The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
55 views

How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from ...
0
votes
1answer
56 views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
1
vote
3answers
3k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
1
vote
4answers
167 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
0
votes
2answers
40 views

Only allow access to specific service running on computer in Demilitarized Zone over internet

If a computer (running different services such as ftp and ssh) is placed on a Demilitarized Zone, will all of its services automatically be accessed by anyone on the internet? If the answer is yes, ...
33
votes
5answers
17k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
0
votes
1answer
30 views

Remote Desktop over VPN to access other VPN

My current situation is: Site 2 can connect to site 1 via VPN. I'm on site 3. IT at site 1 doesn't allow creating a new VPN to site 1. I'm thinking of using a Remote Desktop via VPN from site 3 to ...
0
votes
2answers
138 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
0
votes
1answer
146 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
9
votes
4answers
3k views

Why not simply backup the TrueCrypt container file?

The TrueCrypt website has some detailed information on how to backup (TrueCrypt non-system volumes) securely, summarised below: Create a new TrueCrypt volume Mount the main volume. Copy all ...
10
votes
1answer
665 views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
678 views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
20
votes
5answers
65k views

How to find out the IP address of email sender in Gmail

Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender. Since Gmail ...
2
votes
1answer
44 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
1
vote
1answer
2k views

Use Metasploit to exploit SMB through Conficker

I've got an SP0/unpatched Windows XP which is vulnerable to the Conficker worm. I'm using metasploit to use the Conficker exploit with the purpose of opening a remote shell/command line. My ...
1
vote
2answers
114 views

Renting a remote server with IPMI: is one vulnerable?

It has been reported in the media and some security conscious mailing lists that some IPMI-enabled servers, implementations and brands suffer serious security issues. When you go to a dedicated ...
2
votes
1answer
261 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
0
votes
1answer
78 views

What's recommended for performance & security : Server as PC or Server as HDD [closed]

we are trying to find a file server for us. we look for the best practices of the establishment of an efficient and secure server. Therefore, my question is: What is recommended: server as a PC or ...
3
votes
1answer
2k views

How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File

Walked into my office an hour into a Remote File Transfer initiated by an unknown user. I disabled it right away and looked through the files they transferred, which include a blank check with my ...
2
votes
4answers
160 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
1
vote
1answer
146 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
-4
votes
1answer
87 views

LUG war games — suggested strategies? [closed]

My LUG on campus once in awhile holds a mock wargames on a VM. I'm trying to figure a way to get root access and make everyone else not be able to have root (king of he hill). I have a few ideas, but ...
0
votes
2answers
241 views

Denial Of Service attack in asynchronous communication

Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario: I have a client server application were there is a WAN communication between the client and ...
4
votes
1answer
95 views

Should I take care of mysql credentials?

My mysql server is configured to not allow remote connection. Should I seriously care about mysql user and password in this case?
4
votes
1answer
136 views

Sulley - only using ASCII printable characters

I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol. s_initialize('CWD') ...
2
votes
2answers
489 views

I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?

The VPS is running CentOS and I have full access. I only looked around using the cPanel installation and already disabled anonymous FTP access. What other security risks are there with a default VPS ...
1
vote
1answer
979 views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
3
votes
5answers
373 views

Securing data transfer between public network and personal accounts

I would be traveling soon and I am looking for all kinds of ways to encrypt the data transfer (usernames, passwords, emails ...) between the new networks to which I will connect my Laptop, that is ...
2
votes
1answer
3k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
18
votes
1answer
627 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
4
votes
5answers
183 views

Testing C++ Algorithm On A Server

I am making a C++ testing server and want to do that compiled programs would: not have access to read or write files. not have access to open or connect through sockets. not be able to work with ANY ...
3
votes
1answer
468 views

Saving connection parameters in an RDP file

For connecting to a remote Windows Server 2008 I use a standard Windows 7 RDP remote desktop connection. In an RDP dialog there is an option to save connection parameters to an RDP file to use it ...
12
votes
3answers
335 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
9
votes
7answers
664 views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...