Prevention is the best medicine.
71
votes
7answers
4k views
How can I protect my internet-connected devices from discovery by Shodan?
There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices.
Shodan runs 24/7 and collects ...
61
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
43
votes
8answers
6k views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
27
votes
8answers
2k views
22
votes
6answers
2k views
Keeping secrets from root on Linux
I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background.
Many of ...
21
votes
3answers
5k views
How to secure a MongoDB instance?
Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
19
votes
6answers
2k views
Secure Linux Desktop
I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
17
votes
7answers
615 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
17
votes
3answers
3k views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
14
votes
5answers
2k views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
13
votes
3answers
1k views
Bruteforce attack on my FTP server
I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
13
votes
4answers
1k views
Windows hardening
Can anyone point me at some good resources on Windows hardening? From 2003 upwards.
13
votes
4answers
901 views
Recommendations for Changing the Default Shell For Service Accounts
It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
11
votes
4answers
445 views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
10
votes
3answers
656 views
VPS security best practice
I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.
I've previously been hosting it off a VM in the house, but I want to ...
8
votes
5answers
838 views
Best practices for securing an iPhone
As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic.
There is already a question on protecting ...
8
votes
1answer
541 views
Hadoop security, isolation, and hardening
This is a multiple part question, which all really come back to the main question:
How best to protect data in a Hadoop (wikipedia) cluster.
(Current version, vanilla main-branch distro - ...
7
votes
3answers
518 views
Securing a laptop against attacks (article)
I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
7
votes
1answer
3k views
Available Resources for Securing RHEL 6
Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
7
votes
2answers
232 views
Can a webcam be turned on when disabled in Windows' device manager?
In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option.
Of course when your system is ...
7
votes
1answer
2k views
How to secure a ActiveMQ?
Does anybody have experience with securing/hardening ActiveMQ?
Check lists or guides would be welcome.
6
votes
2answers
244 views
Do I have to harden IE if I'm only using Firefox?
Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
6
votes
2answers
2k views
Implications of Trace/Track Methods on Apache
When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
6
votes
4answers
2k views
How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?
Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
6
votes
5answers
455 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
1answer
89 views
How does ASCII-Armoring help to prevent buffer-overflow attacks?
I was reading about return-to-libc attacks at Wikipedia.
According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
6
votes
2answers
2k views
php.ini security setting after attack
My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options.
here is my settings:
file_uploads = Off
...
5
votes
3answers
645 views
What can a hacker do when he has physical access to a system?
I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system.
It's obvious that I will not ...
5
votes
3answers
564 views
IIS and SQLServer Hardening
long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
5
votes
3answers
304 views
Setting up a security CTF server
I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges.
To sum it all up in a simple one-sentence question: How do you set up a server ...
5
votes
1answer
1k views
Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?
I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
5
votes
1answer
235 views
What are some good ways to secure personal computers
I see that many topics here are related to securing data, equipment at an enterprise level. Good advice includes stuff like blocking all unused ports, allowing only whitelisted traffic and installing ...
5
votes
2answers
234 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
5
votes
1answer
243 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
5
votes
1answer
1k views
How do I apply a security baseline to Windows 2008 R2?
I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
5
votes
2answers
491 views
How to harden my Buffalo LinkStation Pro?
The Buffalo LinkStation Pro Duo that we use can be pretty easily hacked into. The good thing about this is that this NAS runs Linux and can therby be improved in features, e.g. running an NFS or LDAP ...
4
votes
5answers
409 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
4
votes
3answers
112 views
Defense in depth vs low complexity - Balancing point?
I've asked a few questions relating to schemes for various security-related functions, and posited schemes to accomplish those goals. In the responses, I see a conflict between two fundamental ...
4
votes
2answers
396 views
Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?
It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app:
<VirtualHost ilia.ws>
Include /home/ilia/sql.cnf
...
4
votes
1answer
363 views
Security Risk of Disabling forceguest in non-AD Environment
Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
3
votes
3answers
271 views
How would one make a network resistant to the unknown?
I play in a game which includes normal risks, but also a wide range of supernatural powers which could affect the security of a network. These may be as prosaic as a retrieving data directly from a ...
3
votes
3answers
228 views
An OS that does not trust its RAM?
I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?
3
votes
3answers
220 views
Why should every file have a user and a group?
I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
3
votes
2answers
342 views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
3
votes
1answer
432 views
Blacklist IP addresses based on number of 404s in Apache
I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses.
Is there ...
3
votes
3answers
254 views
Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance
Why should the firewall be outside the server, excepting these two items
Take the performance impact of noise off of the server.
Add a physical layer between devices so they can be on separate ...
3
votes
2answers
148 views
Protect sensitive data from sysadmin prying eyes
I'm thinking about this problem. What if I have to manage sensitive data (i.e. health data), and I use a managed server?
I'd use encryption of course, but if they have root access they can see conf ...
