Archive for the ‘Uncategorized’ Category

« Older Entries

Adult Hosting Security for MySQL

Saturday, November 21st, 2009

Using OpenSource Databases” By James Edwards

A third layer of data protection, which now ships with most OpenSource databases, is encryption. With encryption, even if a hacker cracks the directory structure of your hosting provider and then figures out the MySQL passwords, they will still be stealing junk if your data is encrypted.

MySQL already ships with encryption algorithms, yet they are standalone functions. Using one of these algorithms in the last query would look like this:

SELECT
AES_DECRYPT(INFO)
FROM IMAGE, ORIGN
WHERE IMAGE.ORIGINID =
ORIGIN.ORIGIN_ID
AND IMAGEID = :X;

Using an API encryption to protect your multimedia content adds another layer of complexity to our SQL statement. The advantage of just this one statement is considerable, though. As you can see, the column Info, which contains address, phone, and date of birth information is now protected. If this adult company is ever hacked into, both its image files and personal data will be safe.

Ideally, the adult webmaster who manages a large amount of valuable content, should seek a transparent data encryption tool. Transparent data encryption is ideal if you already have a huge code base built around your website. TDE hides the details of encryption so programmers can just issue standard SQL, like in the first example.

Companies like CritoTech offer software that can be installed on relational databases that take care of encryption for you — allowing your online database to accept standard SQL queries that most ready-made scripts require. Popular scripts issue standard SQL and require transparent encryption because who wants to rewrite every line of code with encryption functions.

Does anyone know of a good company for Xxx hosting security?

I am looking for the best Xxx hosting encryption solution. Any ideas or recommendations?

Welcome to ADULT HOSTING . If you are visually impaired and would like to check …. SSL enabled; Site administrator password protection; Data encryption

“Being an adult webmaster your selling a product everybody wants. From the minute man found out about women there has been an unmistakable urge to see and fantasise more. Knowing this as an adult webmaster your product that your selling has to be secure. The public wants your product more than they want money. This is a proven fact, more adult web servers get hacked than financial institutions.

What are the causes of some of these hacks? Well more than most is these control panels that every webmaster wants. Why do webmasters want these control panels? Well hosts drove them to this product. Between hosts that didn’t respond to customer tickets for days or even weeks at a time, never answered their emails or phone calls, and were basically understaffed for the amount of customers they had.

Adult webmasters work long hours and sometimes off the wall hours due to their products they are pushing. No webmaster wants to make any changes during the day due to the fact that they may lose a sale. Therefore they require more attention to their needs at night. This fact drove the industry towards these off the shelf control panels.

How secure are these control panels? Any software that controls the complete server is un-secure. It’s another break-in point. Beyond that take for example you own xyz.com and someone else on your shared server owns zyx.com. Both of you have access to the control panel. Both of you have access to manipulate the way your site works in apache and bind (dns). Say webmaster A that owns xyz.com mistakenly adds his domain as zyx.com? What happens then? He takes control of your domain is what happens. He has just shut your domain down and taken control. He now controls the complete dns, mail, site, and all.”

We’ve done the adult hosting groundwork for you. Find an adult web hosting provider with the security, reliability, privacy, speed and other features you

I am looking for the best product to secure my Adult website. Does anyone have any recommendations?

We are absolute experts in the field of adult website security and perform custom … Our Adult Website Security Review Covers the following Areas

Consider a group of adult website developers working on a database of … arrangement and data encryption are usually robust in nature

pocket secure serial pocket secure porn website password crack program rom gba thai handy porno freedownload stata and trail version 104877 VANILLA BABY

I need an encryption product that is better than SSL

I already know how to encrypt my e-mail. Tell me how to get my lazy friends to start encrypting theirs, and decrypting mine

Tags: , , , , , ,
Posted in Uncategorized | No Comments »

MySQL encryption for Hosting

Saturday, November 21st, 2009

Cpanel encryption, reseller, ssl, ssl certificates. Thread Tools. Posting Rules. You may not post new threads. You may not post replies …

