Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
0
votes
2answers
455 views

TLS 1.3 server_handshake_traffic_secret calculation

I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3. In section 4.3.1 (Encrypted Extensions) it says In all handshakes, the server MUST send the EncryptedExtensions ...
0
votes
0answers
15 views

Security bug in wildfly-security-manager

I have a question to this Common Vulnerabilities and Exposures about wildfly-security-manager: CVE-2019-14843 Does this security flaw imply an attacker could break into the wildfly server, or does it ...
0
votes
1answer
49 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log?
0
votes
0answers
76 views

Port scanning - Idle scan 2.0?

I have some server applications and from time to time I'm being victim of some attacks which might be of interest and I'm going to describe in the following. The most recent attack originated from ...
19
votes
5answers
8k views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
2
votes
1answer
560 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
2answers
133 views

How do I ensure a local Minecraft server (with admin wrapper) is inaccessible to the outside?

I'm running a Minecraft server on my local network for myself and my roommates. I would like to simplify some of the admin tasks by using an admin wrapper. Unlike most of the questions, tutorials, ...
2
votes
2answers
239 views

How to log passwords tried for login?

I was just watching Michal Hrušecký's presentation about their open source routers. In the presentation he showed their "Honeypot as a Service" offering and how it allows you to see the passwords that ...
1
vote
1answer
139 views

Does Google Chrome store browsing history on their servers?

Does Google Chrome store browsing history on their servers? I think, if for example I use private browsing, Chrome can still log my activity.
1
vote
0answers
52 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
1
vote
1answer
176 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
1answer
266 views

over 100 scanner requests 5 min after domain registration

First off, I am no security expert! Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...
1
vote
1answer
253 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
0
votes
0answers
38 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
4
votes
1answer
134 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
1
vote
1answer
121 views

How to send authentication token via SMS for a REST API

I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need ...
4
votes
1answer
230 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
4
votes
0answers
87 views

Should I create a JWT on one server, and verify it on a different server?

So lets say I have 2 microservices: 1). A serverless / lambda function, triggered by some hardware event 2). A websocket server, to handle some data I want to ensure that only authenticated ...
9
votes
5answers
7k views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
1
vote
1answer
120 views

Are there any security risks associated with having static files on the server be publicly available?

I am going to frame this question using ASP.NET Core in mind since that is what I'm using, though my question is applicable to any scenario in which you have a client that makes requests to a server ...
0
votes
1answer
138 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
1
vote
1answer
270 views

Is there a “no-spy, no-backdoors standard” for telecom hardware manufacturing?

The BBC News article Huawei says willing to sign 'no-spy' agreements reports the following: Huawei has also said it is independent from the Chinese government, but some countries have blocked it ...
0
votes
0answers
50 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
1
vote
4answers
442 views

What are the benefits of using IP whitelists to secure cloud servers/resources?

Consider the following scenario: There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only ...
0
votes
2answers
70 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
76 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
-1
votes
1answer
57 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
3
votes
1answer
124 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
2
votes
0answers
59 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
2answers
158 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
-1
votes
2answers
104 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
5
votes
1answer
97 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
0
votes
0answers
45 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
-3
votes
2answers
127 views

Is pure client-side security better or worse (from a security point of view) than pure server-side security in client-server software?

I'd like to know in general which of the two types of security is the best in all aspects that may refer to security (we can use this the general aspects for security: integrity, availability, ...
0
votes
0answers
18 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
2
votes
3answers
5k views

Is allowing root login in SSH with “PermitRootLogin without-password” a secure method?

I have set my live IP in /etc/hosts.allow, and deny all other hosts. I have also set PermitRootLogin without-password in /etc/ssh/sshd_config. Is that a secure method? Can an attacker crack my key ...
0
votes
2answers
129 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
0
votes
1answer
41 views

What are the different security concerns associated with open ports on mobile vs open ports on servers?

I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case. Do ...
3
votes
2answers
284 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
2
votes
2answers
175 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
0
votes
1answer
57 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
2
votes
2answers
251 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
4
votes
2answers
393 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
2answers
112 views

Why should I bother having a firewall on servers?

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware. The only ports that are open ...
1
vote
1answer
374 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
0
votes
1answer
130 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
4
votes
2answers
3k views

OpenVAS won't generate SCAP Database

To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...
0
votes
0answers
46 views

Real time chat - is it possible to see messages from it again

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...
2
votes
2answers
178 views

How does Amazon prevent mischief in their AWS Lambda service if I am allowed to execute code on their machine?

AWS Lambda lets me execute a piece of code on a random Linux machine it provides to me, whenever I need to run my code. What is stopping me from executing OS level commands that let me take over the ...
1
vote
1answer
84 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...