New answers tagged server
0
I have a Buffalo Linkstation Pro and with the latest firmware it comes the option that supports AFS file system that is encrypted. That will ensure communications between your PC and NAS are encrypted.
SMB should support NTLMv2 in windows for communications which is encrypted too.
The issue to manage the storage itself to be encrypted it will drive you ...
3
I want to close the back doors into my system.
I believe that is your answer. You need to perform some incident response and find out what the cause of your breach was and close the holes that you have found.
Security is a mulch-layered approach, you will want some software like firewalls, antivirus, intrusion detection, etc. at the system level and ...
0
You could write a custom PAM module that would allow access if a user wasn't listed in a database (so it doesn't affect your admin accounts) or if the user's database entry had an active support ticket. Drop a reference to your new custom auth module in /etc/pam.d/sshd.
1
SFTP is a not really intended for what you are trying to accomplish. Anything else you would be implementing would be non-standard.
You may want to create a web app for upload where you can also implement a workflow where there are authorization requests and tickets associated with each request that an authorized user must use in order to initiate the file ...
19
There are a number of defenses you can use to help prevent and recover from theft.
The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...
7
Going by your threat model which is theft of the server, I would choose to go with full disk encryption in the form of LUKS or similar.
For that threat model though, encryption shouldn't be your focus. Instead, make sure your datacentre has appropriate physical security in the form of access control, surveillance and the likes.
2
There are different types firewall in place each have its own purpose we have
Packet Filter Firewall: Packet-filtering firewalls are the simplest firewall that validate packets based on protocol, source and/or destination IP addresses, source and/or destination port numbers, time range. They have no visibility to the packet payload.
Stateful Packet ...
9
A firewall allows you to limit access to ports you specify, and you can specify sources as well. For example, you can prevent non-root users from creating services that accept connections, so an attacker can't create a new shell backdoor. You can even limit outbound connections to reduce the possibility of reverse shells. A not uncommon practice is to ...
1
The only sane protection against DDoS attacks is deploying a service like CloudFlare.
The very nature of a DDoS attack makes it difficult to detect and stop. How are you going to distinguish between malicious and normal traffic? Even if you have such a means, performing analysis on every single connect attempt on your server is probably going to overload ...
-2
You can also just filter connexion with MAC Address. So you will authorize just some specific devicce to access this port. (I know about MAC spoofing, but every solutions has threats...)
1
Here's a small project I wrote, which uses geoip to keep track of the places people log in from and sends out an alert when someone logs in from a geographical location not previously seen for that user: howler.
It doesn't prevent anyone from logging in, but it's pretty effective and quickly becoming aware of unusual login patterns.
10
The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...
8
An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...
12
Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data).
If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...
Top 50 recent answers are included
