A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

0
votes
1answer
21 views

Does serving Tomcat via Apache Webserver improve security?

This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios: Tomcat serves ...
4
votes
1answer
42 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
0
votes
0answers
10 views

How to stop auto-created files to happen?

I'm new to "Information Security" so I hope I'm in the right place. I'm experimenting a very disapointing problem on my hosting server: some files are automaticaly created and I don't know how. The ...
3
votes
1answer
47 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
-2
votes
1answer
48 views

protect files on webserver, allow only internal use

I have a website and it has an audio player to play music files, the music files are hosted in a public directory. Since they are they anyome can point there and use the files on their website. Is ...
2
votes
3answers
68 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
9
votes
5answers
6k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
2
votes
1answer
325 views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
17
votes
2answers
1k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
1
vote
4answers
102 views

untangle server at work place privacy

When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example: Skype chat messages Personal emails (Gmail, Yahoo)
0
votes
1answer
28 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
0
votes
0answers
35 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
4
votes
2answers
147 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
5
votes
3answers
590 views

Can allowing a web application to move, copy and/or delete files outside of the server root be a security issue?

I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it ...
4
votes
2answers
140 views

You've just acquired a newly created CentOS server, what should you do to secure it?

I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?
0
votes
2answers
50 views

Attack surface for a site that hosts only static content HTML and images?

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
0
votes
2answers
50 views

What type of probing sends GET /“ data ” to a server?

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like No route found for "GET /wp-login.php" (uncaught exception) No route found for "GET ...
2
votes
1answer
53 views

What security does nginx provide between server blocks?

What security does nginx provide between server blocks? Here is an example scenario. Say I have two server blocks configured with nginx. Each serves up a web application to authenticated users. I ...
-3
votes
1answer
46 views

Security concerning using Windows 7 as a web server [closed]

Can Windows 7 be used for hosting a low traffic website which only use php and mysql and nothing else, like email, file hosting, etc.
0
votes
3answers
55 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
2
votes
1answer
123 views

What features boost security for a home edge router?

I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
18
votes
4answers
2k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
1
vote
3answers
573 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
5
votes
1answer
160 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
21
votes
3answers
6k views

“Optimal” Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...
0
votes
1answer
89 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
1answer
38 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
25
votes
4answers
21k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
0
votes
1answer
27 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
2
votes
1answer
223 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
0
votes
0answers
29 views

Managing keyczar keysets across multiple servers (google compute engine)

I'm a developer building a web service that will be required to store a few credentials for 3rd party services that would themselves provide access to customer data that I would consider sensitive. ...
1
vote
1answer
73 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
-2
votes
1answer
126 views

Backdoors and hard-coded usernames and passwords

I have been researching on computer worms that brought me to this topic of backdoors. According to my research, backdoors are malicious pieces of code that are inserted into either computers to get ...
12
votes
5answers
4k views

Index page has been compromised, suspicious files are showing up

My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
1
vote
1answer
802 views

Skype chat history and web browsing history CHECK

In an office work place, can a network admin have access to my Skype chat history and web browsing history without logging in to my pc since all pc's are connected with the same network? i am ...
36
votes
6answers
3k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
13
votes
3answers
17k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET ...
1
vote
1answer
54 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
2
votes
4answers
443 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
0
votes
2answers
157 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
44
votes
1answer
6k views

What should end-users do about Heartbleed?

What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to ...
13
votes
7answers
736 views

Online Government Elections System - Is it possible?

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
0
votes
2answers
239 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
1
vote
4answers
132 views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
11
votes
4answers
437 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
4
votes
2answers
187 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
10
votes
4answers
654 views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
7
votes
3answers
620 views

Does hiding version numbers increase my security? [duplicate]

I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits. As an ...
8
votes
1answer
152 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
-1
votes
1answer
112 views

How bad is to buy domain name with .ext from another country even if they allow non citizens to own one?

I'd like to purchase a domain name from a country that does not require citizenship, since they can make nice urls, they are more available and sometimes not too expensive too! But few things annoys ...