A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
115 views

Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)

Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
1
vote
1answer
31 views

Categories of security when evaluating services and protocols

I'm setting up some externally accessible services for a small business, and evaluating some of the different options I have. This is all new to me. I have found the question, "is this secure?" to be ...
1
vote
1answer
84 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
55 views

Defense of a server against malicious uploaded resources

We know that viruses and other threats can propagate through mail etc.But when any resource is shared,it is uploaded to the server and then shared.This means that the server does not take the ...
1
vote
1answer
130 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
4answers
109 views

Is it possible to block specific users that connect to the internet behind of same gateway with NAT?

Assume there are two internet users (A and B) that connect to the internet from the same gateway by using NAT. That means they use same IP address while passing through our firewall. Now assume we ...
1
vote
2answers
96 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
1
vote
1answer
146 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
1
vote
1answer
237 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
1
vote
2answers
120 views

Renting a remote server with IPMI: is one vulnerable?

It has been reported in the media and some security conscious mailing lists that some IPMI-enabled servers, implementations and brands suffer serious security issues. When you go to a dedicated ...
1
vote
2answers
188 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
4answers
319 views

Learn about network and security for securing a server

I'm setting up an OpenBSD server that I want to connect to the Internet (it's going to be used to host a site - so, with Apache, SQLite and the like). I want it to be as secure as possible. Social ...
1
vote
0answers
26 views

How to implement secure client-server communication over https using python and m2crypto?

I want to secure the communication between a server and multiple clients. The communication goes this way: The client connects to a specific page at the server and checks for a software version. ...
1
vote
1answer
41 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
1
vote
1answer
127 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
88 views

Implications of Bash history [closed]

I am using Salt Cloud to script my deployments of a small collection of commercial servers. Since it is cheap to get things right the first time, I'd like to avoid obvious mistakes. If I leave my ...
1
vote
0answers
311 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
1answer
65 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
1
vote
1answer
388 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
0
votes
2answers
121 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
0
votes
1answer
56 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
233 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...
0
votes
2answers
87 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
0
votes
1answer
273 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
0
votes
1answer
103 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
0
votes
5answers
345 views

How to protect server uploads

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be ...
0
votes
1answer
23 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...
0
votes
1answer
68 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
0
votes
2answers
204 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
0
votes
2answers
72 views

Restricting locations for unzipping a zip file

I hope that I have found the correct place to ask my question regarding unzipping files. I would like to see if there is a way to restrict the locations available to the user to unzip a password ...
0
votes
1answer
55 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
0
votes
1answer
658 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
0
votes
1answer
79 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
0
votes
2answers
2k views

Should I restrict Core Networking firewall rules in Windows server?

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80. Now in my firewall I only have ...
0
votes
1answer
89 views

What are the risks of uploading and downloading data in binary (non-encoded) format to servers and browsers?

I admit up-front that this question may be the result of unfounded paranoia. But I am concerned that uploading and downloading data in binary form opens the door to exploits that might not be ...
0
votes
3answers
191 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
0
votes
1answer
37 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls. Those require authentification. Hence the server will need to know the literal passwords to make those calls. What options ...
0
votes
0answers
99 views

OWASP ZAP with self-signed server cer

I have my browser connect to ZAP via proxy with ZAP cer imported into firefox. I am getting " "connection timeout" when trying to access self-signed server but i am able to see traffic from ...
0
votes
0answers
21 views

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
0
votes
1answer
92 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
0
votes
3answers
206 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
-1
votes
1answer
49 views

Emulating Client by sending encrypted hexdump to dB server and getting response back [closed]

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
-1
votes
1answer
49 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
-1
votes
1answer
37 views

Known Windows vulnerabilities vs actual exploits on Microsoft's websites?

Although some of Microsoft's servers are running on Linux, at least half is running Windows Server of some kind. I'm trying to understand how with so many unpatched and unresolved vulnerabilities in ...
-1
votes
1answer
77 views

Configuration for a server [closed]

I would like to configure a server and need guidance in assembling a server. I do not wish to spend much but at the same time I do not wish to compromise on performance. The purpose for my server ...
-1
votes
0answers
25 views

How to identify the script that's sending spam from my server? [closed]

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
-1
votes
0answers
47 views

How to create a digial signature and verify it through a server [migrated]

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
-1
votes
1answer
69 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
-1
votes
1answer
82 views

Server security experiment? [closed]

Okay, so I am in a university class where we are using a server. Each student in the class has access to the server. We all share it. I can see their files and open them, and they likewise can see ...
-2
votes
1answer
21 views

Usage of Domain from one server to another [closed]

Just want to ask if anyone have an idea about how to do this. I'm using a domain lets call it mymaindomain.com to connect to my Main Server, now I have a second Server that uses mysecondomain.com Is ...