The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
0
votes
1answer
744 views

Security concerns of RADIUS based server/workstation auth

So I'm using WPA2-EAP for a few years now with FreeRadius server. And it's pretty okay, I mean I don't really consider wifi access to be so super-duper critical break in success because it's pretty ...
1
vote
0answers
68 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
1
vote
1answer
3k views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
2
votes
2answers
312 views

do SRV records make a system more vulnerable or expose too much

We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
2
votes
2answers
70 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
1
vote
1answer
120 views

Best way to secure local REST server?

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it ...
1
vote
1answer
293 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
3
votes
2answers
383 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
4
votes
2answers
1k views

Is VM per service a reasonable server security model?

Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an ...
2
votes
1answer
373 views

Is a TPM module insecure if not soldered to the board?

I am looking into Bitlocker for my headless Microserver N54l with windows server 2016 on it. I saw that the n54l has no TPM module, but I can buy one and plug it to the board. I am interested in it ...
-1
votes
1answer
74 views

How to communicate securely over a monitored network [duplicate]

Let's say we have Alice and Bob in a chatroom, trying to communicate. They're connected to the same network, but we have the network admin constantly monitoring all data being sent to servers (and ...
1
vote
0answers
696 views

LOTs of filtered ports on my server

I'm setting up a dedicated server (4 days uptime, not in production yet). I'm a coder, not a sysadmin or a security expert so bear with me. I just tried to portscan it with nmap -p- -T5 -Pn -sV -v to ...
0
votes
1answer
273 views

How dangerous is it to allow local connections to remote selenium servers?

There are services like BrowserStack or Sauce Labs that help with testing and test automation on different browsers and devices. But, in order to solve the problem of an application under test being ...
1
vote
0answers
238 views

Is it dangerous to give remote VNC access to a Server?

I have a Server powered by macOS Server on macOS Sierra. It serves as a file (AFP & SMB) server, VPN Server, and Web Server. It already has SSH enabled. I was wondering if it is safe to enable VNC ...
0
votes
1answer
129 views

How to prevent my site from being hacked by learning from server log?

My site had been hacked today and I was also able to find the injection point in my site. I'm working on how to prevent this in future. This is my server log: 8.37.230.5 - - "POST /admin/images/...
0
votes
3answers
292 views

How to restrict file access on a local Windows Server?

I just started a new software development company, We are using Windows Server, with Wamp installed on the machine. The machine is connected to a router and we have 10 employees. But only 5 of them ...
2
votes
3answers
223 views

Am I exposing myself to attacks when running my test server while connected to a commercial VPN?

I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming ...
1
vote
1answer
160 views

Is it possible for an attacker to log my keystrokes on a linux server which has no X window system?

assuming the following: publicly reachable webserver - administered via SSH no X window system installed and no X11 forwarding through SSH attacker has gained access and is able to run a shell as my ...
1
vote
2answers
132 views

Should web application for methods PUT and DELETE return the same response as for GET

My web application for methods PUT, DELETE and any junk HTTP method return the same response as for GET method (html main page, nothing is uploaded or deleted), for TRACE there is response 405. Is ...
4
votes
1answer
169 views

GPG key handling with Server

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel ...
2
votes
1answer
204 views

How to make my basic Java Server secure against hackers? [closed]

I have a basic Java Server program on my iMac written entirely in Java, which works for a Java client drawing program. The program basically enables a user to draw something on the JPanel with the ...
0
votes
2answers
621 views

How to secure a fresh Ubuntu 16.04 install [closed]

I have a service that's spinning up fresh Ubuntu 16.04 instances onto a VPS (on behalf of users) and would really like to do what I can in terms of putting good privacy and security practices in by ...
10
votes
2answers
3k views

Are hacked email addresses a local network or web server problem? [closed]

I work at a small nonprofit and woke up to find that many of our email addresses have been sending spam asking recipients to open an attachment (doc file). We have a local network that all of our ...
0
votes
1answer
4k views

CVE-2017-7529 - Exploit details? [closed]

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7529 Where can I find the exploit details for this CVE? Usually sites like exploit-db.com include the PoC exploit for a given vuln but I can't ...
1
vote
1answer
2k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
0
votes
1answer
507 views

Client Server TCP connection - sending a password

I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and ...
0
votes
2answers
129 views

How to make sure my web application is secured? [closed]

My backend is hosted on AWS-EC2 running ruby on rails. My frontend is hosted on aws-s3 using angular-js. My DB is MongoDB. All APIs have an authentication token for user security. Every server is ...
1
vote
1answer
62 views

Secure dev server with remote staff

What are the best practices to secure a development server where the staff is remote? On that server, it will run apache2 webserver and mysql. Server O/S is Debian 9. My idea is that: Only SSH ...
1
vote
1answer
492 views

Whitelist Application For Windows Server 2012

My problem I am looking for an application which runs on Windows Server 2012 for security reasons. Our server began attacked on many protocols. They are trying brute force attacks with very weak ...
6
votes
2answers
2k views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
0
votes
2answers
667 views

Is it safe and secured to use Mono-Project for Ubuntu to run a ASP.NET with a MySQL database?