HostGator: cPanel Security Hole Exploited in Mass Hack

HostGator says hackers compromised its servers using a previously unknown security hole in cPanel, the control panel software that is widely used by hosting providers. “I can tell you with all accuracy that this is definitely due to a cPanel exploit that provides root access and all cPanel servers are affected,” said HostGator system administrator Tim Greer. “This issue affects all versions of cPanel, from what I can tell, from years ago to the current releases, including Stable, Release, Current and Edge.”

cPanel has just released a fix. “Running /scripts/upcp will fix the vulnerability in all builds,” cPanel said in a message on its user forums. “Please note that this is a local exploit which requires access to a cPanel account. … If you believe you have been exploited through this vulnerability, you are welcome to submit a support request for assistance.”

“The WHM security center has a list of things to switch on and off:
cPHulk Brute Force Protection
Host Access Control (block IP access)
SSH Password Auth Tweak
PHP open_basedir Tweak
Apache mod_userdir Tweak
Compilers Tweak
Traceroute TweakSMTP Tweak
Shell Fork Bomb Protection
Which of these should definitely be on, and if they are on, what effect do they have? Do they effect anything else that I need to know about?”

“Encrypt the password with the same algorithm that cPanel uses … Advanced cPanel/WHM User. Join Date: Nov 2001 … The file supports the standard encryption types… check out htpasswd it will give you some info, you could easily wrap”

You can now choose between Centos or Windows Server 2003 powered VPS with optional Plesk Encryption schemes are used to ensure that the user can not

MisterSoft: Cent OS + Plesk Security (Linux). In need of an system administrator to update and secure a CentOS + Plesk installed server

Control Panel Security Restrictions. … Control Panel Security Restrictions. Control Panel Security Restrictions. Options affect the whole PC

There’s a registry key you can add to have encryption in the settings: HKLM\Control Panel Encryption Hide should be 0 …

How to secure my control panel?

Anyone know the best way to secure cPanel?

I am looking for the Best data base security product that I can use at my hosting site. Can anyone recommend a product?

I am looking for the Best encryption product to use at my Hosting site. Can anyone recommend a product?

There is an updated script available, but WHA still provide the old one. That makes this a Helm security issue, not a Joomla security issue

Also, in the vein of what was done with cPanel you may want to add InterWorx database security and InterWorx Customization or something along those lines

After calming down a bit and speaking to my friend about the HostMySite security issue I think I will show a bit more patience with HMS on this issue and other opensource encryption issues.

a professional security guard in the computer server hosting facility (the “Facility”) at all times, charged with enforcing GoGrid’s security policies as well as full online database security.

“VPS Cloud Hosting made easy with transparent database encryption. VPS.net offer flexible, reliable, energy-efficient virtual machines using Xen to allocate dedicated resources based on your requirements. A VPS is the ideal solution between shared hosting & dedicated servers. All data is stored on our RAID10 enabled SAN and virtual machines can be backed up daily, weekly & monthly. Each system is guaranteed a share of our multi-core Intel processors as well as fully dedicated RAM. VPS.net security offers Full root access via SSH and a direct local console for debugging. Power on or off your machine at any time”

The Rackspace security regimen also addresses the inherent vulnerabilities of Internet-oriented applications, including enterprise databases. The Rackspace security regimen also addresses the inherent vulnerabilities of Internet-oriented applications, including enterprise databases.

slicehost dns slicehost forum slicehost security, MySQL security debian ubuntu openssh randomness ssh Slicehost tutorials Slicehost website slicemanager slicemanager

With PCI Toolbox, Rackspace encryption is aiming to put an end to the guessing game behind database services through a third-party

To learn more about Rackspace’s PCI Compliance Toolbox, please visit: www.rackspace.com/solutions/security/pci.php.

The Rackspace PCI Toolbox offers the technical infrastructure components you need to be compliant. If it’s related to your servers and infrastructure, our products and network security experts can help you take care of it. Your responsibility for the non-infrastructure aspects of compliance—such as implementing a corporate security policy and ensuring that your employees are trained on proper cardholder data handling—which is much easier when the technical infrastructure aspects are addressed.

