A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
0
votes
2answers
248 views

Would running different functions on virtual machines on the same server make me compliant with PCI DSS requirement 2.2.1?

I'm currently going through the PCI DSS requirements and wondered whether running different functions on virtual machines on the same server still make me compliant with the requirement below for PCI ...
2
votes
3answers
961 views

Is there any risk to having many “unused” ports open through firewalls and routers [duplicate]

I have a server I am using to host public internet services where I want to start and stop many instances, lets say up to 50 per physical server. The architecture of the software means each instance ...
2
votes
4answers
3k views

Is my browsing history on the server hidden when I use a VPN?

I am a client within a server in a school. My computer has a static IP address to enable me to connect to the internet. We have a server that records the browsing history of the computers that are ...
5
votes
2answers
689 views

Is SSH public key authentication sufficient for protecting a server if IP Whitelisting is disabled?

I'm currently working for a startup company who maintains a server on AWS. Currently, our server is set up so that in order to access it via SSH, you need to be on a white listed IP (set up in AWS) ...
1
vote
0answers
638 views

How secure is demonsaw? [closed]

So Demonsaw 4.0 "Titan" was released a few days ago, it claims that it is an encrypted communications platform that allows you to chat, message, and transfer files without fear of data collection ...
2
votes
2answers
624 views

Php Wso Shell and Simple Shell returns Blank Page - Why? [closed]

I just uploaded a simple shell as well as a WSO shell on a web server for running shell command. But the php file seems to open a blank page. Any Ideas why's this happening?
3
votes
2answers
115 views

Is it safe to log into a virtual private server not owned by me?

What are the dangers of using a virtual private server (VPS) that I do not own? Someone on a mail list offered to let me host my website on his Linux VPS for free, and gave me non-root ssh access ...
0
votes
2answers
1k views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
0
votes
1answer
60 views

How to set up a server for files? [closed]

I have a specialized software that I have created that can generate gigabytes worth of random data in seconds. I want to put all of these randomized, large files into a location to where it can be ...
4
votes
1answer
262 views

Server side code signing

I'm currently implementing a couple of security improvements to a crypto currency trading website that handles all data client-side and uses a static file approach. One of the things I've been asked ...
4
votes
1answer
2k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
2
votes
1answer
3k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
1
vote
1answer
508 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
-2
votes
1answer
60 views

Howto securely invoke a script on a remote server?

I have an application running on a dedicated (Ubuntu) server. There is also a desktop GUI which functions as dashboard for the application. I want to be able to start and stop the application from the ...
1
vote
2answers
155 views

Can storing a secret in the client be considered “good enough” security?

I have spent the better part of 2 weeks looking at a solution to secure my game. It's a game for Android/iOS that has its own server/database. So far, the only security I have is salt+hash passwords....
2
votes
2answers
1k views

Authenticate a user thru a UDP socket

so let's say I had a basic socket, doesn't give you any information about the user other than the IP address, what would be my options If I wanted to authenticate a user in the most optimal way ...
1
vote
6answers
2k views

Downloading a file from a server with a secret: in text or binary?

Suppose, a user can click a button on a website and downloads a file with a secret. Via ajax. Is it more secure if a server generates that file and sends it as 1) zip, tar or the like -- a binary ...
-2
votes
2answers
493 views

Can PowerShell be used to run scripts on a remote PC?

Can powershell be used to run scripts on remote PC’s like i am sitting in my house and i want to run scripts on a facebook server ,is that possible (if facebook server is using windows )? Question 2) ...
3
votes
1answer
136 views

Who is the Gate Keeper?

If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the ...
1
vote
3answers
8k views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
0
votes
2answers
28 views

Change Server IP used by Executeable [Client-Server Authentication]

for Authentication of my Executeable i use a TCP Server Module running on a VPS my Client(Executeable) connects to. Therefor i have to have the IP of the VPS inside the Executeable. I have two major ...
2
votes
2answers
2k views

How important is the usage of open_basedir on a server with multiple different PHP websites?

On an apache webserver with multiple VirtualHosts running different PHP websites on different domains, how important is it to set open_basedir for each VirtualHost? Will it actually help to isolate ...
5
votes
1answer
905 views

SSRF Attack Exploitation Scenario

In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability? ...
1
vote
1answer
125 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
1
vote
1answer
50 views

Will granting access to data without owner approval set a bad precedent?

