Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

1
vote
1answer
237 views

Is there a “no-spy, no-backdoors standard” for telecom hardware manufacturing?

The BBC News article Huawei says willing to sign 'no-spy' agreements reports the following: Huawei has also said it is independent from the Chinese government, but some countries have blocked it ...
0
votes
0answers
44 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
0
votes
2answers
66 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
99 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
1
vote
4answers
267 views

What are the benefits of using IP whitelists to secure cloud servers/resources?

Consider the following scenario: There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only ...
0
votes
1answer
44 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
-1
votes
1answer
40 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
2
votes
1answer
90 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
2
votes
0answers
57 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
2answers
69 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
-1
votes
2answers
102 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
5
votes
1answer
72 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
0
votes
0answers
41 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
-3
votes
2answers
121 views

Is pure client-side security better or worse (from a security point of view) than pure server-side security in client-server software?

I'd like to know in general which of the two types of security is the best in all aspects that may refer to security (we can use this the general aspects for security: integrity, availability, ...
0
votes
0answers
17 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
1
vote
1answer
75 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
1answer
39 views

What are the different security concerns associated with open ports on mobile vs open ports on servers?

I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case. Do ...
0
votes
1answer
65 views

How do I ensure a local Minecraft server (with admin wrapper) is inaccessible to the outside?

I'm running a Minecraft server on my local network for myself and my roommates. I would like to simplify some of the admin tasks by using an admin wrapper. Unlike most of the questions, tutorials, ...
2
votes
2answers
165 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
0
votes
1answer
28 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
2
votes
2answers
242 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
3
votes
2answers
113 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
2answers
114 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
4
votes
2answers
286 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
2answers
103 views

Why should I bother having a firewall on servers?

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware. The only ports that are open ...
0
votes
1answer
132 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
0
votes
1answer
75 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
0answers
45 views

Real time chat - is it possible to see messages from it again

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...
1
vote
1answer
52 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
43 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
1answer
73 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
0
votes
1answer
51 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
2
votes
1answer
329 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
2answers
231 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
1
vote
0answers
37 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
1answer
28 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
0
votes
1answer
83 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
1
vote
1answer
164 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
2
votes
4answers
114 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
0
votes
1answer
47 views

samba server exposed to wan

I recently realized that my samba server was exposed for about 3 years to the wan (ports opened and smbd was listening). I made a mistake when I configured my firewall and failed to check it. This ...
1
vote
1answer
172 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
-1
votes
2answers
199 views

Testing RCE and SSRF using Python SimpleHTTPServer [closed]

Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
0
votes
3answers
864 views

Is SQL injection still a thing? [duplicate]

I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
3
votes
2answers
51 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
2answers
145 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
-1
votes
2answers
626 views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
1
vote
3answers
730 views

How to detect a DoS attack if today all use network address translation?

If a basic DoS attack can be handled by limiting the number of connections that occur in a interval of time with one IP and some enterprises and institutions use network address translation with many ...
1
vote
2answers
400 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
3
votes
0answers
137 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
0
votes
1answer
232 views

over 100 scanner requests 5 min after domain registration

First off, I am no security expert! Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...