A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

4
votes
2answers
248 views

What port services can hackers use to break into a server?

I am getting ready to run my first server. I will use ufw to disable every port except port 22 for ssh and port 80 for http. I am curious though. Suppose theoretically I left every port open except ...
1
vote
2answers
51 views

Is a server absolutely safe if the attacker don't know unknown bug?

If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?
0
votes
0answers
27 views

How can I Run my Kali Tools on a Remote Server [migrated]

I am currently ssh-ed into a remote server. However, I do not have root permissions on the remote server and therefore am unable to install and use tools such as nmap. I've been trying to figure out ...
0
votes
1answer
15 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
1answer
213 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
-1
votes
1answer
45 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
6
votes
2answers
6k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
3
votes
1answer
145 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
0
votes
1answer
95 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://mysite.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
1
vote
1answer
99 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
1
vote
1answer
56 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
-1
votes
1answer
56 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
5
votes
4answers
1k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
1
vote
1answer
124 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
2
votes
0answers
63 views

Ubuntu server seems compromised for a DDOS attack [duplicate]

So i have this VPS Ubuntu v12.04 Server running with DigitalOcean. Zpanel/Apache/PHP stack was installed on the Server For the past few days it was occasionally down. Initially, I didn't know what ...
1
vote
2answers
99 views

Does where I put my PKI certificates matter?

I have an intermediate and a root PKI certificate that I see were already imported into a computers (windows server 2003) certificate store. However both the intermediate and root certificates were ...
2
votes
1answer
84 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
1
vote
1answer
49 views

Defense of a server against malicious uploaded resources

We know that viruses and other threats can propagate through mail etc.But when any resource is shared,it is uploaded to the server and then shared.This means that the server does not take the ...
0
votes
1answer
229 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
1answer
82 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
2
votes
1answer
76 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
2answers
326 views

Are there any logic-bombs that execute when the file is deleted?

I want to delete a suspected malicious file from a server. For the purposes of this question assume that the infected machine is Windows Server 2003 or later. Is there any risk in deleting such a ...
1
vote
1answer
91 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
5
votes
6answers
2k views

Is it possible to locate Tor/proxy users? Spam is getting on my nerves

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "GAYGAYGAYGAYGAYGAYGAY" "FRIGHT IS GAY HAHAHAHHAA" "ADMINS ...
1
vote
2answers
262 views

best place to store backup encryption key [closed]

I have a server on which I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed and is physically accessible to many people. Further, I would ...
1
vote
1answer
80 views

Implications of Bash history [closed]

I am using Salt Cloud to script my deployments of a small collection of commercial servers. Since it is cheap to get things right the first time, I'd like to avoid obvious mistakes. If I leave my ...
3
votes
3answers
193 views

How do I store a user's secret key on a server?

I'm learning about security at the moment and one thing I'd like to try out is having a key server distribute keys to clients that will allow them to securely save and read data locally. My basic ...
0
votes
0answers
188 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
0
votes
1answer
69 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
0
votes
3answers
179 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
1
vote
3answers
132 views

Multiple SSL server certificates

I am sort of new to SSL. During a SSL connection establishment, I see that the server is sending multiple certificates. Can someone help me to understand why the server is sending multiple ...
0
votes
1answer
63 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
1
vote
1answer
168 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
1answer
55 views

Protecting encryption of outdated software with a server

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL ...
7
votes
3answers
226 views

What is a good source for hardened base configurations

I attended B-Sides in Orlando FL where one of the speakers had mentioned a site which contains hardened configs for popular services such as apache and postfix. The author of these configs is ...
1
vote
1answer
52 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
1
vote
1answer
183 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
1
vote
2answers
193 views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
1
vote
4answers
106 views

Is it possible to block specific users that connect to the internet behind of same gateway with NAT?

Assume there are two internet users (A and B) that connect to the internet from the same gateway by using NAT. That means they use same IP address while passing through our firewall. Now assume we ...
6
votes
1answer
164 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
1
vote
1answer
93 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
0
votes
0answers
84 views

OWASP ZAP with self-signed server cer

I have my browser connect to ZAP via proxy with ZAP cer imported into firefox. I am getting " "connection timeout" when trying to access self-signed server but i am able to see traffic from ...
0
votes
1answer
185 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
8
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
1
vote
3answers
95 views

Is forwarding a port(s) a security risk to all computers on the network or just one?

I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
1
vote
0answers
137 views

Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk?

I'm working on upgrading an old Windows RAS server that hosts PPTP VPN. I want to move to a L2TP/IPsec VPN. Due to the firewall appliance we use, the VPN server has to be behind a NAT. This means ...
1
vote
1answer
178 views

Certificate services will not start with “server is offline” error [closed]

I have a subordinate CA. The Enterprise root service was uninstalled from the network by accident and then migrated to a new box using the same key. This new server has a different server name. It ...
1
vote
2answers
89 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
0
votes
2answers
165 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...