1. In computers and computer networks, a configuration often refers to the specific hardware and software details in terms of devices attached, capacity or capability, and exactly what the system is made up of. 2. In networks, a configuration often means the network topology. 3. In installing ...
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
What are some best practices, recommendations, required reading for securing an Apache Server?
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random? Some servers don't have much entropy in the entropy pool ...
I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...