A server is a machine running a software daemon that is generally accessed over a network by other machines.

learn more… | top users | synonyms

1
vote
1answer
32 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
0
votes
0answers
17 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
2
votes
1answer
90 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
0
votes
0answers
16 views

Hamachi as a way to access home vCal / vCard server - security risk?

I have a home server providing a way to sync contacts and calendars between my machines. Until now, I was using it only with computers in my LAN, but recently I need to sync a computer that is on ...
0
votes
0answers
82 views

My website is getting this request all day long every minute xmlrpc.php

I am new to web building and I have word-fence blocking this as googling it tells me it's an attack on my server/website. My question is what are they hoping to achieve, it's not causing that much ...
3
votes
2answers
98 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
-4
votes
1answer
112 views

whats with Chinese and Russian proxy servers?

I keep hearing that if you commit some network activity via Chinese or Russian proxy servers you are very difficult to be tracked down. What is the reason for this other than lack of international ...
1
vote
0answers
22 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net(Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
0
votes
1answer
39 views

how to determine the cipher suites supported by a SERVER?

I somehow was not able to find an answer. I can see the ciphersuits supported by the client/browser on the wire, but server does NOT appear to advertise the ciphersuites it supports during the ...
2
votes
1answer
55 views

Is it a good practice to forbid ip access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, An Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...
-6
votes
1answer
76 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
0
votes
1answer
35 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
0
votes
2answers
59 views

How can website server recognize incoming Tor or VPN connection? [duplicate]

I was trying to signup for a service provided by a website using Tor, the website prevented me and asked me to disable my proxy settings, he noticed me with the following: Our checks indicate that ...
2
votes
1answer
80 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
2
votes
1answer
152 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
3
votes
3answers
234 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
29 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
7
votes
1answer
117 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
3
votes
1answer
103 views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g ...
1
vote
4answers
89 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
1
vote
1answer
69 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
5
votes
1answer
42 views

What are the recommended directory ownership & permissions for hosted websites?

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites. └── var └── www ├── website1 │   └── public_html └── website2 ...
5
votes
4answers
286 views

Why are common security measures on a webserver not enough on a large scale?

Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are ...
0
votes
1answer
49 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
1
vote
1answer
39 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
-1
votes
1answer
31 views

How can someone execute arbitrary code on Python's built in server module? [closed]

I'm not sure if this question could be consider inappropriate here. $ python -m http.server The source code tells: # https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21 SECURITY ...
1
vote
1answer
73 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
4
votes
1answer
73 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
0
votes
2answers
100 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
3
votes
1answer
53 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
1
vote
3answers
54 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
-1
votes
2answers
89 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
0
votes
0answers
30 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
1
vote
1answer
23 views

Usefulness of Server's Work Load given Timing Attack Resistance of Responses

I've read articles in the past discussing the importance of having timing attack resistant responses for information where knowing the time for evaluation would leak information about the data being ...
0
votes
0answers
33 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
0
votes
1answer
129 views

Encrypting the System Infrastructure

The requirements are to Encrypt the data in our servers 'at rest' and the 'database' - in short the whole infrastructure. Threat Model - to protect a possible data-breach by an adversary (or from ...
41
votes
8answers
5k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible ...
8
votes
1answer
83 views

Once established, are sockets on localhost secure?

Once a TCP socket has been established on localhost, and a connection made using accept, is it possible for a non-privileged user to intercept or modify bytes sent over this connection, or can this ...
5
votes
2answers
120 views

Don’t use a web browser on a server?

After pulling up a Windows Server 2012 instance, I learned that google.com is riskier than I thought: It does the same for microsoft.com. There are instructions to disable "Enhanced Security ...
0
votes
1answer
74 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
0
votes
1answer
70 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
1
vote
1answer
93 views

What Are Good Code Signing Environment Guidelines? [closed]

Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
-1
votes
1answer
132 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
4
votes
1answer
59 views

How do I protect the stored clients' public keys on a server?

I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to ...
3
votes
1answer
45 views

Prevent snapshots of VPS

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; ...
5
votes
1answer
118 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
1
vote
1answer
61 views

How to prevent a hacker from accessing other user's web dir

My website got hacked today :) The hacker accessed a website hosted by another user on the same server, then he got access to my /home/website-dir/ ! it's my server and I use it to host some websites ...
4
votes
1answer
119 views

Investigating a possible rogue DNS Server (maybe DNSChanger)

One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to ...
2
votes
1answer
119 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with ...
5
votes
2answers
98 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...