Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
202 votes
14 answers
256k views

How to view all ssl certificates in a bundle?

I have a certificate bundle .crt file. doing openssl x509 -in bundle.crt -text -noout only shows the root certificate. how do i see all the other certificates?
pdeva's user avatar
  • 2,517
80 votes
6 answers
65k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
gtirloni's user avatar
  • 5,795
75 votes
12 answers
37k views

Does changing default port number actually increase security? [closed]

I have seen advice saying you should use different port numbers for private applications (e.g. intranet, private database, anything that no outsider will use). I am not entirely convinced that can ...
Sam's user avatar
  • 975
72 votes
4 answers
187k views

How can I allow one user to su to another without allowing root access?

I'd like to allow certain users to su to another user account without having to know that account's password, but not allow access to any other user account (i.e. root). For instance, I'd like to ...
gharper's user avatar
  • 5,465
71 votes
9 answers
108k views

Cannot SSH: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY [closed]

We have a server on Amazon EC2 running SSH is on a standard (22) port. I placed my public key at the <username>/.ssh/authorized_keys file. The fun thing is that yesterday it was working great! ...
bakytn's user avatar
  • 1,287
54 votes
2 answers
10k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
Brian Lyttle's user avatar
  • 1,757
49 votes
8 answers
17k views

What are best practices for managing SSH keys in a team?

I work with small teams (<10) of developers and admins with the following characteristics: Most members of the team have >1 personal computer, most of which are portable Team members have access ...
Evan Prodromou's user avatar
47 votes
6 answers
76k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
jtimberman's user avatar
  • 7,597
42 votes
6 answers
6k views

Avoid to keep command in history

I use bash and I would like to avoid some commands being kept in the history. Is it possible to do that for the next command only? Is it possible to do that for the entire session?
Luc M's user avatar
  • 3,290
37 votes
10 answers
15k views

Securing a fresh Ubuntu server [closed]

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?
30 votes
11 answers
45k views

Live view of Linux shell commands executed by another user?

Is it possible for the root user in Linux to have a real-time (or close to real-time) view of the shell commands being run by another user logged in via a terminal or SSH? Obviously they're stored in ....
EMP's user avatar
  • 5,162
26 votes
8 answers
2k views

What should I do about a "misbehaving" user?

What should I do about this user? The user is: Downloading pornography Attempting unauthorized access Running hacking software Sending unsolicited email Installing software / tampering with the ...
Tim Brigham's user avatar
  • 15.6k
24 votes
6 answers
59k views

Prevent SSH from advertising its version number

The server I am using is Ubuntu 10.10. To ensure security I want to edit the banner the server sends to the client. If I telnet to my host on port 22 it tells me the exact version of SSH I am ...
Lerikun's user avatar
  • 243
16 votes
2 answers
30k views

vsftp: why is allow_writeable_chroot=YES a bad idea?

There are several thousand blog posts about vsftp and allow_writeable_chroot=YES The common error message: Fixing 500 OOPS: vsftpd: refusing to run with writable root inside chroot () I solved ...
guettli's user avatar
  • 3,823
16 votes
3 answers
4k views

Log every command executed from root

I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
cedivad's user avatar
  • 690
15 votes
2 answers
2k views

how do i perform root actions from non-root account?

I want to be able to restart services from a php-script. running under the www-user account. What's the preferred way to perform these actions? I recon I can place create a file with que'd commands, ...
user65297's user avatar
  • 335
14 votes
4 answers
6k views

Is iLO safe enough to be hung on the WAN

I am wondering if iLO is safe enough to be hung on the WAN, I looked for some articles but could not find any ? How do you guys secure iLO ? Do you put it behind a firewall ? Would you use a ...
Lucas Kauffman's user avatar
14 votes
1 answer
30k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
Stefan Lasiewski's user avatar
11 votes
3 answers
6k views

Bastion server: use TCP forwarding VS placing private key on server

We have bastion server B. We need to SSH from A through B to C, using private key. What is the better option: Put the private SSH key on server B. We read that it's a bad idea to do that in a ...
user2503775's user avatar
9 votes
2 answers
12k views

Admin password of MariaDb doesn't seem to work

I've just installed MariaDb on a fresh Ubuntu Gnome and ran mysql_secure_installation afterwards where I set a decent admin password, removed the anonymous user etc. Afterwards I realized some ...
suamikim's user avatar
  • 193
9 votes
6 answers
114k views

How to enable Audit Failure logs in Active Directory?

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how! How do I enable ...
Jake's user avatar
  • 1,172
6 votes
3 answers
5k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
Jeff Ferland's user avatar
  • 20.7k
6 votes
2 answers
3k views

SYN Flood Advice

Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a ...
Coops's user avatar
  • 6,105
3 votes
2 answers
1k views

Read access control with Mercurial and Apache

I've set up Mercurial via Apache (hgwebdir.cgi). I would like to have the same functionality as when using Subversion and AuthzSVNAccessFile, in which I can restrict which user has read or write ...
mgv's user avatar
  • 133
3 votes
4 answers
2k views

Is there a static, server-side vulnerability/virus/malware/BadThings™ scanner?

