Hot answers tagged webserver
11
Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data).
If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...
9
The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...
7
An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...
5
If you have multiple websites on the same server then depending on the issue, a security problem with one site may well affect another.
Mitigating this essentially means increasing the separation between the two applications. You could do this by using somthing like a chroot jail or if that's not enough isolation you could look at using VM guests on the ...
4
Virtual machine, but real CPU. Regardless of how you elect to see it, the code for your server still runs on the machine of the supposed attacker. Similarly, disk encryption of any kind would not help either, even if you personally typed the password yourself upon boot: at some point, the data is still decrypted, on the attacker's machine.
Virtual machines ...
4
There are various levels of protection you can use. The most basic would be to configure them as separate sites running as different users and only allow each site's user access to the assets it needs. At a basic level, this should prevent one site from being able to access the other.
There are still some attacks that may be able to escape this though (if ...
3
fail2ban can be configured to do this. You can configure it to trigger on a regex match in a logfile and if it happens too many times per minute (not sure if it goes to second resolution but just multiply whatever you were thinking per second by 60) and it can drop the client IP into the iptables packet filter or whatever other action you want taken. Or you ...
3
I want to close the back doors into my system.
I believe that is your answer. You need to perform some incident response and find out what the cause of your breach was and close the holes that you have found.
Security is a mulch-layered approach, you will want some software like firewalls, antivirus, intrusion detection, etc. at the system level and ...
3
In order for such evidence to be accepted, it needs to be possible to tie the information in the image showing the Service Pack level to the system (IP address/URL) being scanned by Trustkeeper. A screenshot that has different windows open that shows you're providing appropriate evidence for the correct system should do the trick.
Do you know if the Service ...
3
If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want.
Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...
2
If you give someone code to run on their own computer, there is always the possibility that they will do something with it that you didn't want or expect. If you've given them the source code, you've made that easier for them. If you absolutely must give people the actual code, and you don't want them to play with it, here are two possibilities gleaned from ...
2
A normal Web browser will send, as part of its requests to Web servers, a standard header called User-Agent, which usually states the browser vendor, version, and type of machine and operating system on which it is currently running. You can use that to react on some device types. However, this is only for a cooperating client: a malicious user can alter at ...
2
I can't imagine why it would since this is not the domain of MDM, but as commercial suppliers keep trying to build one product to do everything rather than developing platforms which integrate, then it's quite possible I might be wrong.
Any MDM platform should allow you to configure VPN on the devices it controls.
Any browser advertises exactly what ...
2
Whether the SSL session identifier is made accessible, by your SSL hardware, to the rest of the server, is entirely up to the interface that this hardware offers.
A decent SSL hardware box should offer some kind of session management, so that the consumer (your Apache / nginx / whatever server behind the box) may know whether successive connections are from ...
2
As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...
1
fail2ban is an easy-to-implement solution in these cases.
Add a block-all-dem-noobs.conf file to your filter.d directory, something like this
failregex = ^ -.*GET
Translation: a RegExp to find GET requests
Then create a new entry in your jail.conf, something like this
[block-all-dem-noobs]
enabled = true
port = http,https
filter = block-all-dem-noobs
...
1
Honestly, based on whats been discussed in the comments, this doesn't sound like a hosting provider you trust at all. If that's really the case, the PCI auditor was right to fail you on this count. Why are you trusting them with PCI data?
You need to either move these assets in house or move them to a different provider that you trust.
In addition, rather ...
Only top voted, non community-wiki answers of a minimum length are eligible
