A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

2
votes
1answer
215 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
3
votes
3answers
357 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
41 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
7
votes
1answer
145 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
4
votes
1answer
160 views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g https://scholar.google.com.sg/scholar?hl=en&q=%22decoy+server%22&...
6
votes
5answers
811 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
1
vote
4answers
93 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
5
votes
1answer
45 views

What are the recommended directory ownership & permissions for hosted websites?

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites. └── var └── www ├── website1 │   └── public_html └── website2 ...
5
votes
4answers
289 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
0
votes
1answer
52 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
-1
votes
1answer
46 views

How can someone execute arbitrary code on Python's built in server module? [closed]

I'm not sure if this question could be consider inappropriate here. $ python -m http.server The source code tells: # https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21 SECURITY WARNING:...
2
votes
1answer
821 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
85 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
2
votes
0answers
818 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
4
votes
1answer
86 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
3
votes
1answer
66 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
1
vote
3answers
58 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
-1
votes
2answers
126 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
38
votes
11answers
34k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
0
votes
0answers
30 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
1
vote
1answer
25 views

Usefulness of Server's Work Load given Timing Attack Resistance of Responses

I've read articles in the past discussing the importance of having timing attack resistant responses for information where knowing the time for evaluation would leak information about the data being ...
0
votes
0answers
41 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
1
vote
5answers
407 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
1answer
129 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
42
votes
8answers
5k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible (...
1
vote
2answers
214 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
2
votes
2answers
123 views

Physical protection of your servers?

Here is a scenario. You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but ...
4
votes
1answer
121 views

Investigating a possible rogue DNS Server (maybe DNSChanger)

One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to ...
8
votes
1answer
98 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
3
votes
0answers
105 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
5
votes
2answers
185 views

Don’t use a web browser on a server?

After pulling up a Windows Server 2012 instance, I learned that google.com is riskier than I thought: It does the same for microsoft.com. There are instructions to disable "Enhanced Security ...
3
votes
1answer
48 views

Prevent snapshots of VPS

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; ...
0
votes
1answer
104 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
0
votes
1answer
87 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
5
votes
2answers
100 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
1
vote
1answer
113 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
-1
votes
1answer
139 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
2
votes
1answer
141 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with "...
5
votes
1answer
130 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
4
votes
1answer
60 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
1
vote
1answer
62 views

How to prevent a hacker from accessing other user's web dir

My website got hacked today :) The hacker accessed a website hosted by another user on the same server, then he got access to my /home/website-dir/ ! it's my server and I use it to host some websites ...
-1
votes
2answers
55 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
22
votes
3answers
3k views

Could a VPS provider have access to the content of their users?

Could a VPS provider like DigitalOcean have access to the content of their users? In their terms of service they do not mention anything related to this question, but could they theoretically have ...
1
vote
1answer
214 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
2
votes
1answer
98 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
0
votes
2answers
141 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
1
vote
3answers
154 views

Has my server been compromised? [duplicate]

--thanks everyone this has been resolved, see my answer below-- I created an Debian/OpenVPN server several months ago for private use but in the last two days I've noticed something extremely ...
3
votes
2answers
2k views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
7
votes
1answer
228 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...