A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

6
votes
1answer
250 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
4
votes
0answers
101 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
57
votes
5answers
22k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
0
votes
2answers
59 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
3
votes
1answer
84 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
5
votes
2answers
124 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
3
votes
2answers
138 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
45
votes
8answers
6k views

Hack-resistant hosting solution for non-profit?

(While the answers and comments at How do I deal with a compromised server? are useful, my question is more about prevention of hacking when I do not have total (or much) control over the server. I ...
3
votes
1answer
48 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
3
votes
1answer
216 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
5
votes
1answer
69 views

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? What issues may arise from this? Is there any benefit in doing ...
1
vote
3answers
130 views

Are there any problems with using CAMELLIA, IDEA and SEED based cipher suites on a web server in 2016?

I have recently seen CAMELLIA, SEED and IDEA cipher suites in use for HTTPS on a web server and am unsure what to suggest to the owner. The keys in use are all over 128 bits in length and standard ...
4
votes
4answers
173 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
2
votes
1answer
630 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
0
votes
0answers
47 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
18
votes
3answers
4k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
5
votes
3answers
185 views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
1
vote
2answers
68 views

Security risk of a service that allows a user to test from connectivity from a server to a printer

What are the security risks in adding a feature to an application which allows users to test for connectivity from a server to a printer? I'm planning to add a feature to my application to allow ...
0
votes
1answer
50 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
8
votes
1answer
422 views

Is exposing website performance data a security risk?

I am currently adding a subsite to some websites that allows me to monitor performance data live as the server software perceives it. The data is mostly stuff like amount of memory used, memory ...
82
votes
6answers
11k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
21
votes
5answers
2k views

What is the best option for setting up a several sites supporting SSL on the same IP?

If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
15
votes
5answers
21k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
3
votes
3answers
378 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
1
vote
0answers
42 views

What can go wrong when allowing file uploads on a web server? [closed]

Some basics that are self-evident: Infected/harmful file can be uploaded for other users to download A bug in the web-site's code allowing code execution, thus allowing execution of the uploaded ...
21
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
4
votes
1answer
386 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
1
vote
1answer
110 views

How secure and how to find if a website use Flexible SSL from Cloudflare?

How secure is that technology? Can someone tamper with your traffic between a server and Cloudflare in the first place? And if the answer is yes, how can you check if a website is using the ...
3
votes
1answer
27 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
2
votes
2answers
97 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database [...
5
votes
2answers
1k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
-1
votes
2answers
112 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
3
votes
1answer
674 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: [15/Jan/2016:10:27:...
3
votes
1answer
162 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
0
votes
1answer
45 views

Block web content authoring from internet

In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet? Configuring httpd.conf to restrict the content ...
0
votes
1answer
61 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
1
vote
1answer
387 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
2answers
170 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
1
vote
1answer
127 views

How to trace someone's(hackers) IP who made a lot of request on my website? [duplicate]

Somebody made a lot of(unusual, like never before) http requests on my website, I checked this thing on google analytics and it shows that someone with no lang, no country has visited my website. My ...
-1
votes
1answer
79 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...
3
votes
3answers
89 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
2
votes
1answer
1k views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
4
votes
1answer
165 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
3answers
149 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
0
votes
1answer
105 views

Does the server administrator see what sites I visit

I have seen a lot of answers but here is the peculiarity of mine. In the office we all have a login to the WiFi, First with that login, if I use Tor will my visited sites still be logged by the ...
1
vote
4answers
157 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...