We run a shared hosting webserver with the usual LAMP stack. It is up and running since many years ago (uhm, Apache-1.3 and PHP-3 days?) and went through many iterations. We strive to have good ...
Luke404's user avatar
  • 5,886
2 votes
3 answers
1k views

bind9 in a chroot jail - necessary or not?

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot ...
Danilo Bargen's user avatar
0 votes
2 answers
91 views

Regarding a rented dedicated server, can I remove IPMI (or relevant software) access and OOB (out-of-band) access to the server?

I am trying to secure a rented, dedicated server as much as possible. In my research I found that the hosting provider is likely to have access via IPMI and OOB. Is there anyway to prevent this, or ...
almighty's user avatar
107 votes
6 answers
117k views

"POSSIBLE BREAK-IN ATTEMPT!" in /var/log/secure — what does this mean?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening ...
Mike B's user avatar
  • 12k
102 votes
9 answers
107k views

How to add a security group to a running EC2 Instance?

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?
Geo's user avatar
  • 3,081
99 votes
17 answers
88k views

Does drilling a hole into a hard drive suffice to make its data unrecoverable?

We have a lot of PCs in the company and nobody wants to wipe a multitude of hard drives. We also have many apprentice toolmakers who really want to destroy things. Thus, every couple of months, our ...
RubbelDieKatz's user avatar
82 votes
11 answers
91k views

Dealing with HTTP w00tw00t attacks

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the ...
Saif Bechan's user avatar
74 votes
11 answers
34k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
Septagram's user avatar
  • 937
74 votes
3 answers
49k views

What is the difference between /sbin/nologin and /bin/false?

I have often heard it recommended that a user account should be disabled by setting its shell to /bin/false. But, on my existing Linux systems, I see that a great number of existing accounts (all of ...
Michael Hampton's user avatar
73 votes
6 answers
229k views

How to remove strict RSA key checking in SSH and what's the problem here?

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key: $ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: ...
setatakahashi's user avatar
69 votes
11 answers
219k views

How do I check if Log4j is installed on my server?

I have read about security vulnerabilities related to Log4j. How do I check if Log4j is installed on my server? My specific servers use Ubuntu 18.04.6 LTS. I have installed many third-party packages ...
Uri's user avatar
  • 881
65 votes
4 answers
24k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
user664833's user avatar
  • 1,277
64 votes
2 answers
104k views

What Should be the Permissions of Apache SSL Directory, Certificate, and Key?

I have my cert.pem and cert.key files in /etc/apache2/ssl folders. What would be the most secure permissions and ownership of: /etc/apache2/ssl directory /etc/apache2/ssl/cert.pem file /etc/apache2/...
user avatar
52 votes
19 answers
4k views

The IT Manager is Leaving - What do I lockdown?

The IT Manager may be leaving, and it's possible that the parting of ways may not be completely civil. I wouldn't really expect any malice but just in case, what do I check, change or lock down? ...
Marko Carter's user avatar
  • 4,112
51 votes
4 answers
3k views

Linux: set up for remote sysadmin

Every now and then I get the odd request to provide remote support, troubleshooting and/or performance tuning on Linux systems. Larger companies often already have well established procedures to ...
HBruijn's user avatar
  • 80.3k
44 votes
9 answers
57k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> Now ...
q9f's user avatar
  • 640
41 votes
7 answers
25k views

Reasons to disable / enable SELinux

In the line of this question on StackOverflow and the completely different crowd we have here, I wonder: what are your reasons to disable SELinux (assuming most people still do)? Would you like to ...
wzzrd's user avatar
  • 10.5k
34 votes
4 answers
71k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
RandomDev's user avatar
  • 341
32 votes
5 answers
16k views

Functional implications of differences in SSL and TLS

I know that TLS is essentially a newer version of SSL, and that it generally supports transitioning a connection from unsecured to secured (commonly through a STARTTLS command). What I don't ...
Randell's user avatar
  • 1,203
31 votes
8 answers
3k views

Securing PHP webservers

PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible? I'm looking for ideas ...
David Pashley's user avatar
30 votes
6 answers
35k views

Is there a windows equivalent to chroot?

On a *nix system I can use a chroot to isolate two processes from each other and from the rest of the system. Is there any similar security system under windows? Or is there any way to prevent two ...
Rook's user avatar
  • 2,695
29 votes
10 answers
14k views

I just did a chmod -x chmod

So I did a chmod -x chmod. How I can fix this problem? How do I give execute rights back to chmod?
Rook's user avatar
  • 2,695
29 votes
3 answers
9k views

What kinds of security vulnerabilities does providing DNSSEC expose?

I was planning to sign my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider (namely ...
Johann Bauer's user avatar
29 votes
4 answers
139k views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
Erathiel's user avatar
  • 711
24 votes
3 answers
8k views

Are DNS records private information?

Assuming you wanted to create a subdomain that points to a private location (perhaps the location of a database, or the IP address of a computer you don't want people to attempt SSH-ing into), so you ...
IQAndreas's user avatar
  • 1,580
24 votes
9 answers
20k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
jldugger's user avatar
  • 14.5k

1
2
3 4 5
11