New answers tagged

1

No it is not, as others have responded. Depending on what you want to achieve, you could consider a static website, or a Single Page Application. If you need to expose them to the world, you can host these for free, as a learning experience, on some platforms such as Netifly or GitHub or GitLab Pages (there are many more, I am not affiliated with any of ...


2

A single firewall is not enough because you need to have multiple defensive layers security to harden the whole solution or system from different types of attacks in the OSI layers. My suggestion is the following setup. The server should behind IP firewall with NAT applied and Web application Firewall. Remove all the unnecessary services on the servers....


9

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a strong password. A typical server on the Internet is probed, attacked hundreds, thousands of times a day. I know, from all the alerts I receive in a single day and ...


-2

House Keeping: Firewall Bullproof- PHP-MysqlCode Close all unused ports Your Apache and PHP bins should have write/read/execute permissions, to the right folders google:'secure apache server' google:'linux secure networking'; // commands google:'linux exploits' and everything related to linux root scanner. It's actually an inception of Linux and frontend ...


3

Ingress: Your website will be open to the world on tcp ports 80 and 443. You may also need to open up some other ports to allow you to manage the website (tcp port 22 for ssh for example, although you can limit the source to your management station). That means your webserver will be open to application level attacks on those ports. So test those ports ...


14

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any experience with this. This kind of setup is typical for easy too exploit sites: database-backed often allows SQL injection, insecure uploads might allow code ...


6

The biggest risk is probably a 0-day or simply an unpatched vulnerability in the server software of CS:GO. Against a 0-day you are rather helpless. You can give the user running the CS:GO process as little permissions as possible. If your server gets compromised, the attacker can only act with the permission of this user, as long as he doesn't exploit a ...


1

A ESTABLISHED connection on port 22 only means a TCP connection was made, not that a SSH session is active. If you telnet from your office computer to your server on port 22, and not type anything, you will see the Connection Established on netstat. And now that you masked your office and attacker IP's but not your own, expect more people connecting to it. ...


3

Anybody can establish a connection to the SSH server which means that this information does not say anything about a successful login. Restricting access to key based authentication only is a wise choice and will prevent the typical password brute force attacks. It will not prevent a simple connect to the SSH server though, but at this stage no real harm is ...


1

The HSTS header should be returned for every URI for it to be considered effective. This is because while the header is host wide (optionally including sub-domains), there's nothing to stop a user accessing a resource first which does not return a HSTS header (in your example /contact/nurses), and therefore being allowed to communicate with that URI ...


1

All HTTP(S) headers are just data that the server sends over the wire. It's literally just plain text, usually ASCII/UTF-8. The server can send whatever headers (or body) it is configured for in response to whatever request it receives. Although it is common to configure a server to send certain headers with every response, doing so is neither the only ...


1

There are many many ways to do login mechanisms, and it's a pretty complex topic. This is too broad a question for me to give you a full answer, so just some pointers. Mandatory "don't roll your own" warning: If you are building this app for your own learning, then carry on good sir! But if you are building this for a real website, then please find a web ...


1

What you want to achieve is authenticated machine-to-machine communication between the Lambda function and the websocket server. There are different mechanisms to achieve that. Using a JWT token is one possibility, but there are even easier approaches, if you want to keep it as simple as possible. Based on your question, you want your authentication based ...


Top 50 recent answers are included