A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
31 views

Categories of security when evaluating services and protocols

I'm setting up some externally accessible services for a small business, and evaluating some of the different options I have. This is all new to me. I have found the question, "is this secure?" to be ...
-1
votes
0answers
47 views

How to create a digial signature and verify it through a server [migrated]

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
-1
votes
1answer
35 views

Known Windows vulnerabilities vs actual exploits on Microsoft's websites?

Although some of Microsoft's servers are running on Linux, at least half is running Windows Server of some kind. I'm trying to understand how with so many unpatched and unresolved vulnerabilities in ...
0
votes
1answer
37 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls. Those require authentification. Hence the server will need to know the literal passwords to make those calls. What options ...
6
votes
1answer
159 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
1
vote
1answer
39 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
5
votes
2answers
103 views

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address): I'm seeing attack traffic from your Linode. Just a friendly heads up that its ...
0
votes
1answer
52 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
-2
votes
1answer
21 views

Usage of Domain from one server to another [closed]

Just want to ask if anyone have an idea about how to do this. I'm using a domain lets call it mymaindomain.com to connect to my Main Server, now I have a second Server that uses mysecondomain.com Is ...
0
votes
1answer
21 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...
2
votes
2answers
84 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
-1
votes
1answer
46 views

Emulating Client by sending encrypted hexdump to dB server and getting response back [closed]

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
5
votes
1answer
92 views

What is investigated after a possible hack on servers?

My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, ...
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
2
votes
3answers
140 views

Is it possible to upgrade the SSL version of a connection from the server's side only?

I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes. In my case, both the client application and server are ...
0
votes
2answers
119 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
2
votes
1answer
77 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
2
votes
0answers
25 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
0
votes
1answer
56 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
4
votes
2answers
408 views

What port services can hackers use to break into a server?

I am getting ready to run my first server. I will use ufw to disable every port except port 22 for ssh and port 80 for http. I am curious though. Suppose theoretically I left every port open except ...
1
vote
2answers
74 views

Is a server absolutely safe if the attacker don't know unknown bug?

If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?
1
vote
1answer
75 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
-1
votes
1answer
49 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
1
vote
1answer
109 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
-1
votes
1answer
69 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
1
vote
1answer
163 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://example.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
2
votes
0answers
67 views

Ubuntu server seems compromised for a DDOS attack [duplicate]

So i have this VPS Ubuntu v12.04 Server running with DigitalOcean. Zpanel/Apache/PHP stack was installed on the Server For the past few days it was occasionally down. Initially, I didn't know what ...
1
vote
1answer
124 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
3
votes
1answer
190 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
2
votes
1answer
200 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
1
vote
1answer
55 views

Defense of a server against malicious uploaded resources

We know that viruses and other threats can propagate through mail etc.But when any resource is shared,it is uploaded to the server and then shared.This means that the server does not take the ...
1
vote
2answers
117 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
0
votes
1answer
632 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
1answer
96 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
2
votes
1answer
98 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
1
vote
1answer
129 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
1answer
88 views

Implications of Bash history [closed]

I am using Salt Cloud to script my deployments of a small collection of commercial servers. Since it is cheap to get things right the first time, I'd like to avoid obvious mistakes. If I leave my ...
0
votes
0answers
299 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
1answer
282 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
0
votes
1answer
79 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
1
vote
3answers
179 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
0
votes
1answer
68 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
1
vote
1answer
223 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
1answer
64 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
1
vote
1answer
65 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
7
votes
3answers
230 views

What is a good source for hardened base configurations

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is ...
6
votes
1answer
193 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
1
vote
1answer
94 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
0
votes
0answers
98 views

OWASP ZAP with self-signed server cer

I have my browser connect to ZAP via proxy with ZAP cer imported into firefox. I am getting " "connection timeout" when trying to access self-signed server but i am able to see traffic from ...