A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
0answers
52 views

How to keep home hosted webserver safe [closed]

I've got a raspberry pi I used as a web server. It's not for any sort of commercial traffic I just have it as a machine on my network so I can SSH/FTP in. I recently setup a page linked to a domain ...
1
vote
1answer
141 views

Preventing outgoing Portscan/SYN/UDP Floods in the datacenter

We are a VPS hosting company that have servers housed in a datacenter in Germany. Currently we are receiving multiple take-down requests because customers are ports scanning or attacking servers ...
2
votes
1answer
472 views

Remote Administrative Access to a server, KVM over IP or HP iLo?

We have a situation. We want to grant remote administrative access to one of our servers for clients. As I know, there are two possible ways: 1- KVM-over-IP and 2-HP iLO. The most important thing for ...
1
vote
4answers
15k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
2
votes
2answers
146 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
1
vote
1answer
249 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
-1
votes
1answer
83 views

Server is Sending Spam

I have determined that my server is compromised because it is sending spam (from one of my legitimate addresses). How can I determine what's compromised? Does the attacker know my SSH password? ...
2
votes
1answer
175 views

Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?

I'm using Socket.IO and the client side looks like this. <script src="/socket.io/socket.io.js"></script> <script> var socket = io(); socket.emit("sendData", "hello!"); </...
-4
votes
1answer
168 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like this:...
30
votes
13answers
8k views

Is a server infrastructure fundamentally possible which the smartest person can't breach?

TL;DR: Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant ...
0
votes
3answers
5k views

Should I restrict Core Networking firewall rules in Windows server?

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80. Now in my firewall I only have ...
2
votes
1answer
49 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
2
votes
1answer
87 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
0
votes
1answer
615 views

Command & Control Server List [duplicate]

I recently got an email from my ISP saying that they'd detected traffic to a known Command & Control server from my home. Boo. I'm sure this probably means one of our computers has some awful ...
1
vote
1answer
85 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
4
votes
1answer
361 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
1
vote
0answers
76 views

Ubuntu server seems compromised for a DDOS attack [duplicate]

I have this VPS Ubuntu v12.04 Server running with DigitalOcean. Zpanel/Apache/PHP stack was installed on the Server. For the past few days it was occasionally down. Initially, I didn't know what ...
2
votes
2answers
232 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
0
votes
0answers
29 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
-2
votes
2answers
295 views

Don't store passwords in database? [closed]

Where might someone keep them besides a database? By storing passwords elsewhere I mean a non-traditional database. Allow me to explain. A couple of my friends run high security websites. They ...
6
votes
5answers
433 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
12
votes
1answer
1k views

Git server security

I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal. As it is a Windows ...
0
votes
3answers
57 views

Which attacks can a malicious hosting company execute? [closed]

Which attacks can a rogue hosting company carry against the servers it hosts? Assume that the rogue hosting company also provides full access to law enforcement. I was just wondering about that. So ...
1
vote
2answers
129 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
1
vote
1answer
78 views

How to make sure my HTTP server on Win 7 is secure? [closed]

I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it. I have forwarded data from external IP port 80 to my IP at port 80. The ...
0
votes
0answers
46 views

Is there a pre-established method for cracking RSA SecureID codes?

I am using the most modern version of RSA SecureID's tokens with a RSA server (used with a lot of governments and larger organizations ). I was just wondering if there was a pre-established method for ...
1
vote
1answer
95 views

Store/retrieve users passwords on server (using password managers ?) [closed]

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
5
votes
1answer
100 views

Mail client: Public key pinning

I'm running my own mail server setup: - IMAP: Dovecot - SMTP: Postfix There are 4 clients which retrieve emails via IMAP: - iOS (Default client: Apple Mail) - Android (Default client) - Mac (Default ...
2
votes
1answer
104 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
1
vote
0answers
96 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
0
votes
3answers
151 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
3
votes
3answers
694 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client 207.141.124.18:...
0
votes
1answer
39 views

Is it possible to FDE a VPS/VMS

Is it possible to implement Full Disk Encryption on a Virtual Machine Server or a Virtual Private Server? Also, if it's possible, will the service provider (of the VPS) be able to decrypt/see my ...
3
votes
1answer
121 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
3
votes
3answers
141 views

How to keep logs safe from attackers?

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists. Naturally I keep logs so that ...
0
votes
1answer
380 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
0
votes
1answer
202 views

The security of dll files in a Client/Server application in .net [closed]

I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching. As we all know one of the major caveats ...
6
votes
1answer
2k views

How can one create one's own anti-virus scan server at home? [closed]

I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files. So my question is how can I make ...
1
vote
1answer
92 views

Solutions to decrypt data on access

I want to store sensitive data on on my (public) linux server. Also, I want to be able to access the data from different locations and different OS without much hassle. I thought about using a (simple)...
3
votes
2answers
248 views

Is VM per service a reasonable server security model?

Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an ...
1
vote
1answer
296 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes etc....
3
votes
1answer
148 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
1
vote
0answers
77 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
1
vote
0answers
134 views

Is a direct SIP video call (encrypted) between two computers more secure than going through a registrar service?

I learned recently about ZRTP-encrypted video calls using an SIP client, such as Jitsi or Linphone or Blink. I was able to make a direct encrypted video call between two clients on the same local ...
1
vote
2answers
118 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
-1
votes
2answers
77 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
1
vote
1answer
123 views

Is it a good idea to disable WHM backend and only enable it through ssh when needed?

I have recently set up a managed VPS and it came per-installed with CentOs and WHM. I have configured SSH logins to use private keys and i can SSH into the server with root privileges. I realize ...
0
votes
1answer
446 views

Recent “attack” to my server that might be using shellshock exploit

I just notice this repeated entry in nginx log: 31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/...
7
votes
1answer
476 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
1
vote
1answer
46 views

Categories of security when evaluating services and protocols

I'm setting up some externally accessible services for a small business, and evaluating some of the different options I have. This is all new to me. I have found the question, "is this secure?" to be ...