A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

2
votes
1answer
697 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
1answer
202 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://example.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
2
votes
2answers
236 views

Is this accidental incident considered hacking(illegal)? [closed]

I was doing research for a college research paper and I got bored and opened up CMD. I don't really know more than the next guy about computers, so i figured id just play around. I googled the ...
2
votes
2answers
707 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
2
votes
1answer
168 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
2
votes
1answer
121 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with ...
2
votes
1answer
86 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
2
votes
1answer
102 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
2
votes
1answer
278 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
4answers
1k views

What are the arguments for and against having anti-virus on domain servers

I have been hired at a start-up where I seem to have become the de-facto admin despite being hired to do application support (to be fair I do have a background as an all-rounder). Amongst the ...
2
votes
1answer
59 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
2
votes
1answer
184 views

how much of a security threat would this be?

If I set up a Domain Controller server to be accessible from the internet via Remote Desktop Connection (through port forwarding in the router), how much of a threat would that be? and if I have a ...
2
votes
4answers
725 views

I think my server is under attack, what can I do to stop it? [duplicate]

Possible Duplicate: Invalid users trying to log in to my server I have a small ssh server mostly used for file sharing. A couple of other people and I use it and there are only 3 users. ...
2
votes
1answer
387 views

Remote Administrative Access to a server, KVM over IP or HP iLo?

We have a situation. We want to grant remote administrative access to one of our servers for clients. As I know, there are two possible ways: 1- KVM-over-IP and 2-HP iLO. The most important thing for ...
2
votes
3answers
3k views

Is it possible to upgrade the SSL version of a connection from the server's side only?

I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes. In my case, both the client application and server are ...
2
votes
1answer
663 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
2
votes
1answer
164 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
1answer
162 views

Forefront Identity Management Server Hardening

Is there a good document for hardening FIM? I've tried CIS and NIST, but I couldn't find anything. If there is no such document, what would I have to look out for in the configuration?
2
votes
2answers
8k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
2
votes
2answers
221 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
2
votes
0answers
50 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
2
votes
0answers
765 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
1answer
135 views

Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?

I'm using Socket.IO and the client side looks like this. <script src="/socket.io/socket.io.js"></script> <script> var socket = io(); socket.emit("sendData", "hello!"); ...
1
vote
4answers
14k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
1
vote
1answer
158 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
1
vote
1answer
168 views

question on rooting

Rooting a server is done through uploading a shell on a target website and running a root exploit to gain root privileges on a server thus gaining access to sites that are hosted on that shared ...
1
vote
2answers
211 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
1
vote
1answer
186 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
4answers
92 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
1
vote
2answers
114 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
1
vote
2answers
385 views

best place to store backup encryption key [closed]

I have a server on which I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed and is physically accessible to many people. Further, I would ...
1
vote
1answer
404 views

Is it safe to use flex and bison as a protocol parser?

I started writing a a simple protocol lexer and parser for STOMP using flex and bison. Does anyone know of any security issues that might result from this? Edit: Added code. %{ /* Tokenizer for ...
1
vote
2answers
322 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
1
vote
2answers
567 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
1
vote
2answers
88 views

Is a server absolutely safe if the attacker don't know unknown bug?

If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?
1
vote
2answers
528 views

Why should web applications use multiple gatekeepers?

I have been reading a security checklist for web application design which can be found on: http://msdn.microsoft.com/en-us/library/ff648647.aspx One of the recommendations is to "use multiple ...
1
vote
1answer
793 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
1
vote
3answers
148 views

Has my server been compromised? [duplicate]

--thanks everyone this has been resolved, see my answer below-- I created an Debian/OpenVPN server several months ago for private use but in the last two days I've noticed something extremely ...
1
vote
1answer
263 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
1
vote
3answers
200 views

Is forwarding a port(s) a security risk to all computers on the network or just one?

I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
1
vote
2answers
2k views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
1
vote
1answer
340 views

How to verify data from localStorage on a server

This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit. On my mobile app, I am ...
1
vote
1answer
80 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
1
vote
1answer
78 views

How to make sure my HTTP server on Win 7 is secure? [closed]

I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it. I have forwarded data from external IP port 80 to my IP at port 80. The ...
1
vote
2answers
190 views

Stop POODLE vulnerability in Oracle Application Server

Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know ...
1
vote
1answer
280 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
2answers
203 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
3answers
678 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
1
vote
1answer
682 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
1answer
125 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...