CentOS is a free operating system distribution based upon the Linux kernel. It is derived entirely from the Red Hat Enterprise Linux (RHEL) distribution.

learn more… | top users | synonyms

-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
1
vote
0answers
37 views

What's going on with connections to/from bluecoat?

I'm trying to track down a cause on an Internal Server Failure for an Apache server. The IP address changed recently, so I thought the crash might be related. A quick search of the old IP: $ sudo ...
1
vote
1answer
27 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
0
votes
0answers
17 views

MySQL 5.1 patch

In my case, MySQL 5.1 is running on Cent OS 6.7 MySQL 5.1 being the oldest version of database, can someone help with the medium of getting latest patches for the same? Up gradation to the higher ...
-1
votes
2answers
43 views

How can I prevent booting from media devices?

first of all, I deeply apologise because of my silly question. The thing is that I am learning about hardening. I have VMware workstation 12, and I've created a VM CentOS 7 machine (to be integrated ...
0
votes
0answers
42 views

PHP null byte exploit through cookie [duplicate]

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
0
votes
0answers
41 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under /...
3
votes
3answers
42 views

How do I demonstrate OpenSSH redhat/centos patchlevel to auditors?

A common problem is that Redhat backports security fixes leaving OpenSSH with an old, but not vulnerable, rpm version and ssh version string on Redhat and CentOS. This fools auditors. Apparently, the ...
0
votes
0answers
70 views

null byte injection no response from environ

I have a challenge I'm working and I need some advice please. I found 2 null byte injection points on the web service, both of which gives me the contents of /ets/passwd when I do old ../../../../../...
1
vote
1answer
229 views

Monitoring HTTP traffic on openvpn server

I have configured an OpenVPN server and can monitor HTTP traffic via tcpdump. Is there any way to monitor the HTTPS traffic as well? Hints Self Signed SSL certificate as root certificate on VPN ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
6
votes
1answer
243 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
3
votes
2answers
216 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
2
votes
1answer
108 views

Would placing a hardened virtual machine in a VPS provide more security?

I have been working with DigitalOcean for a while now and while I do like that they make it easy to start up with a fully functioning virtual machine ready to go. It makes me cringe a little though ...
0
votes
1answer
67 views

Mitigating POODLE

First off, let me say that I'm a Windows admin trying to address a vulnerability in Linux, so please use small words. I have a CentOS server that has been identified as being vulnerable to POODLE, so ...
4
votes
3answers
372 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
-1
votes
1answer
113 views

Are there security implications to not installing the Leap Second patch on Red Hat systems? [closed]

What are Leap Seconds? A leap second is a second which is added to Coordinated Universal Time (UTC) in order to synchronize atomic clocks with astronomical time. The reason we have to add a second ...
3
votes
1answer
1k views

My sendmail started sending spam; what is causing it to do so? [closed]

Today my sendmail service started sending e-mail to various addresses. /var/spool/mail: From MAILER-DAEMON@noxcommunity.com Fri Jan 30 22:15:30 2015 Return-Path: <MAILER-DAEMON@noxcommunity.com&...
5
votes
1answer
510 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
2
votes
2answers
882 views

Sucpicious process running in CentOS server

Following is the output of the "top" command. I have clipped the result. Here, I want to know the detail of the process called httpd.pl. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ ...
2
votes
2answers
452 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
0answers
418 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
0
votes
1answer
123 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
0
votes
1answer
271 views

Joomla Linux Permissions

I installed Joomla 3 to /var/www/html directory in Cent OS 6 server. Currently /var/www/html is owned by apache:apache. What is the recommended permissions for Joomla installation on Linux in ...
1
vote
1answer
3k views

removing SSLv3 does not seem to fix POODLE problem [duplicate]

I have removed SSLv3 from my Apache 2.2.15 ssl.conf file with the line SSLProtocol All -SSLv2 -SSLv3 I have restarted httpd but POODLE tests still show vulnerability exists with POODLE. What else ...
1
vote
1answer
147 views

Can shellshock be used on a system with public webpages but restricted server access?

I want to know if my servers are still vulnerable under the following conditions... My servers are private - only myself and trusted developers have access to them We have enabled executables within ...
1
vote
2answers
2k views

OpenSSL updating ciphers suites

For PCI compliance I was required to protect our server against BEAST attacks. While I have correctly configured the apache / openssl settings to pass a scan, these settings have effectively limited ...
2
votes
1answer
177 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
2
votes
1answer
9k views

How to whitelist IP address mod_security CentOS 6

Is it possible to white list an IP address in mod_security? I found white ist whole domain name in mod_security. But I want to white list only the administrator IP. OS: CentOS 6 Server: Apache ...
2
votes
1answer
111 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
2
votes
3answers
1k views

How to prevent attacks to server

I have 3 CentOS server configured for my applications. Recently I recognized that there is so many attacks to my servers. I have so many logs about attempt to login to my servers using sshd from ...
2
votes
2answers
2k views

Outbound DDOS attack from a centos server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
1
vote
0answers
192 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
1answer
2k views

Does connection that use 0.0.0.0 in Foreign Address secured?

When I run my application on Centos the specific process opens port that listens for connections from localhost, but uses 0.0.0.0 in Foreign Address. Is it secured? netstat -plunt Active Internet ...
2
votes
3answers
3k views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
2
votes
2answers
658 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
2
votes
1answer
604 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
2answers
769 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
5
votes
3answers
26k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
1
vote
1answer
497 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
2
votes
2answers
638 views

OSSEC on an existing running machine

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion. zcat /var/log/*.gz | /var/ossec/bin/ossec-...
-1
votes
1answer
1k views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
3
votes
1answer
2k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
5
votes
4answers
511 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
2
votes
1answer
3k views

CentOS - Local privilege escalation - CVE-2012-0056

I have a server with these properties : cat /etc/lsb-release LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:...
4
votes
2answers
4k views

Need advice on linux server being hacked

I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
4
votes
2answers
177 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
1
vote
1answer
3k views

Retrieving saved password from Firefox on Linux [closed]

I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
0
votes
3answers
5k views

WHM server hacked, lost root access [closed]

I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a ...
5
votes
2answers
6k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...