Tag Info

New answers tagged

0

Running a packet sniffing tool like wireshark or tcpdump will let you clearly examine the traffic between the source IP and your web server.


0

Blocking an IP address at the firewall typically means dropping or rejecting the initial packet of a TCP connection during connection setup. The virtual host that the client is trying to connect to isn't known until much later, once the TCP connection is established and the client starts sending the HTTP request (specifically, you're looking for the Host: ...


0

Check the web server (HTTP) logs and filter by the IP address. That will show what resources (i.e. files, scripts, etc) are being requested.


4

Guess My educated guess from reading the spec: The browser will never see more than one server-certificate. Rather the cipher spec is negotiated in advance. And ONLY THEN does the server send the certificates. So if negotiation winds up with an an RSA-cert authenticated cipher suite, then the RSA cert chain will be sent. And if the negotiation winds up with ...


2

Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks. A VPN could add two potential benefits to your security here. Firstly it should encrypt the data between the endpoints. This is obviously a security benefit if ...


2

When deciding on SSL or not, remember it's more than just confiditiality: verify that the server is indeed the site you think you talk to prevent others from seeing confidential data prevent others from prevent others from modifying the data being transferred In some cases, having the data changed outside your knowledge may be as damaging as leaking a ...


1

In August, Google announced that it was giving a small boost in search rank to sites that used SSL. ...Over the past few months we’ve been running tests taking into account whether sites use secure, encrypted connections as a signal in our search ranking algorithms. We've seen positive results, so we're starting to use HTTPS as a ranking signal. ...


2

The cautious strategy would be to do SSL everywhere, then think about switching to non-SSL for some pages if (and only if) performance issues arise, that would be likely to be fixed with absence of SSL. Not using SSL means that passive attacker can see all the traffic, and active attackers can modify at will all the non-SSL parts, which can have deep ...


1

Depends on what data is going to be passed between the client and the server. For example, you will definitely need SSL for user login. I generally use SSL for everything that is online. My rule of thumb is, if data is passing through an open medium then use encryption.


1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...


1

Here is the script I use to make git to push to prod. https://gist.github.com/Zamicol/d9fac0c7857e1085f767 It assumes that anything pushed to the master branch is ready for production. All other pushed branches are ignored. You can modify this hook script to suit your needs. As far as your concerns, I place my git directory under /var/git and my ...


0

I think some responders made this a bit too complicated. You can shove the link into an iframe and have the iframe loaded into a webpage on mydomain.com. Example: cd /var/www/html/mydomain.com/ vi /var/www/html/mydomain.com/login.html On the login page, you can just insert the other site in an iframe: <iframe ...


1

DNS A record setup with a domain name will work as expected to mask to IP address from view. You will still need :89 after the hostname. DNS translates IP address (layer 3 protocol) Port number cannot be masked (layer 4 protocol)


0

Yeah it sounds like you just want to setup your first-server as a reverseproxy i.e. on mydomain-llc.com you just need in config ProxyPass /login/ http://x.y.z.t:89/ ProxyPassReverse /login/ http://x.y.z.t:89/ Now when people go to http://mydomain-llc.com/login/ their traffic will go through mydomain-llc to x.y.z.t, masking the IP and port from ...


3

As you mentioned, you can mask the IP address through DNS. However, there's nothing you can do to mask the port: the decision to display it or not is entirely up to the user's web browser. There are no security implications of exposing the address and port, though: it's trivial for a potential attacker to figure them out.


2

Your server itself (not Drupal) was compromised by a local Linux (root) exploit. Although Drupal may have aided in getting the exploit onto your machine, your machine was exploited with CVE-2013-2094, the "semtex.c exploit" $ md5 fileshare.ro_trolled MD5 (fileshare.ro_trolled) = ff1e9d1fc459dd83333fd94dbe36229a $ strings fileshare.ro_trolled | grep -i @fu ...


0

You asked how to find the malicious software on a compromised server. The short answer is that you cannot. You might be able to find some of the components installed by the compromise, but to be safe, you have to be certain you've found everything, and you cannot do that. (With complex modern operating systems, it amounts to proving a negative.) Once a ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


0

Some statistics from firefox telemetry. The link points to the usage statistics for the SSL_CIPHER_SUITE_FULL variable for firefox 32, showing which suite is actually used for connection between the release of firefox 32 (early september 2014) and today (early november 2014). Its values are defined in the firefox source code. Boiled down we have: 48% ...


0

The strange thing is, Microsoft offers GCM and ECDHE, but not both together with RSA certification. The only AES-GCM ciphers with ECDHE are tied to ECDSA. Otherwise GCM is only available with DHE_RSA. The list can be found in KB2929781 or the IISCrypto tool shows it. IE11 seems to have the same restrictions. I really wish they would implement ...


1

May I ask why you want to do this? This sort of physical segregation is (if done correctly) a high level of security, and normally only used for ultra-critical systems - military, intelligence, etc. It is rarely used in commercial environments, including banking. In your environment, you may do better to forget all about segregating, simply follow good ...


2

Any malware you get on your workstation can then do whatever you could do to the server, including copying any files, saving credentials, etc. Additionally, while you're connected to the internet, the malware could essentially proxy attacker traffic to the server. The setup you've described is arguably more secure if your client is not compromised. Your ...


1

I have recently done the same thing with a Doku Wiki (for secure, offline research storage) on my home desktop (An Arch Linux Box). Only instead of using Ubuntu directly, I ran my server through Virtualbox and Turnkey-Doku Wiki and only turn on Vbox when I need to add/remove things from it. I also have it setup with a bridged connection so it can still be ...



Top 50 recent answers are included