1. In computers and computer networks, a configuration often refers to the specific hardware and software details in terms of devices attached, capacity or capability, and exactly what the system is made up of. 2. In networks, a configuration often means the network topology. 3. In installing ...

learn more… | top users | synonyms (1)

0
votes
1answer
32 views

Secure Django Application

What are some of the recommended configuration settings to secure your Django application? i.e. best practices for settings.py file. I researched and came across some: SESSION_COOKIE_SECURE = True ...
1
vote
2answers
71 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, ...
2
votes
2answers
37 views

Disable all SSH security mechanisms for a private subnet

So I'm running a private subnet where there is no internet connectivity, I understand the grave danger of running an ssh server on the internet without security. In short I would like to be able to ...
0
votes
0answers
28 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
7
votes
3answers
207 views

What is a good source for hardened base configurations

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is ...
0
votes
1answer
105 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
0
votes
1answer
245 views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
16
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
1
vote
0answers
59 views

How does Travis CI protect itself against being used for attacks?

Travis CI allows anyone to run any code on their servers by checking it into GitHub. How do they ensure that someone isn't taking advantage of their servers to launch an attack or other malicious ...
3
votes
2answers
1k views

How do I securely separate a wireless subnet from the wired network?

My setup looks like this: In the interest of security, I'd like to separate the wired network (where the Workstation is plugged in) from the wireless subnet. I don't trust some of the devices in ...
5
votes
4answers
437 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
1
vote
1answer
220 views

OSSEC on an existing running machine

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion. zcat /var/log/*.gz | ...
0
votes
0answers
64 views

Protecting computers from quick physical access attacks [duplicate]

What steps need to be taken to protect a computer from quick attacks that involve physical access? (Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; ...
61
votes
9answers
10k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
1
vote
2answers
176 views

How should I store and maintain secure configuration documents?

We have many scripts that we call "secure baselines" that allow our server/desktop installation people to install operating systems using best security practice. We test that the baselines have been ...
11
votes
1answer
12k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
75
votes
14answers
15k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
2
votes
2answers
287 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
8
votes
1answer
2k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
2
votes
3answers
1k views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
5
votes
2answers
217 views

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
2
votes
3answers
331 views

rancid like tool for config files

I need to be able to watch directories on our servers, and track changes to files as part of our audit compliance. I have adjusted auditd to watch the directories, and send all writes and attribute ...
2
votes
3answers
1k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...
3
votes
1answer
86 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
4
votes
2answers
3k views

Disabling authentication via DSA keys in OpenSSH?

How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...
-1
votes
1answer
73 views

Configuration for a server [closed]

I would like to configure a server and need guidance in assembling a server. I do not wish to spend much but at the same time I do not wish to compromise on performance. The purpose for my server ...
-5
votes
2answers
249 views

What technologies are recommended for E-banking? [closed]

If a Linux user need use his bank account from Internet, then what technologies and procedures should use? Is better to use the Guest Account (if exist) of the OS, or an Administrator Account? What ...
6
votes
3answers
919 views

IIS and SQLServer Hardening

long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
12
votes
2answers
264 views

What is the best way to verify the SSL configuration of my web server?

How do I ensure I have my SSL configuration setup securely?
18
votes
5answers
3k views

Where can I find a solid BURP tutorial?

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
6
votes
2answers
2k views

Security Concerns with TCP Forwarding

Until now I've been setting TCP Forwarding in ssh always blindly to no but searching on the net, I have trouble finding out what the actual security threat is, when allowing it. The one thing I did ...
2
votes
2answers
989 views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...
2
votes
1answer
713 views

Encrypting configuration on shared IIS7 hosting that uses load balancing

When hosting a site on a cluster (or cloud configuration) we need to specify a Machine Key in the web.config file. This is needed to keep the machines in sync (often the first encounter with this is ...
5
votes
1answer
258 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
1
vote
1answer
237 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
2
votes
2answers
293 views

unix config scanner / compliance checks

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds PermitRootLogin yes in the ssh config file or with other words: a script that automates ...
2
votes
2answers
327 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
2
votes
2answers
119 views

What not to reveal of OS configuration

I thought that I should publicize all my programming on a web page so someone will hire me as a programmer. I got tempted to include not only programs but my .emacs, .bashrc, and .Xresources files. ...
7
votes
4answers
4k views

What do I need to configure, to make sure my software uses /dev/urandom?

When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random? Some servers don't have much entropy in the entropy pool ...
5
votes
1answer
221 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
8
votes
1answer
687 views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
2
votes
2answers
657 views

up2date tools for security audit linux / centos

I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server. There are a lot of non up2date tools out ...
1
vote
2answers
3k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
2
votes
1answer
1k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
5
votes
1answer
2k views

Implications of using DNS Forwarders instead of Root Hints

When redesigning an organizations DNS infrastructure, the question of using Forwarders instead of Root Hints comes up. What kinds of issues should I be aware of when the admins and designers start ...
5
votes
3answers
612 views

Why would configuring a Blackberry to turn radio off when charging help with security?

A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy. Has ...
1
vote
0answers
311 views

PF NFS Firewall Issue [closed]

I have a question about NFS and PF (freebsd). I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port numbers. Both the NFS server and ...
5
votes
5answers
427 views

Any value in a web-server closing connections on bad requests (or bad pages)?

At least one web-server, nginx, has the ability to "close the connection without sending any headers", by configuring it to return a (nonstandard) 444 to various malformed HTTP requests. Is there any ...
5
votes
1answer
354 views

mcollective Review and Security Considerations

The use of PuppetLab's mcollective is being planned by my company's SysOps team. I will be reviewing their use of the tool and implementation of the system. At this point I don't have a lot of ...
2
votes
1answer
143 views

Whitelisting applications in Windows7

Windows 7 and Server 2008 R2 come with a security tool called Applocker. This allows admins to restrict applications to a specific white list which can be as granular as the individual application ...