1. In computers and computer networks, a configuration often refers to the specific hardware and software details in terms of devices attached, capacity or capability, and exactly what the system is made up of. 2. In networks, a configuration often means the network topology. 3. In installing ...

learn more… | top users | synonyms (1)

63
votes
9answers
11k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
78
votes
14answers
17k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
18
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
22
votes
2answers
4k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
9
votes
1answer
917 views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
0
votes
1answer
184 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
14
votes
1answer
19k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
18
votes
5answers
3k views

Where can I find a solid BURP tutorial?

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
12
votes
3answers
342 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
7
votes
4answers
5k views

What do I need to configure, to make sure my software uses /dev/urandom?

When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random? Some servers don't have much entropy in the entropy pool ...
5
votes
2answers
227 views

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
3
votes
1answer
91 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...