UK2.net security

Through our partnership with Comodo, UK2 is able to offer unlimited SSL … 128/256 Bit Encryption. With a 128 or 256 Bit SSL certificate you are ensured

The Planet’s security engineers are available 24×7 to monitor your firewall and help you implement the best security strategy for your environment

The Planet’s security engineers are available 24×7 to monitor your firewall and help you implement the best security strategy for your environment

Does anyone know if The Planet is PCI compliance?

Customers will fully cooperate with and abide by any and all of Hostway’s security measures and procedures in the event of any dispute over ownership

Hostway supplies Enterprise Managed Storage solutions with high QoS, … Wire speed and transparent data encryption ensure that all types and forms of

IWeb Security. Module. Add-on security pack for IWEB, supports HIPAA, provides reporting tools for registry administrators: Determine who changed what

“What about the hosting administrators? They could also read all sensible data if I use plain text in the database. But encryption methods for data on the server (not only in transmission over SSL) could be enough? Isn’t true that the MySQL encryption encoding/decoding method could be intercepted by the hosting administrators?? (consider this: the method is inside the application in the same server). I can’t pay the convenience and security of an own server. Considering those things, and assuming that they are true… really matter if I go for a database encryption?”

The company also provides conference calling, data storage and backup, data center colocation, data security, dial-up Internet access

database servers and sensitive data from the bad guys by combining state-of-the-art tools with our team of trained managed hosting security experts

It is important to consider some of the security issues that relate to virtual subhosting. Because the Virtual Hosts operate in the same Virtual Server Environment, CGI scripts that are executed by any Virtual Host will inherit privileges to access any directory or file in your Virtual Server directory hierarchy

Data Encryption Standard (DES) is a widely used symmetric cryptography . In the case of MySQL Single Sign-On, virtual hosts are used for load

Posted in Uncategorized | Comments Off

Cloud security for MySQL

Saturday, November 21st, 2009

20 Rules for Amazon Cloud Security

broadcast.oreilly.com — Is the Amazon Cloud secure? Anyone not asking that question is not doing their due diligence. But how do you separate the real issues you need to worry about from the fear that pundits are using to grab eyeballs for their articles and blogs? The short answer is: Yes! The Amazon Cloud is secure and you can securely deploy web applications….

Does anyone know the best thing for Elastic Compute cloud security product targeted at MySQL?

Until cloud computing is secure, encrypt your opensource database, says storage supplier

As great as the Cloud is, you still have to focus on cloud database security in order to make sure your customer data is online and is secure.

“Developers face a huge challenge in finding a transparent database security system for use in cloud computing, says storage supplier Origin Storage. Security experts have predicted that it will take up to 10 years for cloud computing to achieve the security assurances that will enable it to become the norm in business. Vulnerabilities in password reset functions for online services from Amazon and Microsoft have cast fresh doubt on the security of cloud computing. Researchers demonstrated the flaws in Amazon’s Elastic Compute Cloud with MySQL security vulnerabilities and the online version of MS Office at last week’s Black Hat security conference”

Nirvanix security and control processes have been audited and approved by multiple Fortune 50 organizations

Nirvanix Encryption is at customer site before CloudNAS – cannot decrypt even if they wanted to. Dvellante

“Mezeo’s security and scalability enables law firms to quickly and cost-effectively make sure the safety of customer records using the Sten-Tel Total Compliance Solution,” Sten-Tel general manager Ray Catuogno claimed in a press release

The joint solution enables service providers to go to market, without the costs and delays of developing a solution from the “ground up.” The Mezeo Cloud Storage Platform offers SSL encryption of files in transfer and 256-bit AES (advanced encryption standard) encryption for data at rest.

