A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

0
votes
1answer
15 views

Emulating Client by sending encrypted hexdump to dB server and getting response back

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
3
votes
1answer
68 views

What is investigated after a possible hack on servers?

My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, ...
7
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
2
votes
3answers
95 views

Is it possible to upgrade the SSL version of a connection from the server's side only?

I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes. In my case, both the client application and server are ...
0
votes
1answer
47 views

VPN Security in inner network [on hold]

I am looking to a setup a VPN connection from one server to another. On one end there is a server for video monitoring that works with all the information gathered and sends it further (Server A). On ...
0
votes
0answers
20 views

Google Cloud and Firewall [on hold]

I am trying to look for a server which is able to provide security to host some software tools. I was looking at cloud solutions such as google cloud and amazon aws services and comparing them with a ...
0
votes
2answers
111 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
2
votes
1answer
72 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
2
votes
0answers
24 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
0
votes
1answer
46 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
0answers
67 views

google recaptcha V2 on apache shared server: How to get it to work with SSL [migrated]

I implemented google's reCAPTCHA V2 on http:// on the remote apache shared server and it worked 100%. I then changed the protocol to my shared server SSL using the same script as the non-SSL script. ...
4
votes
2answers
340 views

What port services can hackers use to break into a server?

I am getting ready to run my first server. I will use ufw to disable every port except port 22 for ssh and port 80 for http. I am curious though. Suppose theoretically I left every port open except ...
1
vote
2answers
69 views

Is a server absolutely safe if the attacker don't know unknown bug?

If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?
0
votes
0answers
27 views

How can I Run my Kali Tools on a Remote Server [migrated]

I am currently ssh-ed into a remote server. However, I do not have root permissions on the remote server and therefore am unable to install and use tools such as nmap. I've been trying to figure out ...
0
votes
1answer
30 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
-1
votes
1answer
48 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
1
vote
1answer
102 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
-1
votes
1answer
62 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
1
vote
1answer
148 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://example.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
2
votes
0answers
65 views

Ubuntu server seems compromised for a DDOS attack [duplicate]

So i have this VPS Ubuntu v12.04 Server running with DigitalOcean. Zpanel/Apache/PHP stack was installed on the Server For the past few days it was occasionally down. Initially, I didn't know what ...
1
vote
1answer
72 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
3
votes
1answer
153 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
2
votes
1answer
116 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
1
vote
1answer
51 views

Defense of a server against malicious uploaded resources

We know that viruses and other threats can propagate through mail etc.But when any resource is shared,it is uploaded to the server and then shared.This means that the server does not take the ...
1
vote
2answers
107 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
0
votes
1answer
340 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
1answer
87 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
2
votes
1answer
81 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
1
vote
1answer
97 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
1answer
85 views

Implications of Bash history [closed]

I am using Salt Cloud to script my deployments of a small collection of commercial servers. Since it is cheap to get things right the first time, I'd like to avoid obvious mistakes. If I leave my ...
0
votes
0answers
222 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
1answer
241 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
0
votes
1answer
73 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
1
vote
3answers
144 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
0
votes
1answer
64 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
1
vote
1answer
185 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
1answer
59 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
1
vote
1answer
54 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
7
votes
3answers
226 views

What is a good source for hardened base configurations

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is ...
6
votes
1answer
177 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
1
vote
1answer
93 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
0
votes
0answers
90 views

OWASP ZAP with self-signed server cer

I have my browser connect to ZAP via proxy with ZAP cer imported into firefox. I am getting " "connection timeout" when trying to access self-signed server but i am able to see traffic from ...
1
vote
4answers
108 views

Is it possible to block specific users that connect to the internet behind of same gateway with NAT?

Assume there are two internet users (A and B) that connect to the internet from the same gateway by using NAT. That means they use same IP address while passing through our firewall. Now assume we ...
0
votes
1answer
202 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
1
vote
3answers
98 views

Is forwarding a port(s) a security risk to all computers on the network or just one?

I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
1
vote
2answers
204 views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
8
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
3
votes
3answers
253 views

How do I store a user's secret key on a server?

I'm learning about security at the moment and one thing I'd like to try out is having a key server distribute keys to clients that will allow them to securely save and read data locally. My basic ...
1
vote
0answers
140 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...