Hot answers tagged

77 votes

Is a server infrastructure fundamentally possible which the smartest person can't breach?

"No perfect defense is fundamentally possible." In chess, you have 64 squares, 2 people playing, and one set of immutable, commonly known rules. In server infrastructures, there are an untold ...
user avatar
  • 123k
73 votes
Accepted

Is physical security less important with disks on a server being encrypted?

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to ...
user avatar
  • 1,794
56 votes
Accepted

Could a VPS provider have access to the content of their users?

When you host your data on other people's servers, then these people have full access to it. With a virtualized server, the data is written to the hard drive of the host system. The server ...
user avatar
  • 48.8k
52 votes
Accepted

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
user avatar
50 votes
Accepted

Does changing an uploaded executable's file extension to .png render it safe?

There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 ...
user avatar
  • 670
47 votes
Accepted

What is the most secured SMTP authentication type?

With SSL/TLS it's okay to use LOGIN / PLAIN. You should provide SMTP on top of an SSL-encrypted connection. While some schemes from your list (e.g. DIGEST-MD5) can keep a password secure even over an ...
user avatar
  • 43.6k
37 votes
Accepted

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the ...
user avatar
  • 71.3k
34 votes

Why should the OPTIONS method not be allowed on an HTTP server?

An essential part of security is to reduce the attack surface by removing any functionality which is not needed. Usually this is also functionality which is less well tested and thus might be a vector ...
user avatar
33 votes

Is physical security less important with disks on a server being encrypted?

Physical access is total access. Kinda. Give me physical access to a server with an encrypted disk and the first thing I'd do is plug a key logger into the keyboard to take care of that pesky ...
user avatar
31 votes
Accepted

Is a server infrastructure fundamentally possible which the smartest person can't breach?

Security can be proven, but you have to understand what is proved https://sel4.systems/FAQ/proof.pml Our proof statement in high-level natural language is the following: The binary code of the seL4 ...
user avatar
  • 2,996
30 votes
Accepted

PHP malware on server - but helpless in identifying the malicious code

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a bot that is trying to build a network of backlinks to a ...
user avatar
  • 6,278
29 votes
Accepted

Downloading a file from a server with a secret: in text or binary?

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be ...
user avatar
  • 29k
29 votes
Accepted

Are hacked email addresses a local network or web server problem?

Email addresses do not send spam. Email servers do. Anybody can forge your email address as the From address without hacking you at all. That's how you get spam all the time that says it comes from ...
user avatar
  • 1,031
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
user avatar
26 votes

Is allowing root login in SSH with "PermitRootLogin without-password" a secure method?

This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means ...
user avatar
  • 64k
24 votes

What are the negative aspects of creating fake security footprints?

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are ...
user avatar
  • 14.1k
22 votes
Accepted

How to ensure identity for server-to-server communication over IP

Basically you are trying to re-invent certificate based authentication since you only have an IP address and not a domain. But certificate based authentication can be used without a domain too, for ...
user avatar
20 votes

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant ...
user avatar
19 votes

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I ...
user avatar
  • 5,773
17 votes

Is a server infrastructure fundamentally possible which the smartest person can't breach?

Nobody has found any particular reason to believe they have found such a system. You mention Chess, which is a nice game on a 8x8 grid. Consider that a modern server is slightly more complicated ...
user avatar
  • 9,206
14 votes

Possible to use both private key and password authentication for ssh login?

(cross posting SO answer with updated solution to these days) If you read through the manual page for sshd_config(5), there is option AuthenticationMethods, which takes the list of methods you need ...
user avatar
  • 5,129
14 votes

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

Most things of importance placed in a data center have a sister installation in a physically separate data center, and if there was a reason to "fail over" from the live to the backup site, it's ...
user avatar
  • 71.3k
14 votes

PHP malware on server - but helpless in identifying the malicious code

Well, ill give you some more detail: Note, this is not malware that is trying to break deeper on your system, is a script that makes someone (italian i guess) earn money using your server in 2 ways (...
user avatar
  • 844
12 votes

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

You could try Cryptographic Obfuscation when it exists Cryptographic Obfuscation is where, in certain senses, you make a programs source code unreadable. What you can then do is hardcode a ...
user avatar
  • 2,937
12 votes

Is physical security less important with disks on a server being encrypted?

Disk encryption can be defeated by replacing the machine with a malicious one that looks and behaves exactly the same but its only purpose being to fool the legitimate user into typing in the FDE ...
user avatar
  • 12.7k
12 votes

Does changing an uploaded executable's file extension to .png render it safe?

No. Renaming a file doesn't increase security. He says to me, that by making all files images no harm can be done to the server. for example evilscript.evil would become evilscript.png When you ...
user avatar
  • 313
12 votes

Downloading a file from a server with a secret: in text or binary?

No, If the type of file is specified then there is no added security at all. For example, unzipping a file is so trivial that it doesn't add any security. If you ask whether it's more secure to ...
user avatar
  • 6,881
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
user avatar
  • 6,462
11 votes
Accepted

Check logs for Heartbleed exploit use?

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked ...
user avatar
  • 5,898

Only top scored, non community-wiki answers of a minimum length are eligible