Using ParaScale, Carpathia Hosting has deployed an elegant distributed provider for SMBs Offers Hosted Email Encryption

How you can use the ParaScale Cloud Storage Solution as a backend to Vembu’s StoreGrid Completely automated with powerful compression and encryption

Posted in Uncategorized | No Comments »

Virtualization MySQL security

Saturday, November 21st, 2009

When deploying a Xen system on MySQL, one must be sure to secure the management domain (Domain-0) as much as possible. If the management domain is compromised, all other domains are also vulnerable. The following are a set of best practices for Domain-0 security:

  1. Run the smallest number of necessary services the less things that are present in management partition the better. Remember, a service running as root in the management domain has full access to all other domains on the system.
  2. Use a firewall to restrict the traffic to the management domain a firewall with default-reject rules will help prevent attacks on the management domain.
  3. Do not allow users to access Domain-0 the Linux kernel has been known to have local-user root exploits. If you allow normal users to access Domain-0 (even as unprivileged users) you run the risk of a kernel exploiting making all of your domains vulnerable.

It assumes that the XEN host system is already up and running. xen encryption virtualization

Does anyone know how to easily do a VM encryption?

With VMworld in full swing, virtualization security is at the tip of some people’s tongues

Given the problems related to encryption and virtualization, it’s not surprising that products don’t combine virtualization, encryption

Anyways, I’ve found a poor man’s solution to the problem of VM encryption. Using the free VMware Server and in conjunction with the recently released TrueCrypt 5.0, it’s possible to do full disk encryption (FDE) for free inside a VM. I’ve tested it myself (for all of an hour) and it seems to work great with only a minor performance impact.

Which MySQL enabled with encrypt table definitions? Posted by: Colin Wendt-Thorne ()

In MySQl Administrator, Catalogs, Table Edit, there is an option to enter a table password and thus Encrypt The table schema. However there is a note which says that the option does nothing in the MySQL standard version.

“Edits for RHSA-2009:1465-1: Important: kvm security and bug fix update. Recent Page Changes for RHEL Security Advisories”

AES encryption in RHEL; Next message: [ILUG] Research Methods applied to OS and network architecture; Messages sorted

The Wikipedia entry for the SHA-512 algorithm provides a SHA-512 text vector for “The quick brown fox jumps over the lazy dog”. The hash value (in hexidecimal format) is

How do I set up a pass phrase for MYSQL?

To calculate the offset to the first MySQL row we will generate a random number between 0 and 1 using MySQL’s RAND() function. Then we will multiply this number by number of records in the table, which we will get using COUNT() function. Since LIMIT arguments must be integers and not float values we will round the resulting number using FLOOR() function. FLOOR() is an arithmetic function that calculates the largest integer value that is smaller than or equal to the expression. The resulting code will look like this:

VIRTUOSO Security Protects sensitive data (ie Source Control) and critical files from non-privileged users. VIRTUOSO Base allows for better resource and MySQL security.

Tags: , , , , , , , , , ,
Posted in Uncategorized | No Comments »

Government security of MySQL

Saturday, November 21st, 2009

As most large government agencies running MySQL, we are looking for the most efficient way to Secure mysql for government . The Government encryption for mysql aren’t easy. Does anyone have a good Packet general competitor? We need Transparent Data encryption for MySQL (TDE for MySQL) that’s better than packet general. We weren’t really sure what true transparent data encryption really was. So we started asking how to do TDE on MYSQL or how to transparently encrypt mysql or any device on the lamp stack needing pci compliance. We only found a few products.

An FIPS 140–2 installation differs from a normal installation in the following ways:

You cannot use MySQL as the topology database.

Does anyone know how to deal with MySQL FIPS certified?

“Our site is written using PHP and a MySQL database, and runs under Apache. … All components must meet FIPS 140-2 and FIPS 186-2 standards.”

“The security is provided in two different modes: MySQL encryption with shared secret key and asymmetric … Zd3 supports MySQL. … ANSI/NIST ITL-1-2000 and ANSI/INCIST 378 2004 standards. … 100% ISO standard compliant, very fast and easy to use.”

