A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
1
vote
0answers
123 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
6
votes
2answers
443 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
17
votes
3answers
9k views

What is the most secured SMTP authentication type?

Say you have to choose only one among the following authentication types for your own SMTP server: LOGIN, PLAIN CRAM-MD5 DIGEST-MD5 NTLM/SPA/MSN Which one would you recommend for optimal security? ...
2
votes
2answers
60 views

Insider's threat to a hosted server

If we buy a VPS, the admin of the enclosing server can always steal our data, right? Is using a dedicated server a solution? (We can't afford our own datacenter in any case.) But it seems that ...
-1
votes
3answers
197 views

How do Destination Servers Keep Track of my Public IP address? [closed]

Upon doing a simple what is my IP search, I began to wonder. How does the final server keep track of my IP address and how is the request made? A simple tracert command in Command Prompt and I can ...
0
votes
1answer
155 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
1
vote
1answer
1k views

Prevent CryptoLocker on Server

Are there any ways to prevent files associated with CryptoLocker, to be propagated to a data server, by means of a back up? We use Cobian as our backup system, and it backs up the user's directory to ...
2
votes
1answer
90 views

Would client side hashing provide security from a comprised server [duplicate]

I've been reading about hashing and encryption so I can make more informed decisions. I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, ...
0
votes
1answer
27 views

Split Production and “public” Webspaces

We're developing a Software, using Git and some web based organsiation software on one of our members webspace. This webspace is as far isolated, thus none could access it without knowing the address. ...
-3
votes
2answers
961 views

Why is it a bad idea to allow all inbound / outbound traffic?

I have an AWS server. I didn't want to spend too much time configuring the Security Group and allowed all inbound and all outbound traffic. Is this OK or is it a bad idea?
0
votes
2answers
106 views

Will webshells forever be a challenge for organizations?

The only ways of detecting webshells today are either by using FIM technologies, which are a problem if you start deploying them on "dirty" systems. You literally have to deploy them on clean systems ...
0
votes
1answer
1k views

SSL Certificate pinning with Self Signed Certificates

I am trying to understand how Certificate Pinning works with Self Signed Certificates. My idea is that a Server with a Self Signed certificate will accept the connections only from the clients that ...
2
votes
1answer
145 views

What IP address will show up in the Log

I have a conundrum going on in my head for sometime now. It involves IP addresses, VPN and VPS. The scenario is this: I have two Virtual Private Servers (VPS), let's call them VPS 1 and VPS X. ...
2
votes
2answers
757 views

When to use Session key or Premaster Key

I feel like I am getting a little bit confused about how the first half of TLS works. From my understanding, it's like this: Client sends request to Server (with cipher suite preferences) Server ...
3
votes
2answers
99 views

Security concerns with external MySQL access using tunnelling

I have gotten my personal vServer with a standard installation of Ubuntu Server 16.04 and I wanted to install and configure a MySQL server on it. I was considering to disable direct external access, ...
-1
votes
1answer
284 views

Which protocols are the most secure to achieve authentication and encryption for a client downloading data from a sever?

I'm new to Information Security so please bear with me if this question is quite trivial. I want to design a secure protocol that allows someone to download a piece of data that belongs to them from ...
0
votes
1answer
860 views

Should I sandbox web application?

Let's say that I'm building a web application that I will host on my server. Should I sandbox it in order to protect my server? Note I just learned that there might be more to sandboxing your web ...
-3
votes
1answer
651 views

Getting someones IP Address through server [closed]

How can I get a list of the connected IPs of a gaming server? I am trying to code a patch that can mask the IPs, but how can I even find them in the first place?
0
votes
1answer
1k views

Bypassing closed or filtered ports

I recently setup a basic Ubuntu Server at my home and while at school can't access it because the SSH port (22) has been closed. This lead me open up different ports on my server for SSH so that I ...
1
vote
1answer
87 views

Risk in FTP connect

excuse me the question perhaps beginner, but came out a doubt. One person asked me to edit your site, but it was very strange story and did not know this person yet ... When I connect me by filezilla, ...
1
vote
0answers
1k views

Performing denial of service attack using Python [closed]

I am a student so please don't be rude for I miss something and this project is for research purpose only. I am willing to perform a denial of service attack(on my own servers) I am not willing to do ...
47
votes
13answers
42k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
0
votes
1answer
364 views

Which is potentially more secure, an encrypted secondary drive or local NAS box?

