Tightening security on a system.

learn more… | top users | synonyms

83
votes
8answers
7k views

How can I protect my internet-connected devices from discovery by Shodan?

There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices. Shodan runs 24/7 and collects ...
75
votes
14answers
16k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
62
votes
9answers
10k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
34
votes
8answers
2k views

What methods are available for securing SSH?

What methods are available for securing SSH?
31
votes
6answers
5k views

Keeping secrets from root on Linux

I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background. Many of ...
30
votes
9answers
20k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
28
votes
20answers
3k views

How can I prevent my kids from bypassing my computer restrictions?

My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions: Can this damage my computer or corrupt my files? (I have lots of pictures) Is ...
28
votes
6answers
4k views

Secure Linux Desktop

I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
25
votes
6answers
3k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
24
votes
3answers
9k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
22
votes
2answers
4k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
20
votes
7answers
833 views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
19
votes
3answers
5k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
17
votes
4answers
3k views

Windows hardening

Can anyone point me at some good resources on Windows hardening? From 2003 upwards.
15
votes
3answers
813 views

Why doesn't Linux randomize the address of the executable code segment?

I've recently been learning about how ASLR (address space randomization) works on Linux. At least on Fedora and Red Hat Enterprise Linux, there are two kinds of executable programs: Position ...
14
votes
3answers
2k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
13
votes
4answers
2k views

Recommendations for Changing the Default Shell For Service Accounts

It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
13
votes
2answers
2k views

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under ...
13
votes
3answers
1k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
12
votes
4answers
559 views

What does defense in depth entail for a web app?

I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
12
votes
2answers
4k views

Available Resources for Securing RHEL 6

Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
11
votes
3answers
3k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: ...
11
votes
5answers
1k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
11
votes
3answers
1k views

Securing a laptop against attacks (article)

I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
10
votes
1answer
558 views

Why are some DLLs not randomized? What makes it hard to deploy full ASLR for all DLLs?

One of the challenges with deploying ASLR for everything is that, at least on Windows, some DLLs (libraries) are not compiled in a way that's compatible with ASLR. (They're not compiled as ...
9
votes
3answers
337 views

Finding out what headers are visible

I would like to find an easy way to find out what headers are visible on my websites. For example PHP version, server etc. I've looked around and can't seem to find a good explanation on the subject ...
9
votes
2answers
6k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
8
votes
4answers
3k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
8
votes
1answer
2k views

How to audit web servers for resistance/vulnerability to BREACH

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. I manage a few web servers. How can I audit them to check which of them are potentially vulnerable to ...
8
votes
2answers
744 views

Can a webcam be turned on when disabled in Windows' device manager?

In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option. Of course when your system is ...
7
votes
2answers
288 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
7
votes
3answers
209 views

What is a good source for hardened base configurations

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is ...
7
votes
4answers
253 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
7
votes
5answers
886 views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
7
votes
3answers
1k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf ...
7
votes
1answer
4k views

How to secure a ActiveMQ?

Does anybody have experience with securing/hardening ActiveMQ? Check lists or guides would be welcome.
7
votes
1answer
428 views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
6
votes
3answers
1k views

What can a hacker do when he has physical access to a system?

I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system. It's obvious that I will not ...
6
votes
4answers
1k views

Fastest way to “lockdown” CentOS and have network intrusion detection, firewall, etc up and running?

Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation? I'm hoping for an automated tool that would scan the ...
6
votes
2answers
2k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
6
votes
3answers
931 views

IIS and SQLServer Hardening

long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
6
votes
3answers
646 views

How to effectively (and reasonably) secure Windows in corporate environment.

A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer Windows XP SP3 - fully patched at the time of ...
6
votes
2answers
154 views

How often is ASLR randomness refreshed, in Linux?

Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
6
votes
1answer
4k views

How to ensure that VirtualBox guests can't break out of the vm to get access to the host machine? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? E.g. on Ubuntu/Fedora - if I have VirtualBox installed and I'm running guests in it, then how can I make ...
6
votes
1answer
365 views

What are some good ways to secure personal computers

I see that many topics here are related to securing data, equipment at an enterprise level. Good advice includes stuff like blocking all unused ports, allowing only whitelisted traffic and installing ...
6
votes
2answers
3k views

php.ini security setting after attack

My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options. here is my settings: file_uploads = Off ...
6
votes
1answer
923 views

Hadoop security, isolation, and hardening

This is a multiple part question, which all really come back to the main question: How best to protect data in a Hadoop (wikipedia) cluster. (Current version, vanilla main-branch distro - ...
5
votes
5answers
693 views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
3answers
305 views

An OS that does not trust its RAM?

I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?