As we are aware, usually installing SSL Certificate requires Dedicated IP . The cost of this address is typically being passed down to the end user. Also the IPv4 address will be filled completely if every domain require a dedicated IP. So administrators decided to use multiple SSL installation on a single IP. Thus SNI (Server Name Identification) is established. >> What is SNI : —————— Server Name Indication (SNI) is an extension to the TLS protocol that indicates what hostname the client is attempting to connect. SNI is an extension of the TLS protocol, which allows browsers and servers to map multiple SSL-secured domain names to one IP address and gate, without this making any difference to the site …
The SSLv3 POODLE vulnerability, disclosed on October 14, 2014, is a protocol-level security flaw affecting the SSL 3.0 encryption standard. POODLE, which stands for Padding Oracle On Downgraded Legacy Encryption, exploits weaknesses in how SSLv3 handles padding during encryption. This vulnerability arises when plaintext is converted into ciphertext. To match cryptographic requirements, extra padding is added, and during decryption, this padding can leak sensitive information. Attackers can take advantage of this flaw through a man-in-the-middle (MITM) attack, gradually decrypting secure communications. How to Check if Your WHM/cPanel Server is Vulnerable To verify whether SSLv3 is enabled on your server, log in via SSH as the root user and run the following command: Example: A typical secure response will show: Advanced …
The VENOM vulnerability, also known as the QEMU virtual machine exploit, is a critical security flaw discovered on May 13, 2015 by security researcher Jason Geffner during a security review of virtual machine hypervisors. VENOM stands for Virtualized Environment Neglected Operations Manipulation and affects virtualization environments that rely on the QEMU emulator. What Is the VENOM Vulnerability? VENOM (CVE-2015-3456) is a virtual machine escape vulnerability located in the Virtual Floppy Disk Controller (FDC) code used by QEMU. Many popular virtualization platforms depend on QEMU components, including: If successfully exploited, the vulnerability allows an attacker to: This makes VENOM particularly dangerous in shared hosting and cloud infrastructures. How the VENOM Exploit Works The flaw exists in the emulated floppy drive functionality …
Introduction Server security vulnerabilities can expose key services and applications to attacks. One of these vulnerabilities is the GHOST vulnerability (CVE-2015-0235). This flaw was found in the GNU C Library (glibc) and impacts many Linux distributions. Since several essential services, such as SSH, Bash, and DNS-related applications, rely on glibc, it is crucial for system administrators to check if their servers are vulnerable and implement the necessary fixes. This article outlines how to check for the GHOST vulnerability and decide if your Linux server is at risk. On Linux servers, more than 60 binaries and major services, such as SSH, Nmap, and Bash, rely on the glibc libraries. A heap-based buffer overflow was found in __nss_hostname_digits_dots(), and an attacker could …
FirewallD is a new firewall suite being introduced to Linux distribution. At present, the all-new popular CentOs 7 has it as the default firewall suite which in near future will be implemented in servers. FirewallD, as usual, was developed by the Fedora community and was implemented in the 20th version of the same. It is also being used in arch Linux and others till the date. FirewallD is a dynamic firewall, dynamic in the sense that any change in the firewall will be implemented as soon as the amendment is made. That is unlike the previous firewall suite (iptable) where no hard reset or restart is needed to implement the rule amended or included. Iptables is deprecated in the early …
Portsentry is a tool to detect port scans and log it. Once a host is targeted by an attacker, a port scan is almost always performed. PortSentry detects such scans by monitoring the unused ports on the host. Upon a connection attempt to one of the unused ports, PortSentry is alerted and has the ability to issue a number of commands in response to the scan. Installation # cd /usr/src/ # wget http://sourceforge.net/projects/sentrytools/files/latest/download
If you inspect your server’s error logs, you may see that many visitors (for the most part robots) constantly request access to things they should not be allowed to see. If you see that such access are suspicious and they are trying to spam your forum or hijack your mail program, you may need to deny access from those IP’s. Collecting such offending IP addresses by manually inspecting your logs across your site can become a full-time job. In such cases, you may block access to the site on Country basis (from which the suspicious access was observed) , given that the site have very few legitimate visitors from these regions. It can be done by using the mod_geoip apache …
Spam emails are commonly referred to as unsolicited or junk emails sent in bulk without user consent. In a cPanel server running Exim, spamming usually occurs due to compromised accounts, vulnerable scripts, or improperly configured applications. Common Causes of Server Spamming Spamming generally happens in the following ways: General Fix for Spamming Issues Case 1: Spam Sent via PHP Script Step 1: Check Mail Queue Count A high number indicates possible spam activity. Step 2: View Recent Emails in Queue Step 3: Inspect Email Header Check the auth_id field to identify the account sending spam. Step 4: Locate the Spam Script Identify heavily used mail directories: Step 5: Disable the Script Step 6: Find Malicious IP Accessing Script Block the …
A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and Unix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions. How does Shellshock work? Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable …
Denial-of-service attack (DoS attack) or Distributed Denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. This attack generally target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers. DoS attacks are implemented by either forcing the targeted computer to reset, or consuming its resources so that it can no longer provide its services or obstructs the communication media between the users and the victim so that they can no longer communicate adequately. This blog provides you an overview on how to identify DDOS attack using netstat command. Display all active Internet connections to the server and only established connections are …