I am looking to rent a VPS server to host a game server, MySQL database and an ASP.NET site on it. A Windows server is too expensive for me but Mono-Project for Ubuntu does everything that I need it ...
3
votes
1answer
936 views

Server closed connection error on several browsers when testing SSL

I have uploaded a SSL Certificate to my site www.walksindorset.co.uk. When I test the SSL rating I receive the error message "Server closed connection" on over 15 browsers which includes Andriod 4.0....
4
votes
2answers
14k views

OpenSSL Basic Constraints

I have been working through the book 'Planning for PKI' and I have gotten to the point where I want to create an end-entity certificate. However, I am faced with an error message saying that there are ...
0
votes
2answers
231 views

Would running different functions on virtual machines on the same server make me compliant with PCI DSS requirement 2.2.1?

I'm currently going through the PCI DSS requirements and wondered whether running different functions on virtual machines on the same server still make me compliant with the requirement below for PCI ...
2
votes
3answers
869 views

Is there any risk to having many “unused” ports open through firewalls and routers [duplicate]

I have a server I am using to host public internet services where I want to start and stop many instances, lets say up to 50 per physical server. The architecture of the software means each instance ...
2
votes
4answers
3k views

Is my browsing history on the server hidden when I use a VPN?

I am a client within a server in a school. My computer has a static IP address to enable me to connect to the internet. We have a server that records the browsing history of the computers that are ...
5
votes
2answers
634 views

Is SSH public key authentication sufficient for protecting a server if IP Whitelisting is disabled?

I'm currently working for a startup company who maintains a server on AWS. Currently, our server is set up so that in order to access it via SSH, you need to be on a white listed IP (set up in AWS) ...
1
vote
0answers
611 views

How secure is demonsaw? [closed]

So Demonsaw 4.0 "Titan" was released a few days ago, it claims that it is an encrypted communications platform that allows you to chat, message, and transfer files without fear of data collection ...
2
votes
2answers
567 views

Php Wso Shell and Simple Shell returns Blank Page - Why? [closed]

I just uploaded a simple shell as well as a WSO shell on a web server for running shell command. But the php file seems to open a blank page. Any Ideas why's this happening?
3
votes
2answers
112 views

Is it safe to log into a virtual private server not owned by me?

What are the dangers of using a virtual private server (VPS) that I do not own? Someone on a mail list offered to let me host my website on his Linux VPS for free, and gave me non-root ssh access ...
0
votes
2answers
1k views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
0
votes
1answer
60 views

How to set up a server for files? [closed]

I have a specialized software that I have created that can generate gigabytes worth of random data in seconds. I want to put all of these randomized, large files into a location to where it can be ...
4
votes
1answer
262 views

Server side code signing

I'm currently implementing a couple of security improvements to a crypto currency trading website that handles all data client-side and uses a static file approach. One of the things I've been asked ...
4
votes
1answer
2k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
2
votes
1answer
3k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
1
vote
1answer
473 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
-2
votes
1answer
55 views

Howto securely invoke a script on a remote server?

I have an application running on a dedicated (Ubuntu) server. There is also a desktop GUI which functions as dashboard for the application. I want to be able to start and stop the application from the ...
1
vote
2answers
151 views

Can storing a secret in the client be considered “good enough” security?

I have spent the better part of 2 weeks looking at a solution to secure my game. It's a game for Android/iOS that has its own server/database. So far, the only security I have is salt+hash passwords....
2
votes
2answers
1k views

Authenticate a user thru a UDP socket

so let's say I had a basic socket, doesn't give you any information about the user other than the IP address, what would be my options If I wanted to authenticate a user in the most optimal way ...
1
vote
6answers
2k views

Downloading a file from a server with a secret: in text or binary?

Suppose, a user can click a button on a website and downloads a file with a secret. Via ajax. Is it more secure if a server generates that file and sends it as 1) zip, tar or the like -- a binary ...