Tag Info

Hot answers tagged

5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

Guess My educated guess from reading the spec: The browser will never see more than one server-certificate. Rather the cipher spec is negotiated in advance. And ONLY THEN does the server send the certificates. So if negotiation winds up with an an RSA-cert authenticated cipher suite, then the RSA cert chain will be sent. And if the negotiation winds up with ...


3

As you mentioned, you can mask the IP address through DNS. However, there's nothing you can do to mask the port: the decision to display it or not is entirely up to the user's web browser. There are no security implications of exposing the address and port, though: it's trivial for a potential attacker to figure them out.


2

Any malware you get on your workstation can then do whatever you could do to the server, including copying any files, saving credentials, etc. Additionally, while you're connected to the internet, the malware could essentially proxy attacker traffic to the server. The setup you've described is arguably more secure if your client is not compromised. Your ...


2

The cautious strategy would be to do SSL everywhere, then think about switching to non-SSL for some pages if (and only if) performance issues arise, that would be likely to be fixed with absence of SSL. Not using SSL means that passive attacker can see all the traffic, and active attackers can modify at will all the non-SSL parts, which can have deep ...


2

Your server itself (not Drupal) was compromised by a local Linux (root) exploit. Although Drupal may have aided in getting the exploit onto your machine, your machine was exploited with CVE-2013-2094, the "semtex.c exploit" $ md5 fileshare.ro_trolled MD5 (fileshare.ro_trolled) = ff1e9d1fc459dd83333fd94dbe36229a $ strings fileshare.ro_trolled | grep -i @fu ...


2

Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks. A VPN could add two potential benefits to your security here. Firstly it should encrypt the data between the endpoints. This is obviously a security benefit if ...


2

When deciding on SSL or not, remember it's more than just confiditiality: verify that the server is indeed the site you think you talk to prevent others from seeing confidential data prevent others from prevent others from modifying the data being transferred In some cases, having the data changed outside your knowledge may be as damaging as leaking a ...


1

In August, Google announced that it was giving a small boost in search rank to sites that used SSL. ...Over the past few months we’ve been running tests taking into account whether sites use secure, encrypted connections as a signal in our search ranking algorithms. We've seen positive results, so we're starting to use HTTPS as a ranking signal. ...


1

Depends on what data is going to be passed between the client and the server. For example, you will definitely need SSL for user login. I generally use SSL for everything that is online. My rule of thumb is, if data is passing through an open medium then use encryption.


1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...


1

Here is the script I use to make git to push to prod. https://gist.github.com/Zamicol/d9fac0c7857e1085f767 It assumes that anything pushed to the master branch is ready for production. All other pushed branches are ignored. You can modify this hook script to suit your needs. As far as your concerns, I place my git directory under /var/git and my ...


1

DNS A record setup with a domain name will work as expected to mask to IP address from view. You will still need :89 after the hostname. DNS translates IP address (layer 3 protocol) Port number cannot be masked (layer 4 protocol)


1

May I ask why you want to do this? This sort of physical segregation is (if done correctly) a high level of security, and normally only used for ultra-critical systems - military, intelligence, etc. It is rarely used in commercial environments, including banking. In your environment, you may do better to forget all about segregating, simply follow good ...


1

I have recently done the same thing with a Doku Wiki (for secure, offline research storage) on my home desktop (An Arch Linux Box). Only instead of using Ubuntu directly, I ran my server through Virtualbox and Turnkey-Doku Wiki and only turn on Vbox when I need to add/remove things from it. I also have it setup with a bridged connection so it can still be ...



Only top voted, non community-wiki answers of a minimum length are eligible