepass not an auth afaiac. I'm in the redis.conf but do not know ...
Karl Morrison's user avatar
69 votes
11 answers
219k views

How do I check if Log4j is installed on my server?

I have read about security vulnerabilities related to Log4j. How do I check if Log4j is installed on my server? My specific servers use Ubuntu 18.04.6 LTS. I have installed many third-party packages ...
Uri's user avatar
  • 881
68 votes
2 answers
20k views

Why does AWS recommend against public S3 buckets?

"We highly recommend that you never grant any kind of public access to your S3 bucket." I have set a very granular public policy (s3:GetObject) for one bucket that I use to host a website. Route53 ...
Andrew Johnson's user avatar
66 votes
8 answers
62k views

What steps do you take to secure a Debian server? [closed]

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
66 votes
5 answers
196k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other services....
abitgone's user avatar
  • 1,343
65 votes
6 answers
13k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
Flup's user avatar
  • 8,108
65 votes
4 answers
24k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
user664833's user avatar
  • 1,277
64 votes
13 answers
9k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
Matt's user avatar
  • 1,047
64 votes
2 answers
104k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file /etc/apache2/...
user avatar
63 votes
9 answers
14k views

Is it OK to set up passwordless `sudo` on a cloud server?

I love the idea of accessing servers via keys, so that I don't have to type in my password every time I ssh into a box, I even lock my user's (not root) password (passwd -l username) so it's ...
Dmitry Pashkevich's user avatar
61 votes
8 answers
8k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
Aitch's user avatar
  • 1,179
59 votes
40 answers
6k views

How do you manage your passwords?

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could ...

1
2 3 4 5
139