Questions tagged [remote-server]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
45
votes
5answers
46k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
37
votes
2answers
9k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
36
votes
5answers
130k views

How to find out the IP address of email sender in Gmail

Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender. Since Gmail ...
20
votes
1answer
3k views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
13
votes
4answers
8k views

Why not simply backup the TrueCrypt container file?

The TrueCrypt website has some detailed information on how to backup (TrueCrypt non-system volumes) securely, summarised below: Create a new TrueCrypt volume Mount the main volume. Copy all ...
12
votes
3answers
762 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
12
votes
2answers
7k views

Securing MySQL server from remote connection

I need to open the port for my MySQL server to the outside and from what I read, the default configuration is not secure nor encrypted. For that I have a few solutions in mind with their reason but I'...
9
votes
7answers
3k views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...
6
votes
4answers
14k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery (...
5
votes
5answers
615 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step 1)...
5
votes
1answer
110 views

Should I take care of mysql credentials?

My mysql server is configured to not allow remote connection. Should I seriously care about mysql user and password in this case?
5
votes
5answers
270 views

Testing C++ Algorithm On A Server

I am making a C++ testing server and want to do that compiled programs would: not have access to read or write files. not have access to open or connect through sockets. not be able to work with ANY ...
5
votes
1answer
9k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
5
votes
1answer
177 views

Harden root remote access

I'm trying to find a good method for hardening a server while allowing automated remote management via ssh (ansible). The popular choice is login with a normal user and then use sudo, but this has ...
4
votes
1answer
796 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
4
votes
2answers
2k views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
4
votes
1answer
270 views

Sulley - only using ASCII printable characters

I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol. s_initialize('CWD') s_static('CWD')...
4
votes
1answer
115 views

How does one typically monitor their privileged admins encrypted SSH & RDP sessions?

From a compliance (& perhaps just for pure due-diligence) standpoint, what do IT departments typically deploy to keep an eye on their privileged administrator's remote access sessions? Also what'...
3
votes
2answers
144 views

What is a proper way of destroying data remotely?

After watching a Defcon talk about data destruction, I became interested in the subject of how I would go around remotely destroying all my data on all my systems. I got to a point where I figured ...
3
votes
2answers
814 views

securities concerns about calling REST API from multiple servers

There is a master web application that needs to call REST APIs from servers of other applications. I can think of two ways to achieve it: a). call APIs on the front-end of the master application(...
3
votes
1answer
4k views

Run NetCat as bat file instead of exe

I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the ...
3
votes
1answer
721 views

Saving connection parameters in an RDP file

For connecting to a remote Windows Server 2008 I use a standard Windows 7 RDP remote desktop connection. In an RDP dialog there is an option to save connection parameters to an RDP file to use it ...
3
votes
1answer
111 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
3
votes
1answer
5k views

How secure is NAS server in LAN (wi-fi enabled)?

I've seen this question about NAS security over the Internet and I'm wondering how safe the thing is in LAN? I'm planning on replacing my old, desktop Windows-based PC with a NAS, I was thinking ...
3
votes
1answer
9k views

How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File

Walked into my office an hour into a Remote File Transfer initiated by an unknown user. I disabled it right away and looked through the files they transferred, which include a blank check with my ...
2
votes
5answers
871 views

Securing data transfer between public network and personal accounts

I would be traveling soon and I am looking for all kinds of ways to encrypt the data transfer (usernames, passwords, emails ...) between the new networks to which I will connect my Laptop, that is ...
2
votes
1answer
200 views

What are the loop holes in SSH tunneling?

I am working on React web app build on my local PC at port 443, and I want to make it accessible via internet for testing purposes. One solution that I came across was SSH remote port forwarding as ...
2
votes
4answers
217 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
2
votes
2answers
905 views

I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?

The VPS is running CentOS and I have full access. I only looked around using the cPanel installation and already disabled anonymous FTP access. What other security risks are there with a default VPS ...
2
votes
1answer
247 views

Encrypt files securely on remote server?

Let's suppose I have a rented VPS hosted somewhere in the world. Considering that I don't have physical access, I'm interested in some method that would allow me to encrypt data on the server without ...
2
votes
1answer
1k views

how to access freenet on a remote machine from android

The goal is to use freenet on non-rooted android devices. It is far out of my capabilities to actually port Freenet to android, but I am attempting to use and provide a functioning solution for ...
2
votes
2answers
479 views

How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits

In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from ...
2
votes
1answer
88 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
2
votes
1answer
1k views

Remote Administrative Access to a server, KVM over IP or HP iLo?

We have a situation. We want to grant remote administrative access to one of our servers for clients. As I know, there are two possible ways: 1- KVM-over-IP and 2-HP iLO. The most important thing for ...
1
vote
2answers
109 views

Potential dangers of re-locating critical systems to cloud

It was suggested by some consultants that We relocate some of our critical systems in our environment to cloud base architecture. Besides knowing the fact that on a cloud base architecture we have no ...
1
vote
2answers
237 views

Suspicious url in redis key value

When i put keys * for getting all pairs, one key have named as crackit Then i use below command to get its value get crackit its shows the below url, which looks suspicious. /usr/bin/curl -...
1
vote
4answers
432 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
1
vote
1answer
2k views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
1
vote
1answer
4k views

How to remote access a server behind firewall? [closed]

I have a server with defined IP address (it is for my own usage). I would like to use it from remote access. The server is behind a firewall. Is there a way to access it from remote computer? Is ...
1
vote
1answer
210 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
1
vote
1answer
76 views

Access from external network safely to raspberry

I am implementing a home alarm system with raspberry and I need to access it from the external network. The initial idea was to use cascade VPN and ssh (in my university to connect to the cluster I ...
1
vote
1answer
157 views

Remote server questions

I apologize for the lengthy questions and my lack of knowledge on this issue. I work from home using my own computer and connect to a remote server. I know my employer monitors my work when ...
1
vote
1answer
1k views

How secure is it to use ODBC Driver with SSL

When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server. It is ...
1
vote
1answer
6k views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
1
vote
1answer
8k views

Use Metasploit to exploit SMB through Conficker

I've got an SP0/unpatched Windows XP which is vulnerable to the Conficker worm. I'm using metasploit to use the Conficker exploit with the purpose of opening a remote shell/command line. My ...
1
vote
2answers
174 views

Renting a remote server with IPMI: is one vulnerable?

It has been reported in the media and some security conscious mailing lists that some IPMI-enabled servers, implementations and brands suffer serious security issues. When you go to a dedicated ...
1
vote
1answer
2k views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
0
votes
2answers
119 views

Remote administration methods

There is a requirement for users to remotely access one of my corporate servers from internet. Policy wise, i would want them to at least use 2FA for communication,eg VPN Tokens, password+SMS etc. ...
0
votes
1answer
93 views

What's recommended for performance & security : Server as PC or Server as HDD [closed]

we are trying to find a file server for us. we look for the best practices of the establishment of an efficient and secure server. Therefore, my question is: What is recommended: server as a PC or ...
0
votes
2answers
644 views

Setting up communication between internal database and hosted web server by third party

I am trying to figure out the best and most secure way to do this, if it is possible to do it safe and secure. Small company. We have a hosted web server from a third party that serves our client web ...