Server Security - Page 16 - Results from #300

Discover Server Security News

Warning: Undefined property: stdClass::$helix_ultimate_image in /var/www/www.linuxsecurity.com-443/html/templates/newsberg/html/com_content/category/blog_item.php on line 54

Warning: Undefined property: stdClass::$helix_ultimate_image in /var/www/www.linuxsecurity.com-443/html/templates/newsberg/html/com_content/category/blog_item.php on line 55

Configure Key-Based SSH Authentication In Linux Using PuTTY

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

This tutorial explains how you can replace password-based SSH authentication with key-based authentication which is more secure because only the people that own the key can log in. In this example, we're using PuTTY as our SSH client on a Windows system.

LinuxSecurity.com Team
Jul 06, 2009

New Apache DoS Tool Exploits Connection Exhaustion for DoS Attacks

Yesterday an interesting HTTP DoS tool has been released. The tool performs a Denial of Service attack on Apache (and some other, see below) servers by exhausting available connections. While there are a lot of DoS tools available today, this one is particularly interesting because it holds the connection open while sending incomplete HTTP requests to the server.

LinuxSecurity.com Team
Jun 18, 2009

Addressing Security Concerns in Server Virtualization Strategies

How does your organization handle virtualization security issues? Has it been something you've thought about for your customers? Security and regulatory concerns have some users warily eyeing the move to server virtualization. For example, during the past year, the Stanford Hospital & Clinics, part of Stanford University in Palo Alto, Calif., has shifted about half of its applications from traditional server platforms to VMware-based virtual machines (VM) -- and found it strongly impacted decision-making on security.

LinuxSecurity.com Team
Jun 03, 2009

Evaluating Password Security Policies For Network Defense

Great article on cracking passwords, including info from Bruce Schneier. Don't forget about l0phtcrack for some serious 64-bit auditing and recovery. What tools do you use?Roger Grimes presents a useful tool for figuring out how susceptible your network might be to a password-cracking attack. Most password-cracking scenarios focus on attacks that convert a captured hash to its plain-text password equivalent using an offline attack and hash or rainbow table database. Capturing password hashes assumes a lot. In most cases, the attacker must have highly privileged access (admin or root) to get to the hashes; if they do, they can inflict much more other damage. So why just discuss password cracking?

LinuxSecurity.com Team
May 27, 2009

Exploring Kon-Boot and Its Impact on Linux and Windows Boot Security

This article talks about Kon-Boot, a tool that can be used for security purposes, such as to legitimately rescue a dead system, or malicious purposes too. Does anyone know another such tool? In the case of Microsoft Windows and certain Linux distributions, this concern is not just theory. It is also a very concrete reality. Piotr Bania has put together a proof of concept, a boot compromise tool called Kon-Boot, which so far has been tested and confirmed to work on at least four Linux distribution releases and a slew of common MS Windows releases.

LinuxSecurity.com Team
May 21, 2009

Web Vulnerability Report Reveals 60% Of Sites Face Major Flaws

Most Websites harbor at least one major vulnerability, and over 80 percent of Websites have had a critical security flaw, according to new data released today by WhiteHat Security. The Website vulnerability statistics, based on Website vulnerability data gathered from WhiteHat's own enterprise clients, show that 63 percent of Websites have at least one high, critical, or urgent vulnerability issue, and there's an average of seven unfixed vulnerabilities in a Website today.

LinuxSecurity.com Team
May 19, 2009

Tips For Securing Your Public Web Presence With ModSecurity

Nice article on better securing your public web presence. Does this article help you? We would love to hear from you whether this is the type of article you like to see on this site. Using ModSecurity is not easy. The complexity of your site, your use of PHP, MySQL and other scripting languages will make it more difficult to configure correctly. Basically, the more complex your site, the more time you will need to work out issues with rules. This tutorial will provide you with several important tips to get started with ModSecurity.

LinuxSecurity.com Team
May 18, 2009

Examining Top Five Security Issues Of Virtualized Server Management

Great article contributed by Taylor Banks. From VM sprawl to compliance, here's a look at the top security issues worrying IT about virtualized servers. The bad news: Despite improved IT understanding regarding virtualization management, many of the security holes are still ones that companies create themselves.

LinuxSecurity.com Team
May 13, 2009

Cyber Security KTN Roadmap: Product Inception Security Strategy

The government-backed Cyber Security Knowledge Transfer Network (KTN) launched a new roadmap today intended to kick-start an international effort to engineer security into products from their inception. Building in Information Security, Privacy and Assurance (PDF) aims to overcome the siloed approach to security taken by many countries, according to Cyber Security KTN director Nigel Jones. Security at the core is extremely important. Trying to "bolt on" security, as so many distributions do, often leads to something less than really secure. Do you agree?

LinuxSecurity.com Team
Apr 30, 2009

Analyzing Security Risks of WordPress Themes and Plugins

Wordpress is very popular as both a blogging platform and a general CMS. [...] Unfortunately, the more layers of technology you add to a website (PHP code, MySQL databases, authentication mechanisms, fancy themes and endless plugins), the more security holes you potentially open up.

LinuxSecurity.com Team
Apr 28, 2009

Setting Up SSL Using Self-Signed Certificates on Apache Server

The self-signed certificate is a certificate that you can create yourself that will provide SSL encryption but without the verification of your website from an outside source. The outside verification does cost money. In other words, you can get the protection you need, encryption by doing it yourself. One thing to note, if you are taking people's credit card information then you will need to get a signed certificate as a warning appears when you are using self-signed certificates. Have you every wanted to make your website more secure by using SSL? This article will show you everything you need to setup your own SSL Apache server.

LinuxSecurity.com Team
Oct 14, 2008

Secure MySQL Database From SQL Injection Using GreenSQL Protection

SQL injection attacks can allow hackers to execute arbitrary SQL commands on your database through your Web site. To avoid these attacks, every piece of data supplied by a user on a Web form, through HTTP Post or CGI parameters, or other means, must be validated to not contain information that is not expected. GreenSQL is a firewall for SQL -- it sits between your Web site and MySQL database and decides which SQL statements should and should not be executed. At least that's the idea -- in execution, I found some open doors. Do you want to know how you can protect your website's MySQL server from SQL injection attacks? Then read the following article which reviews GreenSQL, a proxy which guards against these types of attacks.

LinuxSecurity.com Team
Aug 25, 2008

Hiding Software Versions To Secure Your Server Against Attacks

Most of you may not notice, or may not care, about the software versions that get revealed by the running services on your server. By default almost all services reveal some information to the clients that use them. Among this information is the version of the software that is being run. It has always been best practice, not to reveal more than it is needed. Why reveal the version of the service when nobody needs to know it? By letting these details be seen, you don't get anything else, but an extra chance for crackers to break into your server. Have you though about hiding your version of services to attackers? This article looks at four services VSFTPD, PHP, Apache, and Postfix and simples ways of hiding there version numbers.

LinuxSecurity.com Team
Aug 12, 2008

Utilizing Ratproxy for Comprehensive Web Application Security Evaluation

To help developers audit Web application security, Google has released an open source tool called ratproxy. It is a non-disruptive tool designed for Web 2.0 and AJAX applications that produces an easy-to-read report of potential exploits. Ratproxy is a local program designed to sit between your Web browser and the application you want to test. It logs outgoing requests and responses from the application, and can generate its own modified transactions to determine how an application responds to common attacks. The list of low-level tests it runs is extensive, and includes: Have you testing out ratproxy yet? If not this article will show you how to install and use it for your self.

LinuxSecurity.com Team
Jul 29, 2008

Innovative OpenBloks: A Portable Linux Server for Automation Tasks

Plat'Home's latest product, OpenBloks is a pint-sized Linux server that weighs in at a measly 225 grams. It's not much bigger than a deck of cards, but it can run many of the same server applications full-sized machines run. It's ideal for many surveillance and automation processes that rely heavily on reliability. Check out this article for an interesting look into alternatives for huge rack-mount, power-eating servers. What do you feel are the postivies and negatives for this implementation of Linux servers?

LinuxSecurity.com Team
Apr 23, 2008

SSH Configuration On Debian Etch: Public-Key Authentication Setup

This mini-howto explains how to set up an SSH server on Debian Etch with public-key authorization (and optionally with disabled password logins). SSH is a great tool to control Linux-based computers remotely. It's safe and secure. There's no warranty that it'll work for you. All of these settings are applicable for Debian and -like systems! There may be slightly changes on other systems as well. Know your role and your SSH! There's nothing like a concise HowTo on getting things done, and in this case you can get your SSH woes out of the way with this article. Check one of our feature stories by Ryan W. Maple for an even more in depth view SSH best practices!

LinuxSecurity.com Team
Apr 01, 2008

Linux Authentication Solutions Versus Active Directory Options

While Microsoft's Active Directory (AD) is an effective play to circumvent the inherent central authentication foibles of Linux, getting the technology synced with servers has been a complex undertaking for IT practitioners, to say the least. Integrating with Windows eventually has to happen since there is no denying the majority. However, there are obvious open source secure solutions to authentication with Windows - LDAP and Kerberos along with a touch of Samba can go a long way in providing that type of solution. Read on for a devil's advocate's view of Linux authentication in a Windows environment - do you think these solutions match up to what Microsoft can put out?

LinuxSecurity.com Team
Oct 30, 2007

Efficiently Control Your Servers Remotely With PuTTY On Symbian Devices

PuTTY allows you to use your Symbian-powered mobile device to connect securely to a remote computer no matter where you are located. With this tool you can perform various tasks and I bet many of you would like to be able to control their server from the road, we all know problems occur at the least opportune time.

LinuxSecurity.com Team
Aug 20, 2007

Creating Isolated User Environments With Chroot And Unionfs

Guests can never be trusted. Whether they're just anonymous users poking around your server or house guests that never seem to flush the toilet, you can never really entrust the integrity of your system to someone you don't know. Well, how about putting them in a sandbox environment? Not good enough? What about sandbox-within-a-sandbox? Read on to learn about combining the powers of chroot with Unionfs which enables you to put untrusted users into a safe, secure environment where damage is highly mitigated.

LinuxSecurity.com Team
Jun 29, 2007

RHEL 5: Configure Nagios and BMC Patrol for Effective Port Monitoring

When ten plus people are yelling at you at the same time, who do you listen to? It wouldn't matter if everyone was yelling out the scores from yesterday's ball game, however, what if they were yelling about which box / server / service is down? Organize and get your battle plan set by having Nagios sort it all out for you. In fact, make sure everything is working properly with a secured SSH server first and you'll have an easier time bouncing around your network to mitigate any damages.

LinuxSecurity.com Team
Jun 27, 2007

Community Poll

More Polls

Server Security - Page 16

Misuse of Cron Jobs for Long-Term Access in Linux Environments

Securing Remote Access to Linux Servers: Best Practices for 2026

Linux AI Tools Require Enhanced Observability for Security