CentOS is a free operating system distribution based upon the Linux kernel. It is derived entirely from the Red Hat Enterprise Linux (RHEL) distribution.

learn more… | top users | synonyms

2
votes
1answer
49 views

Sucpicious process running in centos server

Following is the output of the "top" command. I have clipped the result. Here, I want to know the detail of the process called httpd.pl. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ ...
1
vote
0answers
48 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
0
votes
0answers
34 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
0
votes
0answers
76 views

Ethical hacking: using a named pipe to insert public key into a authorized_keys file?

I have a couple of CentOS VMs as part of a class I'm taking, I'm just trying to understand how loose permissions (other than the obvious 777) can be taken advantage of. The targetted account on VM1 ...
0
votes
1answer
84 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
0
votes
1answer
56 views

Joomla Linux Permissions

I installed Joomla 3 to /var/www/html directory in Cent OS 6 server. Currently /var/www/html is owned by apache:apache. What is the recommended permissions for Joomla installation on Linux in ...
1
vote
1answer
2k views

removing SSLv3 does not seem to fix POODLE problem [duplicate]

I have removed SSLv3 from my Apache 2.2.15 ssl.conf file with the line SSLProtocol All -SSLv2 -SSLv3 I have restarted httpd but POODLE tests still show vulnerability exists with POODLE. What else ...
1
vote
1answer
140 views

Can shellshock be used on a system with public webpages but restricted server access?

I want to know if my servers are still vulnerable under the following conditions... My servers are private - only myself and trusted developers have access to them We have enabled executables within ...
1
vote
2answers
241 views

OpenSSL updating ciphers suites

For PCI compliance I was required to protect our server against BEAST attacks. While I have correctly configured the apache / openssl settings to pass a scan, these settings have effectively limited ...
2
votes
1answer
93 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
1
vote
1answer
1k views

How to whitelist IP address mod_security CentOS 6

Is it possible to white list an IP address in mod_security? I found white ist whole domain name in mod_security. But I want to white list only the administrator IP. OS: CentOS 6 Server: Apche httpd ...
0
votes
1answer
46 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
1
vote
2answers
618 views

How to prevent attacks to server

I have 3 CentOS server configured for my applications. Recently I recognized that there is so many attacks to my servers. I have so many logs about attempt to login to my servers using sshd from ...
2
votes
2answers
1k views

Outbound DDOS attack from a centos server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
1
vote
0answers
95 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
1answer
538 views

Does connection that use 0.0.0.0 in Foreign Address secured?

When I run my application on Centos the specific process opens port that listens for connections from localhost, but uses 0.0.0.0 in Foreign Address. Is it secured? netstat -plunt Active Internet ...
2
votes
2answers
648 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
1
vote
2answers
413 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
0answers
296 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
2answers
392 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
3
votes
1answer
9k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
1
vote
1answer
334 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
2
votes
1answer
308 views

OSSEC on an existing running machine

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion. zcat /var/log/*.gz | ...
-1
votes
1answer
653 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
3
votes
1answer
1k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
4
votes
4answers
417 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
2
votes
1answer
1k views

CentOS - Local privilege escalation - CVE-2012-0056

I have a server with these properties : cat /etc/lsb-release ...
4
votes
2answers
3k views

Need advice on linux server being hacked

I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
4
votes
2answers
157 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
0
votes
1answer
2k views

Retrieving saved password from Firefox on Linux [closed]

I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
0
votes
3answers
3k views

WHM server hacked, lost root access [closed]

I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a ...
3
votes
2answers
3k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
8
votes
3answers
3k views

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...