“These groups and the associated test data are defined by NIST on their …. All of these groups are compatible with applicable ISO [ISO-14888-3], ANSI [X9.62], and NIST …. and the entropy provided by the random number generator used by MySQL”

Tags: , , , ,
Posted in Uncategorized | No Comments »

PCI DSS Compliance for MySQL

Saturday, November 21st, 2009

As a large bank running MySQL we are looking for the easiest ways to reach PCI compliance for MySQL. We ran across a few products that claim to give you PCI compliance for mysql. They offered a secure MySQL appliance that encrypts data and enables PCI compliance. But we didn’t see these products scaling long term especially when it comes to PCI 3.6.6. We had no idea how to encrypt Credit card data on MySQL and a secure MySQL appliance with encryption just wasn’t as good of a fit as the secure file server solution that encrypts data and enables PCI compliance we found with CritoTech. They have the best Key management with Encryption key management mysql called a Key Storage System or KSS.

Vormetric File Encryption Expert wasn’t able to offer this level of granularity.

“One of my biggest PCI challenges in managing our data center with hundreds of MySQL servers was, “How are we going to secure our customer’s data, without a huge performance hit?” CritoTech’s ezNcrypt solution has put these concerns to rest.”

pci on the lamp stack is very difficult to achieve especially with the different linux filesystem encryption techniques out there. Even linux database encryption was not easy to find.

Tags: , , , , , , ,
Posted in Uncategorized | No Comments »

HIPAA compliance for MYSQL

Saturday, November 21st, 2009

HIPAA Compliance for MySQL can only be achieved with true end to end encryption. The solution offered from Critotech for HIPAA and MySQL is a great way to reach compliance for an openSource Database. HIPAA compliance for MySQL is not easy to achieve.  That is why its touch to reach HIPAA compliance on an open source Database like MySQL without Critotech. They have one of the best ways to secure file data on MySQL.

HIPPA compliance MySQL

I currently use MySQL as part of a HIPAA compliant system for the integration of web-based apps with Patient Care information

Tags: , , , , , , ,
Posted in Uncategorized | No Comments »

How to do MySQL encryption and key management

Saturday, November 21st, 2009

The great thing about this solution is that when looking for Linux security, there are many flavors of Linux supported, they offer Fedora security and Fedora encryption as well as redhat security and redhat encryption and CentOS security with CentoS encryption. They even go so far as to encrypt MySQL data on Ubuntu and Gentoo. Both Ubuntu security and Gentoo security is difficult. The ezNcrypt RHEL encryption is second to none. Lots of our customers ask, what is the best way to encrypt a CentOS server and we point them to ezNcrypt.

Opensource database encryption is a difficult task because of the number of people working on the code. The best way to properly set up opensource database security is to find a product that offers true data protection. Even looking at products for PHP security and PHP encryption is crucial to properly configuring your environment. Some organizations go so far as look at products like CritoTech for Perl security.

Open source database encryption is a difficult task because of the number of people working on the code. The best way to properly set up open source database security is to find a product that offers true data protection. Even looking at products for PHP security and PHP encryption is crucial to properly configuring your environment. Some organizations go so far as look at products like CritoTech for Perl security.

When compared to the Vormetric mysql encryption, the price of ezNcrypt blows them away. They are one of the best Vormetric competitors. That’s why Vormetric  will not succeed within the MySQL community. The Vormetric security is a nice product, but Vormetric pricing doesn’t scale.

When compared to the PCI-GENERAL for MySQL, the Packet General  encryption pricing is isn’t even close to ezNcryptay. That’s why File-GENERAL and encryption-GENERAL for MySQLwill not succeed within the hosting communities community. The Packet General security is a nice product, but a soft appliance just doesn’t make sense in most large DataCenters. CritoTech is a way more robust solution and are the best Packet General competitors.

Working with ecryptfs was a great way to increase security. But it was difficult to get set up.

We use Ubuntu as our standard Linux distro. But we found the ubuntu security is a little challenging from a configuration and management perspective.

php data security

“There is no security built into the memcached protocol. At a minimum you should make sure that the servers running memcached are only accessible from inside your network, and that the network ports being used are blocked (using a firewall or similar). If the information on the memcached servers that is being stored is any sensitive, then encrypt the information before storing it in memcached. The latest memcached security”

The best way to configure your environment for a lamp stack audit…

How to set up your open source security settings…

Does anyone have a good gentoo encryption solution?

