Questions tagged [remote-server]
80 questions
47
votes
2 answers
Is mosh now recommended by the security experts? (2014)
Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of the mosh binary is started on the server, the…
cnst
- 1,884
- 2
- 19
- 30
47
votes
5 answers
Servers for penetration testing
I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest or similar things. I have heard that in order the…
py_script
- 781
- 2
- 7
- 10
41
votes
5 answers
How to find out the IP address of email sender in Gmail
Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender.
Since Gmail specifies the IP address of its email relay server,…
Rushil Paul
- 611
- 2
- 6
- 9
21
votes
1 answer
Is it secure to connect to a remote Windows Server using Remote Desktop only?
I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, please describe how it is more secure that way.
Jonas
- 5,063
- 7
- 32
- 35
17
votes
2 answers
Securing MySQL server from remote connection
I need to open the port for my MySQL server to the outside and from what I read, the default configuration is not secure nor encrypted.
For that, I have a few solutions in mind with their reason but I'd like to know, from a better security point of…
Cyril N.
- 2,649
- 2
- 18
- 28
13
votes
4 answers
Why not simply backup the TrueCrypt container file?
The TrueCrypt website has some detailed information on how to backup (TrueCrypt non-system volumes) securely, summarised below:
Create a new TrueCrypt volume
Mount the main volume.
Copy all files from the mounted main volume directly to the…
James Bradbury
- 2,017
- 19
- 27
12
votes
3 answers
Verifying server software integrity?
I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers are used in competitive gaming, and the integrity…
ProdigySim
- 273
- 2
- 6
9
votes
7 answers
If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?
According to Mandiant, you should not:
Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole”
... as described here: http://blog.mandiant.com/archives/1525
Are there scenarios when it's prudent to take…
Tate Hansen
- 13,714
- 3
- 40
- 83
7
votes
4 answers
how safe is a home NAS with ssh access?
I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files.
Some extras include:
ssh, ftp, telnet, mail servers
photo gallery (directly from the NAS!)
mysql/php (can even run a…
fduff
- 725
- 1
- 8
- 17
6
votes
2 answers
For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?
Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable.
I'd like to unlock LUKS volumes on remotely hosted servers, using initramfs with BusyBox, and Dropbear as…
mirimir
- 726
- 4
- 11
6
votes
5 answers
Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?
On a W3Schools page, I found that HTTP requests work like this:
A client (a browser) sends an HTTP request to the web
A web server receives the request, and runs an application to process it
The server returns an HTTP response (output) to the…
K. Gabor
- 81
- 1
- 4
5
votes
1 answer
Should I take care of mysql credentials?
My mysql server is configured to not allow remote connection.
Should I seriously care about mysql user and password in this case?
Surfer on the fall
- 787
- 3
- 8
- 17
5
votes
1 answer
Harden root remote access
I'm trying to find a good method for hardening a server while allowing automated remote management via ssh (ansible).
The popular choice is login with a normal user and then use sudo, but this has some problems:
Passwordless sudo: this is a no-no.…
Toni Homedes i Saun
- 183
- 8
5
votes
1 answer
How secure is NAS server in LAN (wi-fi enabled)?
I've seen this question about NAS security over the Internet and I'm wondering how safe the thing is in LAN?
I'm planning on replacing my old, desktop Windows-based PC with a NAS, I was thinking about something like WD My Cloud 2 TB or if it will be…
Wordpressor
- 153
- 1
- 5
5
votes
1 answer
Checklist for configuring WinRM Security settings on servers
WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited.
In other words, insecurity though obscurity.
What security settings should I pay…
makerofthings7
- 50,090
- 54
- 250
- 536