Skip to main content
Share Your Experience: Take the 2024 Developer Survey
119 votes

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

Yes, you should absolutely reject the CSR. Additionally, you should change your hosting provider as it looks like they don't know what they are doing. It is already bad enough that they sent you the ...
dr_'s user avatar
  • 5,208
88 votes

Brutalized VPS recovery data now available. Considerations?

I'll start with what to do with your current system: Get in and make a backup of everything. Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law ...
David's user avatar
  • 16.1k
82 votes

Should log files be kept secret?

There are clearly 2 different lines of defense here. First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs. But the more an attacker ...
Serge Ballesta's user avatar
77 votes
Accepted

Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

You've removed a lot of problems that normally get you in trouble (namely, assuming that the app you're hosting is completely secure). From a practical perspective, you absolutely have to consider ...
Xiong Chiamiov's user avatar
61 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
Marcus Müller's user avatar
59 votes
Accepted

What exploit are these user agents trying to use?

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
Dan Landberg's user avatar
  • 3,322
55 votes
Accepted

Why do some web servers still provide information on vendor and version in the HTTP response headers

Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit. Even if you don't advertise it, it can be figured out from the behaviour of ...
Mike Ounsworth's user avatar
52 votes
Accepted

Any reason NOT to set all cookies to use httponly and secure

Yes, there are cases where you don't want HTTP ONLY or SECURE. If you need javascript to see the cookie value, then you remove the HTTP-Only flag. A couple cases - some sites track the page state in a ...
Jonathan's user avatar
  • 2,346
51 votes
Accepted

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
Conor Mancone's user avatar
50 votes
Accepted

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

If I were in your place I would refuse to accept this SSL certificate. The reason for that is, if someone broke into either of the emails that received the private key, they would be able to download ...
vakus's user avatar
  • 3,833
48 votes
Accepted

Does a log entry with "SPT=81" despite nothing listening on that port indicate my server is hacked?

... SRC=my.server.public.ip DST=109.89.132.126 ... ... PROTO=TCP SPT=81 DPT=587 ... RST ... This is a RST. It will be generated by your server if a remote system (in this case 109.89.132.126) tries ...
Steffen Ullrich's user avatar
47 votes

What website accepts only TLS 1.2 so I can verify client capability?

The website: https://badssl.com/ supports various versions of TLS using different subdomains, so you can test lots of variations there! This subdomain and port only supports TLSv1.2 https://tls-v1-2....
Brad Parks's user avatar
42 votes
Accepted

Is it practical to pre-blacklist certain GeoIP regions?

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in ...
Matthew's user avatar
  • 27.3k
38 votes
Accepted

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Yes - the Heartbleed bug involved memory leaks out of the HTTP server such that: We attacked ourselves ...
gowenfawr's user avatar
  • 72.9k
38 votes
Accepted

What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?

One thing Firefox Focus uses this embedded web server for is to detect whether Safari Content Blocking rules were successfully enabled. It seems from this answer and the Focus source code that iOS 10 ...
Ben Regenspan's user avatar
36 votes

Server attack with \x01

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator ...
Polynomial's user avatar
  • 135k
33 votes

What security risks are there in allowing someone to upload PHP scripts?

It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
hmrojas.p's user avatar
  • 1,059
29 votes
Accepted

Downloading a file from a server with a secret: in text or binary?

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be ...
tim's user avatar
  • 29.6k
29 votes

Should log files be kept secret?

Access to raw log data should be restricted to authorized users. The simple reason for that is that even when under normal operating conditions your applications may should not log any data too ...
HBruijn's user avatar
  • 1,345
28 votes

Giving malicious crawlers and scripts a hard time

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
Dmitry Grigoryev's user avatar
28 votes

What security risks are there in allowing someone to upload PHP scripts?

If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
Jacco's user avatar
  • 7,702
28 votes

Why do some web servers still provide information on vendor and version in the HTTP response headers

Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database ...
allo's user avatar
  • 3,361
27 votes

Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

No. This is not enough to keep you secure. It'll probably keep you secure some time but security is complex and quick paced so your approach really isn't good enough for long-term security. If ...
Oli's user avatar
  • 1,141
25 votes

What security risks are there in allowing someone to upload PHP scripts?

To me it sounds like you are about to shoot yourself in the foot. Letting people you don't trust upload and run PHP on your server is extremely dangerous. Here are some things an attacker could try: ...
Anders's user avatar
  • 65.6k
24 votes

Any reason NOT to set all cookies to use httponly and secure

Regarding httponly you are essentially asking if they are use cases where a cookie needs to be read or set by Javascript. Typically some settings of the user interface (choice of language ...) are ...
Steffen Ullrich's user avatar
22 votes

Is using Git for deploying a bad practice?

I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI. The methods people are advocating here are fine for small projects, but generally speaking, ...
siliconrockstar's user avatar
22 votes

What exploit are these user agents trying to use?

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
DarkMatter's user avatar
  • 2,691
22 votes

What exploit are these user agents trying to use?

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
Dai's user avatar
  • 1,728
21 votes

Brutalized VPS recovery data now available. Considerations?

David's answer gave some excellent recommendations (which I highly recommend you follow). I will focus my answer instead on your specific fears in hope to alleviate them. What I wish to accomplish ...
forest's user avatar
  • 66.8k
20 votes

Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

The chance is high that you keep the server mostly secure if you do run updates often (i.e. at least daily, instead of only "every so often"). But, critical bugs happen from time to time, like ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible