New answers tagged webserver
2
My suggestion would be as follows:
Store the PDFs on a LUKS partition (or GPG full-disk / TrueCrypt full-disk), so that theft of the physical disks should not yield the data.
Run a secondary HTTP server whose sole job it is to serve these files. Configure your file permissions such that only that HTTP server can read the PDFs. This provides minimum attack ...
0
Regardless of the length and complexity of the unique string, a file name can be guessed or a compromised communication link may be intercepted to learn the file names.
Why aren't you utilizing a method like scp, if all you are doing is to make pdf files available to your client ? This way, you can either force the user(recipient) to enter a password or ...
4
You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts.
You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...
0
If you're talking about the Internet...
Another way that you might be able to see if the IP address is registered by the same entity is to visit a website like arin.net and do a whois look up for the ip address's registrant. If they're not listed in that site they'll tell you which whois server you should query.
You can additionally do an IP location ...
1
Yes, a server could be present on many network, sub-networks, backbones and so.
If you reach a single host through two different routes, you will find the same server with two different ip.
If this server hold some certificats, they have to match a DNS name.
So you could find some of them under https, smtps, imaps, and so on...
You could use openssl tool ...
1
Ping each system so they're in your system routing tables. Run >arp -a
That should list the IP addresses and the corresponding MAC addresses. If the two IP addresses have the same MAC address, then it's the same system.
2
You can't do it using the MAC address - these are not visible across routers. Even if you were on the same LAN, it doesn't solve the problem (as posted) since it's trivial to change a MAC address.
The big question is how closely you need to stick to your requirement.
There are lots of solutions such as simply authenticating the user, using authentication ...
2
You can use Kerberos network authentication protocol for authenticating user before accessing the machine. Kerberos provides strong authentication for client/server applications by using secret-key cryptography where both client and server prove their identity across an insecure network connection. I recommend to read "Best Practices for Integrating Kerberos ...
5
There are various levels of protection you can use. The most basic would be to configure them as separate sites running as different users and only allow each site's user access to the assets it needs. At a basic level, this should prevent one site from being able to access the other.
There are still some attacks that may be able to escape this though (if ...
6
If you have multiple websites on the same server then depending on the issue, a security problem with one site may well affect another.
Mitigating this essentially means increasing the separation between the two applications. You could do this by using somthing like a chroot jail or if that's not enough isolation you could look at using VM guests on the ...
0
You can configure Apache mod_evasive module. This module provides a very basic function by keeping a hash table of IPs and pages requested and when a threshold level is exceeded on a target page or site it will “block” the IP with a 403 “Forbidden” error. For configuration details you read "How to Stop an Apache DDoS Attack with mod_evasive".
1
fail2ban is an easy-to-implement solution in these cases.
Add a block-all-dem-noobs.conf file to your filter.d directory, something like this
failregex = ^ -.*GET
Translation: a RegExp to find GET requests
Then create a new entry in your jail.conf, something like this
[block-all-dem-noobs]
enabled = true
port = http,https
filter = block-all-dem-noobs
...
3
fail2ban can be configured to do this. You can configure it to trigger on a regex match in a logfile and if it happens too many times per minute (not sure if it goes to second resolution but just multiply whatever you were thinking per second by 60) and it can drop the client IP into the iptables packet filter or whatever other action you want taken. Or you ...
1
Honestly, based on whats been discussed in the comments, this doesn't sound like a hosting provider you trust at all. If that's really the case, the PCI auditor was right to fail you on this count. Why are you trusting them with PCI data?
You need to either move these assets in house or move them to a different provider that you trust.
In addition, rather ...
-1
If you have to have this type of interaction with the Service Provider, you have a bigger security risk than Windows Server 2003 SP1... that bigger security risk IS the security provider.
Fire them as quickly as you can, and find another.
3
In order for such evidence to be accepted, it needs to be possible to tie the information in the image showing the Service Pack level to the system (IP address/URL) being scanned by Trustkeeper. A screenshot that has different windows open that shows you're providing appropriate evidence for the correct system should do the trick.
Do you know if the Service ...
3
I want to close the back doors into my system.
I believe that is your answer. You need to perform some incident response and find out what the cause of your breach was and close the holes that you have found.
Security is a mulch-layered approach, you will want some software like firewalls, antivirus, intrusion detection, etc. at the system level and ...
2
As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...
3
If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want.
Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...
2
If you give someone code to run on their own computer, there is always the possibility that they will do something with it that you didn't want or expect. If you've given them the source code, you've made that easier for them. If you absolutely must give people the actual code, and you don't want them to play with it, here are two possibilities gleaned from ...
4
Virtual machine, but real CPU. Regardless of how you elect to see it, the code for your server still runs on the machine of the supposed attacker. Similarly, disk encryption of any kind would not help either, even if you personally typed the password yourself upon boot: at some point, the data is still decrypted, on the attacker's machine.
Virtual machines ...
2
A normal Web browser will send, as part of its requests to Web servers, a standard header called User-Agent, which usually states the browser vendor, version, and type of machine and operating system on which it is currently running. You can use that to react on some device types. However, this is only for a cooperating client: a malicious user can alter at ...
0
If its a web server, you can install Google analytics that will not only tell you what device is connecting, but # of visits, browser, OS, country, new vs returning visits and much much more.
I am not sure if that's a kind of solution you were looking for but I decided to share this information just in case if you think its valuable. Other members will ...
2
I can't imagine why it would since this is not the domain of MDM, but as commercial suppliers keep trying to build one product to do everything rather than developing platforms which integrate, then it's quite possible I might be wrong.
Any MDM platform should allow you to configure VPN on the devices it controls.
Any browser advertises exactly what ...
Top 50 recent answers are included
