A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
0answers
24 views

How does SFTP work? Please help someone [migrated]

We run a system that automatically sends a swift message at the end of a process. But this messages are sent using FTP. We feel the FTP process is too prone to MITMA and wish to change the sending ...
4
votes
1answer
100 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
3
votes
1answer
48 views

Server closed connection error on several browsers when testing SSL

I have uploaded a SSL Certificate to my site www.walksindorset.co.uk. When I test the SSL rating I receive the error message "Server closed connection" on over 15 browsers which includes Andriod 4.0....
2
votes
3answers
77 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
1
vote
2answers
145 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
0
votes
1answer
83 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
-1
votes
1answer
32 views

What are some good ways to test our back-end application? [closed]

We are just a few weeks to launch our mobile application for a few costumers to validate and test. This application is directly bounded to our server, which runs a back-end RESTful application. What ...
-2
votes
1answer
73 views

How safe is it to use tor on a monitored network?

So in a shape this question has been asked but mine is more specific. If It is a work network that blocks a huge number of websites and services, you can use tor to circumvent the blocks but can the ...
1
vote
1answer
44 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
1
vote
0answers
44 views

Make my SSH I treat like VPN more anonymous [closed]

I have a VPS (although I could easily upgrade to a dedicated server) which I use as a "poor man's VPN" by tunneling through it. My aim is to improve this server so anyone attempting to track me has ...
-4
votes
1answer
80 views

Safest SQL database [closed]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
0
votes
1answer
44 views

secure ways to prevent access to an application by more than one person at a time?

If an application is licensed in such a way that is set up for one user, on one computer, how can I secure it? Even if locking into one computer, how could you prevent the computer from being ...
5
votes
3answers
220 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
2
votes
0answers
15 views

Distributed Shared Secret for RNG that only Distributor knows?

For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
0
votes
1answer
35 views

How to check connectivity between raspberry pi and server [closed]

How to check connectivity between raspberry pi (which act as a client) and server using web-socket
20
votes
2answers
3k views

What are the negative aspects of creating fake security footprints?

My take on reducing the risk of being hacked on products and installation have often been to create false footprints. From my own experience, the servers I've spent most time (and hate) on hacking ...
1
vote
1answer
109 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
-4
votes
2answers
44 views

Forcing javascript on to a server [closed]

this might be on the edge, but the purpose is not illegal. I want to edit a javascript on a server and feed it to the server with a change. Is this possible? To either edit it within the server and ...
23
votes
4answers
21k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
0
votes
2answers
173 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with Windows Defender multiple times but haven't found anything. My ...
0
votes
1answer
32 views

How to check if any host trying to connect back to the my executable(application)?

Last month i have downloaded some hacking tools!!! After that i'm having a strong feeling that some host trying to connect back to the application(don't know whether i'm been monitored or not). Is ...
0
votes
0answers
20 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
2
votes
1answer
99 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
0
votes
0answers
16 views

Hamachi as a way to access home vCal / vCard server - security risk?

I have a home server providing a way to sync contacts and calendars between my machines. Until now, I was using it only with computers in my LAN, but recently I need to sync a computer that is on ...
0
votes
0answers
108 views

My website is getting this request all day long every minute xmlrpc.php

I am new to web building and I have word-fence blocking this as googling it tells me it's an attack on my server/website. My question is what are they hoping to achieve, it's not causing that much ...
3
votes
2answers
100 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
-4
votes
1answer
137 views

whats with Chinese and Russian proxy servers?

I keep hearing that if you commit some network activity via Chinese or Russian proxy servers you are very difficult to be tracked down. What is the reason for this other than lack of international ...
1
vote
0answers
23 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
0
votes
1answer
61 views

how to determine the cipher suites supported by a SERVER?

I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the ...
2
votes
1answer
64 views

Is it a good practice to forbid ip access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, An Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...
8
votes
5answers
274 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls that require authentication. Hence the server will need to know the literal passwords to make those calls. What options do ...
-5
votes
1answer
123 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
1answer
45 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
0
votes
2answers
94 views

How can website server recognize incoming Tor or VPN connection? [duplicate]

I was trying to signup for a service provided by a website using Tor, the website prevented me and asked me to disable my proxy settings, he noticed me with the following: Our checks indicate that ...
2
votes
1answer
98 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
2
votes
1answer
188 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
3
votes
3answers
311 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
37 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
7
votes
1answer
135 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
4
votes
1answer
138 views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g https://scholar.google.com.sg/scholar?hl=en&q=%22decoy+server%22&...
6
votes
5answers
787 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
1
vote
4answers
93 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
5
votes
1answer
45 views

What are the recommended directory ownership & permissions for hosted websites?

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites. └── var └── www ├── website1 │   └── public_html └── website2 ...
5
votes
4answers
289 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
0
votes
1answer
50 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
-1
votes
1answer
44 views

How can someone execute arbitrary code on Python's built in server module? [closed]

I'm not sure if this question could be consider inappropriate here. $ python -m http.server The source code tells: # https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21 SECURITY WARNING:...
2
votes
1answer
769 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
79 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...