A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
39 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
1
vote
1answer
32 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
0
votes
0answers
17 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
2
votes
1answer
90 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
0
votes
0answers
16 views

Hamachi as a way to access home vCal / vCard server - security risk?

I have a home server providing a way to sync contacts and calendars between my machines. Until now, I was using it only with computers in my LAN, but recently I need to sync a computer that is on ...
0
votes
0answers
82 views

My website is getting this request all day long every minute xmlrpc.php

I am new to web building and I have word-fence blocking this as googling it tells me it's an attack on my server/website. My question is what are they hoping to achieve, it's not causing that much ...
3
votes
2answers
97 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
-4
votes
1answer
111 views

whats with Chinese and Russian proxy servers?

I keep hearing that if you commit some network activity via Chinese or Russian proxy servers you are very difficult to be tracked down. What is the reason for this other than lack of international ...
0
votes
2answers
98 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
1
vote
0answers
22 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
0
votes
1answer
39 views

how to determine the cipher suites supported by a SERVER?

I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the ...
1
vote
1answer
68 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
2
votes
1answer
54 views

Is it a good practice to forbid ip access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, An Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...
8
votes
5answers
270 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls that require authentication. Hence the server will need to know the literal passwords to make those calls. What options do ...
-6
votes
1answer
74 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
1answer
35 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
0
votes
2answers
59 views

How can website server recognize incoming Tor or VPN connection? [duplicate]

I was trying to signup for a service provided by a website using Tor, the website prevented me and asked me to disable my proxy settings, he noticed me with the following: Our checks indicate that ...
2
votes
1answer
79 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
2
votes
1answer
148 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
3
votes
3answers
233 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
29 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
7
votes
1answer
115 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
3
votes
1answer
99 views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g ...
6
votes
5answers
732 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
1
vote
4answers
89 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
5
votes
1answer
42 views

What are the recommended directory ownership & permissions for hosted websites?

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites. └── var └── www ├── website1 │   └── public_html └── website2 ...
4
votes
2answers
172 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
5
votes
4answers
285 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
0
votes
1answer
49 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
-1
votes
1answer
31 views

How can someone execute arbitrary code on Python's built in server module? [closed]

I'm not sure if this question could be consider inappropriate here. $ python -m http.server The source code tells: # https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21 SECURITY ...
2
votes
1answer
652 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
73 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
2
votes
0answers
746 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
4
votes
1answer
73 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
3
votes
1answer
53 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
1
vote
3answers
54 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
-1
votes
2answers
87 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
37
votes
11answers
33k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
0
votes
0answers
30 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
1
vote
1answer
23 views

Usefulness of Server's Work Load given Timing Attack Resistance of Responses

I've read articles in the past discussing the importance of having timing attack resistant responses for information where knowing the time for evaluation would leak information about the data being ...
0
votes
0answers
31 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
1
vote
5answers
308 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
1answer
129 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
41
votes
8answers
5k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible ...
1
vote
2answers
165 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
2
votes
2answers
104 views

Physical protection of your servers?

Here is a scenario. You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but ...
4
votes
1answer
119 views

Investigating a possible rogue DNS Server (maybe DNSChanger)

One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to ...
8
votes
1answer
83 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
3
votes
0answers
104 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...