New answers tagged

0

At least in the latest versions of Authy's Android application authenticator tokens, such as your Gmail TOTP, are sent to api.authy.com only after being encrypted using an AES key derived from your backup password and a randomly generated salt using PBKDF2. According to this source information sent from the API to your mobile phone has the following format: ...


2

Disable exec and suexec, enable open_basedir and basically follow every suggestion in this post. You mentioned still there are other ways to... if after reading that post you still have questions or weaknesses, please post them here or in Serverfault


-1

You've not specified what SQL your using. Keep in mind that Microsoft SQL Server will only execute onto Windows operating system. I'll make the assume that your using Windows Server and Microsoft SQL Server. Firewall: Blocked all connections. Allow port 1433 (SQL TCP) for your computer which talks to SQL only Allow port 1433 (SQL UDP) for your computer ...


0

I'm with TesselatingHeckler that you should really think twice about this because making a big project with half-assed copy pasta solutions in server and SQL is really a bad idea. You can read up the information necessary but as said, its just really broad. You should probably start with the database as this is the most critical part of an application and ...


0

For securing a server you can follow the TCP/IP Model for trying to have the most secured system possible. With this model you will apply the principe of secure in depth and you will apply a secured principe on each layer of the model. Example: If your SQL server talk with only a few servers in the same local network you can do a static ARP table with ...


2

Can't tell if that's a typo or not. But you wrote ErrorDocument 403 'not found'. Remember that each of the various error messages corresponds to a different condition. So, for example, Error 403 is not the error that happens when someone looks for a URL that doesn't exist. Error 404 is what is transmitted in that case. If you really want to override ALL of ...


4

Try creating some custom error response pages. A plain old HTML page that just says something along the following lines: ERROR 403: You are not authorised to access this resource. It doesn't even need any formatting.


0

Depending. If a DDoS of the size of just 1 byte over a half of the internet is launched on the rest, the entire Internet will be down. But that is almost impossible. Normal DDoS attack can be absorbed but not stopped. In the example above by Tom Leek, the security guy can handle only so much people, if the entire world come flooding in, they can do ...


1

If an attacker was attempting a DoS on a server, measuring the load could provide information regarding the success of a DoS as well as help the attacker determine how much more resources are required to further the attack. This could be helpful if resources are not freely available. Perhaps the resources are busy doing other things and will be costly to ...


0

You usually won't see DDoS traffic on your analytic page. That's because GA and others rely on Javascript, while the vast majority of DDoS Bots don't support JS. For referer spam such as buttons-for-websites, semalt and others, you need some bot access control. more information available here. Disclosure: I work @ Imperva Incapsula, a CBSP which provides ...



Top 50 recent answers are included