A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

2
votes
0answers
800 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
4
votes
1answer
82 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
3
votes
1answer
61 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
1
vote
3answers
58 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
-1
votes
2answers
112 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
37
votes
11answers
34k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
0
votes
0answers
30 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
1
vote
1answer
25 views

Usefulness of Server's Work Load given Timing Attack Resistance of Responses

I've read articles in the past discussing the importance of having timing attack resistant responses for information where knowing the time for evaluation would leak information about the data being ...
0
votes
0answers
39 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
1
vote
5answers
365 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
1answer
129 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
42
votes
8answers
5k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible (...
1
vote
2answers
199 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
2
votes
2answers
121 views

Physical protection of your servers?

Here is a scenario. You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but ...
4
votes
1answer
121 views

Investigating a possible rogue DNS Server (maybe DNSChanger)

One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to ...
8
votes
1answer
91 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
3
votes
0answers
104 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
5
votes
2answers
157 views

Don’t use a web browser on a server?

After pulling up a Windows Server 2012 instance, I learned that google.com is riskier than I thought: It does the same for microsoft.com. There are instructions to disable "Enhanced Security ...
3
votes
1answer
46 views

Prevent snapshots of VPS

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; ...
0
votes
1answer
93 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
0
votes
1answer
79 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
5
votes
2answers
99 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
1
vote
1answer
109 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
-1
votes
1answer
138 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
2
votes
1answer
129 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with "...
5
votes
1answer
124 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
4
votes
1answer
60 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
1
vote
1answer
61 views

How to prevent a hacker from accessing other user's web dir

My website got hacked today :) The hacker accessed a website hosted by another user on the same server, then he got access to my /home/website-dir/ ! it's my server and I use it to host some websites ...
-1
votes
2answers
55 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
21
votes
3answers
3k views

Could a VPS provider have access to the content of their users?

Could a VPS provider like DigitalOcean have access to the content of their users? In their terms of service they do not mention anything related to this question, but could they theoretically have ...
1
vote
1answer
192 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
2
votes
1answer
97 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
0
votes
2answers
131 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
1
vote
3answers
151 views

Has my server been compromised? [duplicate]

--thanks everyone this has been resolved, see my answer below-- I created an Debian/OpenVPN server several months ago for private use but in the last two days I've noticed something extremely ...
3
votes
2answers
2k views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
7
votes
1answer
223 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
1
vote
0answers
50 views

How to keep home hosted webserver safe [closed]

I've got a raspberry pi I used as a web server. It's not for any sort of commercial traffic I just have it as a machine on my network so I can SSH/FTP in. I recently setup a page linked to a domain ...
1
vote
1answer
137 views

Preventing outgoing Portscan/SYN/UDP Floods in the datacenter

We are a VPS hosting company that have servers housed in a datacenter in Germany. Currently we are receiving multiple take-down requests because customers are ports scanning or attacking servers ...
2
votes
1answer
429 views

Remote Administrative Access to a server, KVM over IP or HP iLo?

We have a situation. We want to grant remote administrative access to one of our servers for clients. As I know, there are two possible ways: 1- KVM-over-IP and 2-HP iLO. The most important thing for ...
1
vote
4answers
15k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
1
vote
1answer
763 views

Prevent CryptoLocker on Server

A quick question, which may have a not-so-quick answer - Are there any ways to prevent files associated with CryptoLocker, to be propagated to a data server, by means of a back up? We use Cobian as ...
2
votes
2answers
127 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
1
vote
1answer
245 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
-1
votes
1answer
74 views

Server is Sending Spam

I have determined that my server is compromised because it is sending spam (from one of my legitimate addresses). How can I determine what's compromised? Does the attacker know my SSH password? ...
2
votes
1answer
151 views

Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?

I'm using Socket.IO and the client side looks like this. <script src="/socket.io/socket.io.js"></script> <script> var socket = io(); socket.emit("sendData", "hello!"); </...
-4
votes
1answer
160 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like this:...
31
votes
13answers
8k views

Is a server infrastructure fundamentally possible which the smartest person can't breach?

TL;DR: Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant ...
0
votes
3answers
5k views

Should I restrict Core Networking firewall rules in Windows server?

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80. Now in my firewall I only have ...
2
votes
1answer
44 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...