I work for a small company that does contract work that involves storing customer data on our servers for the duration of a project. We recently adopted more strict folder security in which each team ...
8
votes
4answers
2k views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
1
vote
1answer
225 views

Running a local server inside a virtual machine disconnected from the Internet - is this secure?

This is a follow up to the question I asked yesterday. According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial ...
0
votes
1answer
114 views

server that responds on any port [closed]

I want to make a server that responds open to every port that is scanned by nmap (TCP and UDP). Are there a simple solution to do that?
2
votes
3answers
124 views

What to do about compromised passwords through malicious sites or site hacks [duplicate]

So my question or hypothesis is that: most people use only a few passwords for all online services, getting one of these passwords means you could access that person's sites easily which don't have ...
1
vote
1answer
1k views

Should UAC be turned on or off on servers?

So there a number of sources (e.g. this) that recommend leaving UAC (User Account Control) turned on on PCs, however there isn't much talk about UAC on servers. In fact the only thing I could find ...
2
votes
0answers
131 views

Developing hidden onion servers [closed]

I was wondering which language is best to build a .onion website (PHP, Python, ...). Which language is more secure and which frameworks are more secure? Is it a good idea to use CSS (Cascading Style ...
1
vote
0answers
149 views

Add time to mod_forensic log [closed]

as my website is getting hacked constantly I added mod_forensic to analyze the requests and possibly identify the vulernable wordpress part. However I do not have a timestamp in the log. As this is ...
1
vote
0answers
43 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
2
votes
2answers
408 views

Best guide/reference/roadmap for server penetration testing [closed]

I have been assigned to pen test some servers and have been provided the IPs of the same. In my past I have worked on application security testing projects and am aware of OWASP 10, SANS 25 etc. but ...
1
vote
3answers
917 views

Which protocol should I use for secure message transfers between two servers?

There are two servers. I am going to transfer very secret messages from the first one to the second. The second server (the one that receives data) doesn't have access to any other resources except ...
2
votes
1answer
624 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
1
vote
0answers
50 views

Hosting companies by AS Number [closed]

Is there any website out the like bgp.he.net (Hurricane Electric) or ipv4info.com that has a database with all VPS/Dedicated Server comapnies filtered by AS Number? I know that there are plenty of ...
0
votes
2answers
121 views

VPS outbound emails security

I have an instance of VPS running with logrotate that emails me logs every day. It is a send-only SMTP server with Postfix, set up using this guide. I just need to receive the logs from this server. ...
41
votes
9answers
7k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible (...
0
votes
1answer
716 views

How to tell when a masquerade attack is occurring?

As I understand it, a masquerade attack is when an attacker acts as a registered/ authenticated user or entity in a system. There are obviously ways to prevent this, for example user education, don'...
2
votes
3answers
137 views

Am I being attacked?

I saw this in the error log in the cPanel and I think someone is accessing my files. [Sat Oct 01 07:05:38.875312 2016] [:error] [pid 430322] [client 52.10.104.14:36382] File does not exist: /home/...
1
vote
1answer
666 views

When to sanitize ip address?

Common website save your ip address while your are connecting to display it on a security section view-able by the user or an admin. I thought servers like Apache, Nginx ... extracted the ip address ...
1
vote
1answer
149 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
1
vote
1answer
2k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
0
votes
3answers
1k views

Get IP of web server located at sub directory level

I usually use ping or tracert to get IP-addresses for domains or sub domains and it works really well. However I have stumbled upon a site that seems to use a reverse proxy or something similar ...
1
vote
1answer
93 views

Is it an security issue to have php change files?

I wrote some code which uses information from database to change content of various files and write something back to database afterwards. This code is completly written in php and gets executed when ...
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
5
votes
2answers
2k views

How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?

I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
0
votes
1answer
55 views

Server->Client distribution security

Apologies in advance if this is the wrong SE site for this topic, though it should be a fairly appropriate match. I am building a video game where one of the features available to users will be ...
0
votes
2answers
687 views

Setting up communication between internal database and hosted web server by third party

I am trying to figure out the best and most secure way to do this, if it is possible to do it safe and secure. Small company. We have a hosted web server from a third party that serves our client web ...