hosted by liquidweb

Page 1 of 20 1 23411 Last »
Showing results 1 to 25 of 500
Search: Posts Made By: brianoz
Forum: Hosting Software and Control Panels Today, 06:59 AM
Replies: 14
Views: 1,325
Posted By brianoz
I'm afraid that whilst I agree this would be...

I'm afraid that whilst I agree this would be useful, I have no idea how to generate such randomness. It could perhaps be done in WHMCS (or similar account manager scripts) but it would be nice to...
Forum: Hosting Security and Technology 05-16-2013, 02:57 AM
Replies: 4
Views: 580
Posted By brianoz
Csf doesn't report to dshield yet, that could be...

Csf doesn't report to dshield yet, that could be an interesting data point to add ...
Forum: Hosting Security and Technology 05-14-2013, 02:18 AM
Replies: 1,463
Views: 213,353
Posted By brianoz
One important point worth making: No...

One important point worth making:

No evidence has been found that there was actually an SSH vulnerability. Rather, the system itself was hacked through other root-level vulnerabilities, and as a...
Forum: Hosting Security and Technology 05-08-2013, 02:14 AM
Replies: 3
Views: 250
Posted By brianoz
AFAIK, CSF does this out of the box with it's...

AFAIK, CSF does this out of the box with it's clustering and global features...
Forum: Hosting Security and Technology 05-07-2013, 07:41 AM
Replies: 12
Views: 425
Posted By brianoz
CSF is a brilliant piece of work, not just a...

CSF is a brilliant piece of work, not just a firewall.

A firewall is only one component of your security architecture and isn't enough to keep you safe by itself. Read up on what else you can do;...
Forum: Hosting Security and Technology 05-07-2013, 07:39 AM
Replies: 27
Views: 777
Posted By brianoz
As a couple of people are saying, this has to be...

As a couple of people are saying, this has to be someone with some form of access already to either your PC or slice. This means they have compromised your PC, your network, or your slice. Or even...
Forum: Hosting Security and Technology 05-07-2013, 07:29 AM
Replies: 15
Views: 737
Posted By brianoz
Am I right in my understanding here that to be...

Am I right in my understanding here that to be able to exploit both of these they need to be logged in?

And to exploit the root access version they need to be logged in as a reseller?

I...
Forum: Other Reviews 05-06-2013, 07:27 PM
Replies: 26
Views: 773
Posted By brianoz
As Steven said via the link above, salt stops...

As Steven said via the link above, salt stops rainbow tables working. Anyone not using salt clearly doesn't care.
Forum: Hosting Security and Technology 05-06-2013, 04:48 AM
Replies: 7
Views: 455
Posted By brianoz
What you are really asking is, how do I secure my...

What you are really asking is, how do I secure my server?

The best way to secure your server is by hardening it and there are various hints around the place. CSF, suphp or similar, mod_security,...
Forum: Hosting Security and Technology 05-03-2013, 06:23 AM
Replies: 5
Views: 432
Posted By brianoz
Make sure your jumphost has two factor...

Make sure your jumphost has two factor authentication. Then alter your iptables config (CSF does this easily) so that only this host can login to ssh.

You need to have a fallback plan - what...
Sponsored Links
Forum: Hosting Security and Technology 05-03-2013, 02:00 AM
Replies: 15
Views: 703
Posted By brianoz
I'm afraid you missed my point completely. Those...

I'm afraid you missed my point completely. Those specific calls made no difference, they can't be used to attack. Capitalism or not, blocking them doesn't help. If you're going to promote blocking...
Forum: Hosting Security and Technology 05-02-2013, 09:41 AM
Replies: 15
Views: 703
Posted By brianoz
Exactly my point, and no, these functions aren't...

Exactly my point, and no, these functions aren't going to be used for hacking because as far as I can see, none of them could be used for privilege escalation or to attack another user. (I understand...
Forum: Hosting Security and Technology 05-01-2013, 05:00 AM
Replies: 15
Views: 703
Posted By brianoz
No point in blocking all those pcntl_* calls when...

No point in blocking all those pcntl_* calls when you have exec and system open. Perhaps the pcntl_fork() call and syslog() but the others provide no security value as far as I can see.
Forum: Hosting Security and Technology 04-15-2013, 08:04 PM
Replies: 14
Views: 624
Posted By brianoz
With CSF - is lfd running? Do you see log...

