Hot answers tagged server
24
Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things.
In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...
20
There are a number of defenses you can use to help prevent and recover from theft.
The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...
18
There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult.
Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...
17
Giving non-obvious names to things is akin to security through obscurity which is usually frowned upon in these parts. Problem with that kind of security is not that it does not work; indeed, it has some value, which was demonstrated many times through History (e.g. that's why a tank is called "tank" and not "armored chariot"). But you cannot quantify ...
15
No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic.
Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...
13
There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...
13
It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...
13
Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents.
There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...
12
Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...
12
Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data).
If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...
11
The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...
10
A firewall allows you to limit access to ports you specify, and you can specify sources as well. For example, you can prevent non-root users from creating services that accept connections, so an attacker can't create a new shell backdoor. You can even limit outbound connections to reduce the possibility of reverse shells. A not uncommon practice is to ...
9
Despite what others are saying, yes you can.
Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board.
The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...
9
One possibility is that sudo was configured to only execute certain applications - you can find examples of this in the sudo manual.
If one of these was vim, but bash was not an option then the user could not run sudo -i or sudo bash but would be able to run sudo vim. However, once done, vim would have an effective uid/gid of 0/0 and quite happily let you ...
8
You can have both public-key and password authentication on the same server. If public-key authentication fails, it will go to password authentication.
As to requiring both, that's seems silly and counterproductive, and checking man sshd_config there isn't an option to do this.
Your ssh private key should have a secure passphrase. So if an attacker ...
8
Pascal's blog entry shows a few weaknesses, some of which being recalled in ownCloud's advisory, but they did not recall the worst.
The storage of encryption keys as files in /tmp is already pretty bad, especially since /tmp is a true disk-based directory in many Linux and *BSD operating system (I usually configure my /tmp to be a memory-based filesystem, ...
8
Java is fine for servers. The security issues with Java are actually issues with the Java applet model, in which your JVM (in your browser) is meant to run potentially hostile code (i.e. code "from the Web") and yet somehow prevent that hostile code from doing bad thing. The applet model is a bit like running the applet code in a virtual machine, except that ...
8
An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...
7
This would be a prime example of Security Through Obscurity. While this does provide some security value, the gain is generally very minimal and it should never be relied upon as an ultimate defense.
As with any security measure, how to balance security and usability here is one which your organization needs to decide. If you can come up with a convenient ...
7
Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the ...
7
Going by your threat model which is theft of the server, I would choose to go with full disk encryption in the form of LUKS or similar.
For that threat model though, encryption shouldn't be your focus. Instead, make sure your datacentre has appropriate physical security in the form of access control, surveillance and the likes.
6
You can use match in sshd_config to select individual users to alter the PasswordAuthentication directive for.
Match User root,foo,bar
PasswordAuthentication no
Match User Rishee
PasswordAuthentication yes
This would give root, foo and bar key authentication, and Rishee password authentication.
An alternative is to match by negation, like this:
...
6
In a fight between a polar bear and a white shark, who will win ? Guess what, if this is a pool fight, the shark will munch through the bear in less than two minutes (this site makes unsubstantiated claims to the contrary, but there are strong clues that a shark eating a polar bear really happened). Now put them both on a land, and I will put my money on the ...
6
If you are stepping through one instruction at a time, and the segfault occurs immediately upon jumping (and not when hitting some potentially broken shellcode at the end of the NOP sled, which could also cause a segfault), and you are certain that the address is correct, points to valid memory and that your NOP sled itself isn't broken, then yes it seems ...
6
I strongly believe that the user is using Tor and possibly other services to anonymize their transmissions. At least two of the IP addresses you mentioned are Tor exit nodes. The points which Thomas Pornin laid out in his answer are the best solution, and are what I would do if I were you. Registration and user reputation are proven ways to alleviate spam. ...
5
Bison and flex are reasonable tools to write parsers for protocols which fit in an LALR(1) grammar; but they are just tools like, e.g., a C compiler. It is still up to you not to do anything wrong with them. For that matter, bison and flex mean that you are about to implement your code with C or C++, languages which are known to be difficult to handle ...
5
nsCertType is an old Netscape-specific extension, which was used by the Netscape browser at a time when that browser was still alive. You can forget it nowadays.
The signing CA, by principle, acts in any way as it sees fit. It can put whatever it wishes in your certificate. Your certificate request is just a suggestion. You can more or less count on the CA ...
5
As @HendrikBrummermann already pointed out in the comments, it was an attempt to exploit register_globals on a PHP enabled web server.
The server making the request that ended up in your web server's logs, so it turned out, was merely an infected web server running in zombie mode, running a stealth bot checking for possible attack vectors on unsuspecting ...
4
I would make sure you have these things:
Firewall
Host Based Intrusion Detection system on all your machines (OSSEC is a free one, but you have to tweak the rules a little)
Web Application Firewall
These solutions will significantly reduce the chance of a succesful attack by scanners etc. To have reasonable assurance you should also invest in a pentest. ...
4
Before you go down the road of hosting your own email, why do you want to get rid of gmail? Is it because of the contextual advertisements,... etc?
Is there another provider that can deliver the privacy and safety you need? (Microsoft Hosted Exchange, Google Hosted mail, or Hushmail)
When it comes to email, there are two general approaches to ...
Only top voted, non community-wiki answers of a minimum length are eligible
