Skip to main content
51 votes
Accepted

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
Conor Mancone's user avatar
50 votes
Accepted

Does changing an uploaded executable's file extension to .png render it safe?

There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 ...
Draugr's user avatar
  • 670
47 votes
Accepted

What is the most secured SMTP authentication type?

With SSL/TLS it's okay to use LOGIN / PLAIN. You should provide SMTP on top of an SSL-encrypted connection. While some schemes from your list (e.g. DIGEST-MD5) can keep a password secure even over an ...
Arminius's user avatar
  • 45k
41 votes

Is having the name of web server software in HTTP response header a serious problem?

Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works. Why that? Because there'...
Guntram Blohm's user avatar
39 votes

Is allowing root login in SSH with "PermitRootLogin without-password" a secure method?

This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means ...
forest's user avatar
  • 67k
38 votes
Accepted

Should I be worried about unusual SSH login attempts from unknown IP addresses?

That's just "normal". Any exposed server on the Internet is going to be scanned by malicious (and benign) bots. What you are seeing is brute force attempts. They are usually not targeted; ...
Kate's user avatar
  • 8,435
34 votes

Why should the OPTIONS method not be allowed on an HTTP server?

An essential part of security is to reduce the attack surface by removing any functionality which is not needed. Usually this is also functionality which is less well tested and thus might be a vector ...
Steffen Ullrich's user avatar
31 votes
Accepted

PHP malware on server - but helpless in identifying the malicious code

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a bot that is trying to build a network of backlinks to a ...
Ivan's user avatar
  • 6,338
29 votes
Accepted

Downloading a file from a server with a secret: in text or binary?

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be ...
tim's user avatar
  • 29.7k
29 votes
Accepted

Are hacked email addresses a local network or web server problem?

Email addresses do not send spam. Email servers do. Anybody can forge your email address as the From address without hacking you at all. That's how you get spam all the time that says it comes from ...
Grant's user avatar
  • 1,056
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
Steffen Ullrich's user avatar
25 votes
Accepted

Is having the name of web server software in HTTP response header a serious problem?

Assuming that the server is fully patched and you're just talking about product name and not version, I wouldn't generally regard this as a serious problem. Essentially all security hardening is a ...
Rory McCune's user avatar
  • 62.5k
24 votes

What are the negative aspects of creating fake security footprints?

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are ...
Trey Blalock's user avatar
  • 14.2k
22 votes
Accepted

How to ensure identity for server-to-server communication over IP

Basically you are trying to re-invent certificate based authentication since you only have an IP address and not a domain. But certificate based authentication can be used without a domain too, for ...
Steffen Ullrich's user avatar
19 votes

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I ...
Jeroen's user avatar
  • 5,841
17 votes

Should I be worried about unusual SSH login attempts from unknown IP addresses?

How worried should I be about these attempts? Not particularly unless you are seeing specific usernames other than root which are actually found on your system. Are they likely part of a botnet ...
Austin Hemmelgarn's user avatar
15 votes

PHP malware on server - but helpless in identifying the malicious code

Well, ill give you some more detail: Note, this is not malware that is trying to break deeper on your system, is a script that makes someone (italian i guess) earn money using your server in 2 ways (...
jmingov's user avatar
  • 874
13 votes

Does changing an uploaded executable's file extension to .png render it safe?

No. Renaming a file doesn't increase security. He says to me, that by making all files images no harm can be done to the server. for example evilscript.evil would become evilscript.png When you ...
enkryptor's user avatar
  • 323
12 votes

Downloading a file from a server with a secret: in text or binary?

No, If the type of file is specified then there is no added security at all. For example, unzipping a file is so trivial that it doesn't add any security. If you ask whether it's more secure to ...
Gudradain's user avatar
  • 7,021
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
Kate's user avatar
  • 8,435
11 votes
Accepted

Hack my server, please?

You're looking for a penetration tester. You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
S.L. Barth is on codidact.com's user avatar
11 votes
Accepted

How to use YubiKey through GnuPG on remote server?

GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private ...
Jens Erat's user avatar
  • 24.6k
11 votes
Accepted

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

You wouldn't need the vulnerable website if you have an account on the shared hosting already. What you need is code execution on the host. A remote code execution vulnerability in one of the hosted ...
Anders's user avatar
  • 65.7k
11 votes

Is having the name of web server software in HTTP response header a serious problem?

On the long list of things you can do to protect a server on the internet, not exposing the name of the web server barely rates. The version number may be of more concern, since it may in theory help ...
thomasrutter's user avatar
  • 1,667
10 votes

Jump Servers for security

What is the advantage of using jump servers for security reasons? Jump servers, or more accurately, bastion hosts, provide a segregation layer between the target network and the user. Consider a ...
h4ckNinja's user avatar
  • 3,066
10 votes

Securing HTTP File Transfer over local network

For security, you need authentication. If Alice wants to sends a file to Bob's computer, Alice's app needs a way to verify that it's Bob's computer it's talking to, and not an attacker's computer. So ...
Sjoerd's user avatar
  • 31.8k
9 votes
Accepted

Does the auth server have to be separate from the resource server when using OAuth 2.0?

OAuth is like any other auth scheme with regard to its functional purpose. You send creds to it, and it returns user info (even if it's only success/fail messages). Usually a standards based auth ...
Neil Davis's user avatar
9 votes

How likely is it that I was hacked by running a local server for development?

have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network You accessing your services ...
ndrix's user avatar
  • 3,306
9 votes

Downloading a file from a server with a secret: in text or binary?

The file format is irrelevant to the security of the data transport. You can send plain text as well as arbitrary binary formats securely through an encrypted TLS tunnel. Without transport security, ...
Arminius's user avatar
  • 45k

Only top scored, non community-wiki answers of a minimum length are eligible