136 votes
Accepted

Script Kiddies - how do they find my server IP?

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
Mark Buffalo's user avatar
  • 22.6k
119 votes

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

Yes, you should absolutely reject the CSR. Additionally, you should change your hosting provider as it looks like they don't know what they are doing. It is already bad enough that they sent you the ...
dr_'s user avatar
  • 5,168
96 votes
Accepted

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

Let's Encrypt is a Certificate Authority, and they have more or less the same privileges and power of any other existing (and larger) certificate authority in the market. As of today, the main ...
Simone Carletti's user avatar
89 votes

Brutalized VPS recovery data now available. Considerations?

I'll start with what to do with your current system: Get in and make a backup of everything. Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law ...
David's user avatar
  • 16.1k
84 votes

Should log files be kept secret?

There are clearly 2 different lines of defense here. First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs. But the more an attacker ...
Serge Ballesta's user avatar
77 votes
Accepted

Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

You've removed a lot of problems that normally get you in trouble (namely, assuming that the app you're hosting is completely secure). From a practical perspective, you absolutely have to consider ...
Xiong Chiamiov's user avatar
63 votes
Accepted

What are the dangers of advertising my MySQL-powered amateur site?

Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party. All one needs to do is to find a ...
schroeder's user avatar
  • 128k
61 votes

Hack-resistant hosting solution for non-profit?

If the only thing you expose to internet are non-interactive web pages and do not need to run server-side components, then you can substantially lower your risks by using a static web site. You are ...
WoJ's user avatar
  • 9,028
61 votes
Accepted

Giving malicious crawlers and scripts a hard time

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
Marcus Müller's user avatar
61 votes
Accepted

What exploit are these user agents trying to use?

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
Dan Landberg's user avatar
  • 3,322
60 votes
Accepted

What are the main advantages of using LibreSSL versus OpenSSL

There is a very extensive article at Wikipedia and it does not make sense to reiterate everything here. But to give you some highlights: It replaces OpenSSL on OpenBSD, OS X since 10.11 and on some ...
Steffen Ullrich's user avatar
58 votes

Script Kiddies - how do they find my server IP?

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
user2428118's user avatar
  • 2,776
55 votes
Accepted

Why do some web servers still provide information on vendor and version in the HTTP response headers

Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit. Even if you don't advertise it, it can be figured out from the behaviour of ...
Mike Ounsworth's user avatar
53 votes
Accepted

Should I disable TLS 1.0 on my servers?

TLS 1.0 when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why I wouldn't ...
Steve Sether's user avatar
  • 21.6k
52 votes
Accepted

Any reason NOT to set all cookies to use httponly and secure

Yes, there are cases where you don't want HTTP ONLY or SECURE. If you need javascript to see the cookie value, then you remove the HTTP-Only flag. A couple cases - some sites track the page state in a ...
Jonathan's user avatar
  • 2,346
52 votes
Accepted

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
Conor Mancone's user avatar
50 votes
Accepted

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

If I were in your place I would refuse to accept this SSL certificate. The reason for that is, if someone broke into either of the emails that received the private key, they would be able to download ...
vakus's user avatar
  • 3,833
49 votes
Accepted

Does a log entry with "SPT=81" despite nothing listening on that port indicate my server is hacked?

... SRC=my.server.public.ip DST=109.89.132.126 ... ... PROTO=TCP SPT=81 DPT=587 ... RST ... This is a RST. It will be generated by your server if a remote system (in this case 109.89.132.126) tries ...
Steffen Ullrich's user avatar
47 votes
Accepted

How do attackers find the IP addresses of recently deployed servers?

Your guess is likely correct. The big server hosters have continuous IP ranges from which they assign IPs to their customers. Low budget hosters are frequently used by amateurs who don't know what ...
Philipp's user avatar
  • 49.4k
47 votes

What website accepts only TLS 1.2 so I can verify client capability?

The website: https://badssl.com/ supports various versions of TLS using different subdomains, so you can test lots of variations there! This subdomain and port only supports TLSv1.2 https://tls-v1-2....
Brad Parks's user avatar
42 votes
Accepted

Is it practical to pre-blacklist certain GeoIP regions?

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in ...
Matthew's user avatar
  • 27.4k
39 votes
Accepted

Should I use a second/dedicated IP address for SSH?

Unless that IP address belongs to a dedicated management network which implements additional security, it is a waste of resources. Both IPs are, obviously, ending up on the same server. This means ...
Stephane's user avatar
  • 18.7k
39 votes
Accepted

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Yes - the Heartbleed bug involved memory leaks out of the HTTP server such that: We attacked ourselves ...
gowenfawr's user avatar
  • 72.7k
38 votes
Accepted

What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?

One thing Firefox Focus uses this embedded web server for is to detect whether Safari Content Blocking rules were successfully enabled. It seems from this answer and the Focus source code that iOS 10 ...
Ben Regenspan's user avatar
36 votes

Server attack with \x01

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator ...
Polynomial's user avatar
  • 135k
34 votes

What security risks are there in allowing someone to upload PHP scripts?

It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
hmrojas.p's user avatar
  • 1,069
29 votes
Accepted

Downloading a file from a server with a secret: in text or binary?

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be ...
tim's user avatar
  • 29.5k
29 votes

What security risks are there in allowing someone to upload PHP scripts?

If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
Jacco's user avatar
  • 7,622
29 votes

Should log files be kept secret?

Access to raw log data should be restricted to authorized users. The simple reason for that is that even when under normal operating conditions your applications may should not log any data too ...
HBruijn's user avatar
  • 1,355
28 votes
Accepted

Is "mini-httpd" a secure web server?

Update: As pointed out by Moti Korets here, my answer relates to "Vector Ultra Mini Httpd", not "ACME mini_httpd" that I now realise was being asked for by the OP. Vector Ultra Mini Httpd No it is ...
SilverlightFox's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible