Server Security - Page 14

Apache and Setting Up SSL

The self-signed certificate is a certificate that you can create yourself that will provide SSL encryption but without the verification of your website from an outside source. The outside verification does cost money. In other words, you can get the protection you need, encryption by doing it yourself. One thing to note, if you are taking people's credit card information then you will need to get a signed certificate as a warning appears when you are using self-signed certificates. Have you every wanted to make your website more secure by using SSL? This article will show you everything you need to setup your own SSL Apache server.

• LinuxSecurity.com Team
• Oct 14, 2008

Protecting Your MySQL Database From SQL Injection Attacks With GreenSQL

SQL injection attacks can allow hackers to execute arbitrary SQL commands on your database through your Web site. To avoid these attacks, every piece of data supplied by a user on a Web form, through HTTP Post or CGI parameters, or other means, must be validated to not contain information that is not expected. GreenSQL is a firewall for SQL -- it sits between your Web site and MySQL database and decides which SQL statements should and should not be executed. At least that's the idea -- in execution, I found some open doors. Do you want to know how you can protect your website's MySQL server from SQL injection attacks? Then read the following article which reviews GreenSQL, a proxy which guards against these types of attacks.

• LinuxSecurity.com Team
• Aug 25, 2008

Hiding Software Versions - A Step Forward to a Secure Server

Most of you may not notice, or may not care, about the software versions that get revealed by the running services on your server. By default almost all services reveal some information to the clients that use them. Among this information is the version of the software that is being run. It has always been best practice, not to reveal more than it is needed. Why reveal the version of the service when nobody needs to know it? By letting these details be seen, you don't get anything else, but an extra chance for crackers to break into your server. Have you though about hiding your version of services to attackers? This article looks at four services VSFTPD, PHP, Apache, and Postfix and simples ways of hiding there version numbers.

• LinuxSecurity.com Team
• Aug 12, 2008

Testing Web Application Security Using Google's Ratproxy

To help developers audit Web application security, Google has released an open source tool called ratproxy. It is a non-disruptive tool designed for Web 2.0 and AJAX applications that produces an easy-to-read report of potential exploits. Ratproxy is a local program designed to sit between your Web browser and the application you want to test. It logs outgoing requests and responses from the application, and can generate its own modified transactions to determine how an application responds to common attacks. The list of low-level tests it runs is extensive, and includes: Have you testing out ratproxy yet? If not this article will show you how to install and use it for your self.

• LinuxSecurity.com Team
• Jul 29, 2008

A Linux Server in the Palm of Your Hand

Plat'Home's latest product, OpenBloks is a pint-sized Linux server that weighs in at a measly 225 grams. It's not much bigger than a deck of cards, but it can run many of the same server applications full-sized machines run. It's ideal for many surveillance and automation processes that rely heavily on reliability. Check out this article for an interesting look into alternatives for huge rack-mount, power-eating servers. What do you feel are the postivies and negatives for this implementation of Linux servers?

• LinuxSecurity.com Team
• Apr 23, 2008

How To Set Up SSH With Public-Key Authentication On Debian Etch

This mini-howto explains how to set up an SSH server on Debian Etch with public-key authorization (and optionally with disabled password logins). SSH is a great tool to control Linux-based computers remotely. It's safe and secure. There's no warranty that it'll work for you. All of these settings are applicable for Debian and -like systems! There may be slightly changes on other systems as well. Know your role and your SSH! There's nothing like a concise HowTo on getting things done, and in this case you can get your SSH woes out of the way with this article. Check one of our feature stories by Ryan W. Maple for an even more in depth view SSH best practices!

• LinuxSecurity.com Team
• Apr 01, 2008

Does Active Directory Top Linux Authentication Options?

While Microsoft's Active Directory (AD) is an effective play to circumvent the inherent central authentication foibles of Linux, getting the technology synced with servers has been a complex undertaking for IT practitioners, to say the least. Integrating with Windows eventually has to happen since there is no denying the majority. However, there are obvious open source secure solutions to authentication with Windows - LDAP and Kerberos along with a touch of Samba can go a long way in providing that type of solution. Read on for a devil's advocate's view of Linux authentication in a Windows environment - do you think these solutions match up to what Microsoft can put out?

• LinuxSecurity.com Team
• Oct 30, 2007

Running the PuTTY SSH Client on a Nokia E61

PuTTY allows you to use your Symbian-powered mobile device to connect securely to a remote computer no matter where you are located. With this tool you can perform various tasks and I bet many of you would like to be able to control their server from the road, we all know problems occur at the least opportune time.

• LinuxSecurity.com Team
• Aug 20, 2007

Entering A Safe Mirror When Logging In With Unionfs And Chroot

Guests can never be trusted. Whether they're just anonymous users poking around your server or house guests that never seem to flush the toilet, you can never really entrust the integrity of your system to someone you don't know. Well, how about putting them in a sandbox environment? Not good enough? What about sandbox-within-a-sandbox? Read on to learn about combining the powers of chroot with Unionfs which enables you to put untrusted users into a safe, secure environment where damage is highly mitigated.

• LinuxSecurity.com Team
• Jun 29, 2007

Nagios with BMC Patrol, Setting Up SSH and More

When ten plus people are yelling at you at the same time, who do you listen to? It wouldn't matter if everyone was yelling out the scores from yesterday's ball game, however, what if they were yelling about which box / server / service is down? Organize and get your battle plan set by having Nagios sort it all out for you. In fact, make sure everything is working properly with a secured SSH server first and you'll have an easier time bouncing around your network to mitigate any damages.

• LinuxSecurity.com Team
• Jun 27, 2007

Suse Linux Gets Better Virtualization, Security?

• LinuxSecurity.com Team
• Jun 20, 2007

How To Block Spam Before It Enters The Server (Postfix)

The last few weeks have seen a dramatic increase in spam (once again). Estimates say that spam makes now up for 80 - 90% of all emails, and many mail servers have difficulties in managing the additional load caused by the latest spam, and spam filters such as SpamAssassin do not recognize large parts of that spam as they did before. Fortunately, we can block a big amount of that spam at the MTA level, for example by using blacklists, running tests on the sender and recipient domains, etc.

• LinuxSecurity.com Team
• Jun 07, 2007

Google: Attack code more likely on Microsoft IIS

Web sites running Microsoft Corp.'s Web server software are twice as likely to be hosting malicious code as other Web sites, according to research from Google Inc. Last month, Google's Anti-Malware team looked at 70,000 domains that were either distributing malware or hosting attack code. "Compared to our sample of servers across the Internet, Microsoft IIS features twice as often as a malware-distributing server," wrote Google's Nagendra Modadugu, in a Tuesday blog posting.

• LinuxSecurity.com Team
• Jun 06, 2007

Backing up MySQL data

Backing up files and directories is relatively easy; databases, however, have some special quirks that you need to address. Our examples use MySQL, but the same principles apply to PostgreSQL and other relational databases. This article is excerpted from O'Reilly's recently published book Linux System Administration .

• LinuxSecurity.com Team
• May 30, 2007

Rootsh terminal logger keeps watch on root users

Rootsh is a shell that logs everything a root user sees on his terminal. This is useful if you have more than one system administrator for a server and you want a record of exactly what any given user does. Despite the fact that the latest rootsh release was in March 2005, it still does its job great.

• LinuxSecurity.com Team
• May 04, 2007

Rootkits: The next big enterprise threat?

Late at night, a system administrator performed a routine check of a crashed server, one of 48 systems comprising a major online infrastructure that generated about $4 million per month in revenue. He was a bit surprised that the system had gone down, as it had been humming for months without any indication of being prone to crashing. The check uncovered three encrypted files. The administrator called on MANDIANT to analyze them.

• LinuxSecurity.com Team
• May 01, 2007

Where's the Virtual Security?

Deployment of products that transform physical servers into "virtual machines" has resulted in nothing short of a data centre revolution. But virtualization of everything from operating systems to applications increasingly has critics asking: Where's the security? "Traffic is going from virtual machine to virtual machine," points out Neil MacDonald, vice president of research firm Gartner. "Where's the monitoring, the intrusion-detection and protection?"

• LinuxSecurity.com Team
• Apr 27, 2007

Put your OpenSSH server in SSHjail

Jailing is a mechanism to virtually change a system's root directory. By employing this method, administrators can isolate services so that they cannot access the real filesystem structure. You should run unsecured and sensitive network services in a chroot jail, because if a hacker can break into a vulnerable service he could exploit your whole system. If a service is jailed, the intruder will be able to see only what you want him to see -- that is, nothing useful. Some of the most frequent targets of attack, which therefore should be jailed, are BIND, Apache, FTP, and SSH. SSHjail is a patch for the OpenSSH daemon. It modifies two OpenSSH files (session.c and version.h) and allows you to jail your SSH service without any need for SSH reconfiguration.

• LinuxSecurity.com Team
• Apr 25, 2007

SMTP Authentication Update

It's about 2 and a half years since the standards bodies threw up their hands and left SMTP authentication to the industry. Implementation progress has been slow but positive. And there have been some surprises.

• LinuxSecurity.com Team
• Apr 24, 2007

Virtualization security risks being overlooked, Gartner warns

Companies in a rush to deploy virtualization technologies for server consolidation efforts could wind up overlooking many security issues and exposing themselves to risks, warns research firm Gartner.

• LinuxSecurity.com Team
• Apr 10, 2007