Tightening security on a system.

learn more… | top users | synonyms

1
vote
1answer
36 views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
1
vote
1answer
108 views

Is it there any effective way to prevent shodan to access my webcams [duplicate]

Recently while browsing using shodan, I came across a search string to explore webcams. Some of the searches I carried out were: webcamxp city:city name webcamxp geo: longitude and latitude ...
0
votes
0answers
9 views

Hardening BMC Remedy OnDemand ITSM 8.1 [closed]

How would one approach hardening BMC Remedy OnDemand ITSM 8.1 hosted in the BMC cloud ?
5
votes
1answer
453 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
-5
votes
1answer
112 views

Recommendations about procedures and policies for an application security strategy? [closed]

I need to develop an application security strategy for a web application product. Do you have any recommendations as far as procedures and policies are concerned? Any inputs / guidelines or relevant ...
2
votes
0answers
15 views

SELinux restrict Apache/PHP access [migrated]

I installed a minimal CentOS system with Apache, PHP and SELinux in a default configuration: SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root ...
1
vote
2answers
20 views

What are hardened ACLs for the Windows %systemroot% folder?

What are the recommended file permissions for %systemroot% in Windows 8.1? I couldn't find hardened file system permissions to apply to better secure a Windows installation.
0
votes
0answers
21 views

PowerShell's Module logging, a few questions

I'm looking for some more information concerning the white paper which goes into some detail over PowerShell's Module logging. Specifically, once this is enabled, are the default cmdlets logged? For ...
0
votes
1answer
38 views

Unidentified Filemount in Ubuntu

Not sure if this should go under security or Ubuntu but, I believe that my server got hacked somehow. Its being hosted on Digital Ocean and I mainly use it fiddle around with things. Today, I got a ...
4
votes
1answer
60 views

Should I wipe a brand new Machine and HDD ?

So I am buying a brand new machine and a HDD separate, when I buy this new HDD should I wipe it before I install it ? What necessary steps should I take to make sure it's pretty much clean of any ...
3
votes
1answer
216 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardend Operating Systems who restrict or totally disable Terminal 'root' access for the user. (1) Would this feature prevent persistant BIOS rootkits from writing into BIOS or ...
66
votes
9answers
13k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
0
votes
0answers
35 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
1answer
57 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
1
vote
1answer
51 views

SOP for the CERT in case of hack activity [closed]

I work at a University in the Information Systems Department and recently one of the web server was hacked. the hacker deleted certain databases and few websites were down. In lieu to such events ...
0
votes
2answers
80 views

Can a signed downloaded file be securely verified if you only control the private key and the download/verification algorithm?

I'm designing the update procedure for IP Camera's. I'm wondering if my current design is secure enough. I have a binary file that I want to get to a device. I make a hash of this binary file and ...
7
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
85
votes
15answers
20k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
2
votes
1answer
51 views

Secure the config file of a service

I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would ...
2
votes
1answer
81 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
9
votes
3answers
350 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
6
votes
3answers
2k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
0
votes
1answer
354 views

Recent “attack” to my server that might be using shellshock exploit

I just notice this repeated entry in nginx log: 31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: ...
1
vote
3answers
90 views

What can manufactures of hardware do to prevent attacks on the firmware?

Given the revelations since The Equation Group was discovered. As well as that it is possible to not guarantee removal of a rootkit even with a nuke from high orbit. What properties of a harddrive ...
2
votes
1answer
133 views

Basic nginx securing / restricted access [closed]

I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects. UPDATE : ...
3
votes
1answer
219 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
7
votes
1answer
472 views

What are some good ways to secure personal computers

I see that many topics here are related to securing data, equipment at an enterprise level. Good advice includes stuff like blocking all unused ports, allowing only whitelisted traffic and installing ...
17
votes
3answers
2k views

Why doesn't Linux randomize the address of the executable code segment?

I've recently been learning about how ASLR (address space randomization) works on Linux. At least on Fedora and Red Hat Enterprise Linux, there are two kinds of executable programs: Position ...
0
votes
1answer
393 views

Firewall Benchmark, Checklist, Guideline?

I'm doing some research on checklist, benchmark, hardening guidelines. And I couldn't find specific documents for security checklist for firewall. CIS had this document, but it was only for Cisco ...
3
votes
2answers
194 views

Python security hardening

I’m working for a large organization which is using some Windows products that require python to work. Python is used to execute built in utility scripts and the user never recognizes that python is ...
2
votes
0answers
229 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
5
votes
2answers
992 views

How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost?

This question is a followup question to Storing plaintext passwords for cameras - Security concerns?. In that question, I posed what I thought was a simple question, which actually turned out to ...
11
votes
5answers
2k views

Storing plaintext passwords for cameras - Security concerns?

This question has a follow-up question here: How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost? TL;DR: Can I use ...
5
votes
1answer
221 views

What can be done to bridge the Air Gap, except autorun?

What can be done to bridge the Air Gap, except autorun? Is there any hardware butterflies that can attack physically isolated Unix/Linux machine in common usb drives, like VSC (Vendor Specific ...
2
votes
2answers
870 views

Hardening a perimeter router

What are some of the steps that could be taken to harden a perimeter (internet facing) router from attacks by potentially malicious users?
2
votes
1answer
138 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
7
votes
5answers
2k views

Fastest way to “lockdown” CentOS and have network intrusion detection, firewall, etc up and running?

Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation? I'm hoping for an automated tool that would scan the ...
0
votes
3answers
149 views

Testing Malware in one Virtual Machine which is running side by side along with other Virtual Machines

I want to harden the security of my host system and side by side running virtual machines while testing some files for malware in one of the virtual machines. Here comes a list of questions that I ...
0
votes
1answer
121 views

Joomla Linux Permissions

I installed Joomla 3 to /var/www/html directory in Cent OS 6 server. Currently /var/www/html is owned by apache:apache. What is the recommended permissions for Joomla installation on Linux in ...
3
votes
2answers
204 views

Read-Only Hard Drives

Has anyone come across a 2.5 SSD or HDD that has a physical read-only switch similar to this? Or an enclosure that can render a hard drive read only?
1
vote
2answers
104 views

Segregating Offline Server and Internet Connection in one pc

What I want to do: Setup a PC with two routers. One router is directly connected to the internet, the other is connected to an offline workspace server. My client will be connected to both via a ...
2
votes
3answers
153 views

Is opening a new mysql connection for each query potentially unsafe?

I am doing some unit testing and noticed that if I click (or have multiple people clicking) the same filter very very fast (very precise I know;) eventually I get a "The connection is already open." ...
2
votes
2answers
66 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
1
vote
2answers
185 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
15
votes
5answers
2k views

Securing a laptop against attacks (article)

I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
29
votes
20answers
4k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
2
votes
2answers
189 views

What's there to harden for a home Unix-box behind Comcast cable modem?

I'm learning that much of the security advice I come across under the "hardening" heading simply does not apply to a single-user home desktop box sitting in a private wireless IPv4 LAN behind a ...
1
vote
1answer
394 views

How to harden a “dedicated” Firefox?

I want to set up an instance of Firefox to be used to access a strictly limited "white list" of websites (my bank's, my credit cards', etc.). How can I harden such an instance of Firefox to reduce ...
2
votes
3answers
172 views

How to setup a dedicated home machine (Linux) for secure transactions?

I would like to set up a computer at home (preferably running Debian, or some other flavor of Linux) to be used only for secure financial transactions. The idea is that, by strictly limiting what is ...
85
votes
8answers
9k views

How can I protect my internet-connected devices from discovery by Shodan?

There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices. Shodan runs 24/7 and collects ...