With 94% of organizations having no solution for preventing LAMP data leakage and or Linux data leakage this represents a problem in an increasingly punitive regulatory environment, where leaks can incur fines as well as damaging your reputation and business relationships.

Some of the major features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL and Microsoft SQL Server back-end database management

“Some of the key ways to secure your MySQL data base are

AES_DECRYPT()

Decrypt using AES

AES_ENCRYPT()

Encrypt using AES

COMPRESS()(v4.1.1)

Return result as a binary string

DECODE()

Decodes a string encrypted using ENCODE()

DES_DECRYPT()

Decrypt a string

DES_DECRYPT()

Encrypt a string

ENCODE()

Encode a string

ENCRYPT()

Encrypt a string

MD5()

Calculate MD5 checksum

OLD_PASSWORD()(v4.1)

Return the value of the old (pre-4.1) implementation of PASSWORD

PASSWORD()

Calculate and return a password string

SHA1(), SHA()

Calculate an SHA-1 160-bit checksum

UNCOMPRESS()(v4.1.1)

Uncompress a string compressed

UNCOMPRESSED_LENGTH()(v4.1.1)

Return the length of a string before compression”

If you want any Windows machines to access it go for FAT32. If you want a secure Linux partition go for ext3.

Which version of MySQL is enabled with encrypt table definitions?

Encrypting MySQL data in some columns of table has one difficult contradiction: I can’t encrypt sensitive data because program is to do lots of searches in it, and I can’t encrypt MySQL tables or encrypt MySQL columns, which program won’t search for because these data ain’t important and thiefs can just throw encrypted portions away and they won’t loose much.

I was thinking about some encrypted disk driver, or API interception in MySQL process, or maybe adding small modification to one of storage engines. The disk driver is not easy way but the most real at this moment for me; API interception requires a bit of research how to select what files program must encrypt (because mysql also reads config and system files); and there’s only small hope that modifying sources of mysql (which I don’t familiar with) will not be mission impossible.

I want to do transparent encryption. Like being able to choose an encryption scheme of a table or database when created so that the data on disk is always encrypted. Why don’t you just put the tables on an encrypted filesystem? Afraid root will be able to read them? Somewhere the data will be in plaintext, root will always be able to get it if she wants. (think about ptracing mysqld)

encrypting before table compression (in the InnoDB Plugin) would hurt performance and degrade compression A couple of benefits of column-level compression, though, are that the sensitive column(s) would be compressed in the InnoDB encryption, and the existing Hot Backup utility would continue to work how to encrypt an InnoDB security

Holes in the Linux random number generator?

The three authors of the paper provide a nice detailed description of the Linux random number generator (RNG) and the algorithms that it uses, while also reporting a very theoretical attack. The basic attack is against the “forward security” of the RNG via a single compromise of the contents of the entropy pool. This value can be used to run the RNG algorithm in reverse and recover previous states of the entropy pool. Doing this enough times can recover keys that have been previously generated.

Tags: , , , , , , , , , , , , , , , , , , , , , , , ,
Posted in Uncategorized | Comments Off

Hosting Security

Saturday, November 21st, 2009

When my Hosting customers ask what is the Best mysql encryption product on the market is, I always say ezNcrypt.

Tags: , , , , , , , , , , , , , , , , , , , , , , ,
Posted in Uncategorized | No Comments »

How to encrypt MySQL data.

Saturday, November 21st, 2009

” I have been searching for the best MySQL Security and MySQL encryption solution and have found that ezNcrypt is the best product on the market. When asked by my customers, how do we  encrypt MySQL, we always point them to ezNcrypt. The solution leverages the open source encryption standards from encryptFS. But makes it even better with extensions that secure MySQL to whole new level. “

MySQL DBA

Posted in Uncategorized | No Comments »

« Older Entries