With CSF - is lfd running? Do you see log entries when you try to get banned?

If not, "service lfd restart" - probably not the problem, but worth checking.
Forum: Hosting Security and Technology 04-05-2013, 11:35 PM
Replies: 6
Views: 551
Posted By brianoz
The "fix" unfortunately has to be manually...

The "fix" unfortunately has to be manually selected in easyapache and just blocks the race condition.

You also want to install Steven from Rack911's patch (which forces SymlinkIfOwnerMatch on) and...
Forum: Hosting Security and Technology 04-05-2013, 11:29 PM
Replies: 7
Views: 607
Posted By brianoz
I'll bite; how?

I'll bite; how?
Forum: Hosting Security and Technology 04-05-2013, 11:26 PM
Replies: 11
Views: 894
Posted By brianoz
That number of hacked sites was almost certainly...

That number of hacked sites was almost certainly the symlink hack that has been going around, presumably the host didn't know enough about it to protect you. (Although on a VPS you are normally...
Forum: Hosting Security and Technology 03-31-2013, 05:40 AM
Replies: 11
Views: 894
Posted By brianoz
This is really too big a topic to ask for...

This is really too big a topic to ask for responses on. Best to do a little work of your own, do some googling, check out the forums etc.

Website security consists of a number of layers:
-...
Forum: Hosting Security and Technology 03-28-2013, 10:23 PM
Replies: 21
Views: 949
Posted By brianoz
Although I agree with your point about possibly...

Although I agree with your point about possibly blocking HTTP access, the point is that a malicious file shouldn't be there in the first place. You have every right to go through people's files, not...
Forum: Hosting Security and Technology 03-26-2013, 04:26 AM
Replies: 20
Views: 908
Posted By brianoz
Right. Good advice I'm sure. And how do we know...

Right. Good advice I'm sure. And how do we know that the private maker of such software knows how to make it secure? You're actually no better off.

It's down to this: like anything, quality...
Sponsored Links
Forum: Hosting Security and Technology 03-26-2013, 04:15 AM
Replies: 37
Views: 3,247
Posted By brianoz
Completely agree re cPanel making this clearer. ...

Completely agree re cPanel making this clearer. I'm rather disappointed in their lack lustre response on this one - it's not that often you get a loophole that can enable compromise of most of the...
Forum: Hosting Security and Technology 03-25-2013, 10:29 PM
Replies: 37
Views: 3,247
Posted By brianoz
Jesse, There is a version of the apache...

Jesse,

There is a version of the apache patch around that checks file ownership AFTER opening the file, so is not subject to race conditions. This is the version published by bluehost and, though...
Forum: Hosting Security and Technology 03-21-2013, 06:05 PM
Replies: 25
Views: 1,374
Posted By brianoz
Some excellent points about securing SSH above;...

Some excellent points about securing SSH above; you can't rely on just changing the port number.

However, whilst changing SSH port doesn't inherently make anything more secure, it does reduce log...
Forum: Hosting Security and Technology 03-21-2013, 05:56 PM
Replies: 10
Views: 430
Posted By brianoz
Obviously if it's HTTP, an enormous domain log...

Obviously if it's HTTP, an enormous domain log gives it away. If it's via DNS, you can turn on logging and look for high traffic on a domain. But you really haven't given us enough information here...
Forum: Hosting Security and Technology 03-17-2013, 05:38 AM
Replies: 12
Views: 1,740
Posted By brianoz
Great way to get your entire class C blocked :) ...

Great way to get your entire class C blocked :)

You might want to look at cPanel's options for sending emails from their site IP. This works reasonably well and means if someone does something...
Showing results 1 to 25 of 500
Page 1 of 20 1 23411 Last »

 
Forum Jump
Login:
Log in with your username and password
Username:
Password:



Forgot Password?
Advertisement:


 

Learn more about advertising opportunities across the iNET Interactive Network.

LiquidWeb
X

Welcome to WebHostingTalk.com

Create your username to jump into the discussion!

WebHostingTalk.com is the largest, most influentual web hosting community on the Internet. Join us by filling in the form below.


(4 digit year)

Already a member?