I have both and I wonder where I should keep my data. On one hand my encrypted drive is unlocked most of the time when I'm logged in so it's just as susceptible to a virus or a malicious application ...
2
votes
3answers
2k views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
4
votes
1answer
215 views

What should I exchange with the server when I generate my AES 256 key?

I'm creating a mobile fast-paced game and currenly I'm working on login/registration/connecting. I'm trying to make it right so it won't mess in the future. For now, I have read multiple articles of ...
1
vote
2answers
1k views

Port-Forwarding insecure? [closed]

I was going to do port-forwarding to create a gaming server with an old PC. I the found out that it makes more things visible to the internet. Is port-forwarding a bad choice considering its ...
2
votes
1answer
4k views

How many bcrypt rounds are necessary?

I'm making an app and am using bcrypt to encrypt passwords. I've no prior knowledge about bcrypt and still don't know much, I know it supposed to be a secure cpu-intensive encryption. After ...
1
vote
3answers
647 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
28
votes
2answers
42k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
2
votes
1answer
100 views

Is it a good practice to forbid IP access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. When you access by IP, an Nginx forbidden page shows up (with there OS version). My question is does it affect any side of ...
16
votes
2answers
10k views

Why should the OPTIONS method not be allowed on an HTTP server?

Why should the OPTIONS method not be allowed on an HTTP server?
1
vote
1answer
41 views

Do i still need IP restriction on my server if I am using key based auth?

I currently have ip restrictions set such that I can only SSH into my server from either the office or my home. I expect to travel around to various sites over the next few months and thus need to ...
0
votes
2answers
957 views

Many Websites, one server, which port to use?

I've recently been doing some research on pentesting websites through metasploit. Now I've run into a problem that I'm sure is pretty common but I cant seem to find anything else about it on ...
19
votes
3answers
4k views

PHP malware on server - but helpless in identifying the malicious code

I am new to this community, so please forgive me if my question is stupid. I discovered that my server got hacked, and found several PHP files on it. I haven't been lazy and tried my best to ...
0
votes
3answers
399 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
1
vote
1answer
442 views

Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?

I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap. PORT STATE SERVICE 21/tcp open ftp |_ftp-anon: ...
1
vote
3answers
1k views

SSL for private network

I have a private network, a VPS, an Apache web server and several web pages. Most documentation about SSL configuration state that I should buy a certificate, and should give the website adress. ...
3
votes
3answers
8k views

I want to host a server from my home computer; safe?

I am planning to make public a website I have been working on; it seems to me that (in my very limited experience) the only way I can do this without needing to pay any extra money to external hosts ...
-1
votes
1answer
144 views

Isn't creating my own proxy server useless

If I am correct, proxies access the server you want to connect to for you, therefore hiding your IP address (most of the time). If I want to escape from my ISP spying on me, wouldn't hosting my own ...
1
vote
0answers
674 views

Simple Reverse-Shell-Script in java? [closed]

i have a simple script (written in C) and it connects back to a netcat server to open a shell, there, so a really simple reverse shell script. How to do the same in java? #include <stdlib.h> #...
-3
votes
1answer
460 views

Hack my server, please? [closed]

I'm not quite sure this is the place for such questions, but stackoverflow or superuser seem even less appropriate, so. I want to ask if there is some kind of a site or service, similar to the ...
4
votes
3answers
689 views

Server client verification

When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ? This is to prevent the access to the server ...
-2
votes
1answer
140 views

Can a dedicated server provider access my data without knowing root password?

Is it possible for a service provider to access my data without knowing the root password? Is there a way to change the root password without ejecting the disk somehow? Update: I'm wondering whether ...
12
votes
4answers
8k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
2
votes
1answer
870 views

How did someone find my Windows username?

I recently (and stupidly) created a Windows SBS 2011 user whose password was the username. Multiple unauthorized people across the Internet used RDP to log in as that user. How did they find the ...
3
votes
2answers
1k views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
0
votes
1answer
279 views

Metasploitable: Change/Location of login page file?

I have been messing around with Metasploitable 2 and changed the default login credentials. The login page looks like this: I want to change where it says "Login with msfadmin/msfadmin to get ...
0
votes
1answer
55 views

Which is better: detecting spam at receiver or source?

Background I researched a detection of spam sent out using bots. After studying different techniques used by bots to deliver spam, I have no generalised solution to detect spamming at the source ...
3
votes
2answers
13k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
4
votes
1answer
1k views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...