A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

-5
votes
1answer
98 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like ...
30
votes
13answers
8k views

Is a server infrastructure fundamentally possible which the smartest person can't breach?

TL;DR: Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant ...
0
votes
3answers
4k views

Should I restrict Core Networking firewall rules in Windows server?

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80. Now in my firewall I only have ...
1
vote
1answer
27 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
2
votes
1answer
84 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
0
votes
1answer
162 views

Command & Control Server List [duplicate]

I recently got an email from my ISP saying that they'd detected traffic to a known Command & Control server from my home. Boo. I'm sure this probably means one of our computers has some awful ...
1
vote
1answer
63 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
5
votes
1answer
272 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
2
votes
0answers
72 views

Ubuntu server seems compromised for a DDOS attack [duplicate]

I have this VPS Ubuntu v12.04 Server running with DigitalOcean. Zpanel/Apache/PHP stack was installed on the Server. For the past few days it was occasionally down. Initially, I didn't know what ...
3
votes
2answers
196 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
0
votes
0answers
24 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
-1
votes
2answers
244 views

Don't store passwords in database? [closed]

Where might someone keep them besides a database? By storing passwords elsewhere I mean a non-traditional database. Allow me to explain. A couple of my friends run high security websites. They ...
6
votes
5answers
377 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
10
votes
1answer
1k views

Git server security

I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal. As it is a Windows ...
-1
votes
3answers
53 views

Which attacks can a malicious hosting company execute? [closed]

Which attacks can a rogue hosting company carry against the servers it hosts? Assume that the rogue hosting company also provides full access to law enforcement. I was just wondering about that. So ...
1
vote
2answers
93 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
1
vote
1answer
73 views

How to make sure my HTTP server on Win 7 is secure? [closed]

I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it. I have forwarded data from external IP port 80 to my IP at port 80. The ...
0
votes
0answers
44 views

Is there a pre-established method for cracking RSA SecureID codes?

I am using the most modern version of RSA SecureID's tokens with a RSA server (used with a lot of governments and larger organizations ). I was just wondering if there was a pre-established method for ...
1
vote
1answer
92 views

Store/retrieve users passwords on server (using password managers ?) [closed]

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
5
votes
1answer
78 views

Mail client: Public key pinning

I'm running my own mail server setup: - IMAP: Dovecot - SMTP: Postfix There are 4 clients which retrieve emails via IMAP: - iOS (Default client: Apple Mail) - Android (Default client) - Mac (Default ...
2
votes
1answer
100 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
1
vote
0answers
54 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
0
votes
3answers
125 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
3
votes
3answers
627 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
0
votes
1answer
29 views

Is it possible to FDE a VPS/VMS

Is it possible to implement Full Disk Encryption on a Virtual Machine Server or a Virtual Private Server? Also, if it's possible, will the service provider (of the VPS) be able to decrypt/see my ...
3
votes
1answer
109 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
3
votes
3answers
125 views

How to keep logs safe from attackers?

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists. Naturally I keep logs so that ...
0
votes
1answer
240 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
0
votes
1answer
107 views

The security of dll files in a Client/Server application in .net [closed]

I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching. As we all know one of the major caveats ...
6
votes
1answer
1k views

How can one create one's own anti-virus scan server at home? [closed]

I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files. So my question is how can I make ...
2
votes
1answer
80 views

Solutions to decrypt data on access

I want to store sensitive data on on my (public) linux server. Also, I want to be able to access the data from different locations and different OS without much hassle. I thought about using a ...
3
votes
2answers
182 views

Is VM per service a reasonable server security model?

Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an ...
1
vote
1answer
256 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
3
votes
1answer
98 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
1
vote
0answers
71 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
1
vote
0answers
116 views

Is a direct SIP video call (encrypted) between two computers more secure than going through a registrar service?

I learned recently about ZRTP-encrypted video calls using an SIP client, such as Jitsi or Linphone or Blink. I was able to make a direct encrypted video call between two clients on the same local ...
2
votes
2answers
109 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
-1
votes
2answers
77 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
7
votes
3answers
3k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
1
vote
1answer
99 views

Is it a good idea to disable WHM backend and only enable it through ssh when needed?

I have recently set up a managed VPS and it came per-installed with CentOs and WHM. I have configured SSH logins to use private keys and i can SSH into the server with root privileges. I realize ...
0
votes
1answer
428 views

Recent “attack” to my server that might be using shellshock exploit

I just notice this repeated entry in nginx log: 31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: ...
7
votes
1answer
408 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
1
vote
1answer
41 views

Categories of security when evaluating services and protocols

I'm setting up some externally accessible services for a small business, and evaluating some of the different options I have. This is all new to me. I have found the question, "is this secure?" to be ...
-1
votes
1answer
84 views

Known Windows vulnerabilities vs actual exploits on Microsoft's websites?

Although some of Microsoft's servers are running on Linux, at least half is running Windows Server of some kind. I'm trying to understand how with so many unpatched and unresolved vulnerabilities in ...
0
votes
1answer
3k views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
1answer
140 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
5
votes
2answers
184 views

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address): I'm seeing attack traffic from your Linode. Just a friendly heads up that its ...
0
votes
1answer
102 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
-3
votes
1answer
25 views

Usage of Domain from one server to another [closed]

Just want to ask if anyone have an idea about how to do this. I'm using a domain lets call it mymaindomain.com to connect to my Main Server, now I have a second Server that uses mysecondomain.com Is ...
0
votes
1answer
99 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...