Tagged Questions

Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

0
votes
2answers
20 views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : **root** 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 ...
2
votes
2answers
76 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
-3
votes
3answers
102 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
-2
votes
1answer
52 views

Good log file review tools [closed]

I am wondering, what tools are good for log file review? I am interested in a tool that is cheap or free, easy to use, covers all relevant log files, is useful for forensics (e.g. what did a hacker ...
0
votes
2answers
73 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [on hold]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
0
votes
1answer
37 views

Joomla Linux Permissions

I installed Joomla 3 to /var/www/html directory in Cent OS 6 server. Currently /var/www/html is owned by apache:apache. What is the recommended permissions for Joomla installation on Linux in ...
0
votes
1answer
54 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
1
vote
3answers
49 views

Ping Input box on web server vulnerable to piped commands?

Scenario is this. I have logged into a web server as admin through the Login page in browser. it has displayed me with a home page of sorts that has an input box with a button next to it saying ...
23
votes
11answers
4k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 printable ascii characters (without space). It can use ...
3
votes
4answers
116 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
1
vote
1answer
38 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
0
votes
1answer
61 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
2
votes
2answers
686 views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
0
votes
1answer
78 views

UEFI secure boot and rootkits

I heard that with UEFI secure boot enabled a custom kernel module that is not signed will not run, hence a rootkit might be difficult to install. Can a secure boot really block rootkit modules from ...
0
votes
1answer
49 views

jRAT virus on Linux

I dumbly downloaded a .jar file that contained jRAT. When run, it stalls, gives a FileNotFoundException, then crashes. When I ls'd, the jar was there. When I cd'd out and back in, the jar was gone. ...
2
votes
1answer
32 views

ASLR does not seem to randomize text section

I wanted to make some basic tests on Linux ASLR, so i wrote the following code : #include <stdio.h> void funct(){ int a= 0; } void main(){ int b=0; printf("funct : %p\n", ...
0
votes
1answer
47 views

Debian encryption is as safe as Truecrypt. Is this correct?

When I try to install latest debian to my pc, the wizard ask me to input a password to do FDE(full disk encryption). My questions are: What algorithm does Debian use? (Truecrypt = AES) Can I change ...
0
votes
1answer
50 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
3
votes
0answers
39 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
2
votes
4answers
68 views

Add a file as entropy source for /dev/random

What I have: A large file containing lots of secret, true-random bytes (yes, I'm sure they're not merely pseudo-random). I'll call it F. What I want to do: Tell Linux that it can use this file as an ...
0
votes
0answers
13 views

how to pass password file to openssl srp [migrated]

I'm trying to pass password to the openssl srp through a file using -passin param as below but im getting errors. openssl srp -verbose -passin file:password.srpv.attr -srpvfile password.srpv -add -gn ...
0
votes
0answers
30 views

Private server security questions [duplicate]

I want to build my own server. It will have mail, ssh, and apache (slackware 14.1). Could you tell me what I should pay attention on when I secure my server? Should I install SELinux? It will be ...
0
votes
1answer
64 views

How to determinate if someone scanning my server?

How is possible to determinate if someone make requests with tools for pentesting? Is there any linux command?
0
votes
1answer
75 views

How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
0
votes
0answers
53 views

/etc/shadow in old format, where is salt stored? [migrated]

In /etc/shadow I have entries such as admin:YtChlvAGYzva2:16318:0:99999:7:::. I know the original password and would like to generate the same hash somehow. However, running openssl passwd -crypt ...
4
votes
2answers
65 views

Does KASLR really provide more security against exploits?

I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with ...
0
votes
1answer
108 views

Find and kill process that create malicious connections

State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 3640 my.public.ip.xx:https xxx.xx.xxx.xx:56206 SYN-SENT 0 1 ...
4
votes
1answer
173 views

Does dual boot hurt security?

On my laptop I have a well secured Linux installation that I would like to stay this way. It has in the past and could in the future contain confidential medical data I use for my study. I also have a ...
1
vote
3answers
59 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
4
votes
2answers
236 views

How secure is BSD sockets?

BSD sockets API was released in 1983. As it was implemented 3 decades ago and still being widely used, is it secure in today's scenario where every software has to be actively protected against ...
5
votes
2answers
291 views

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
0
votes
2answers
130 views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
1
vote
1answer
37 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
8
votes
1answer
492 views

What does this attempted Shellshock exploit do, and has my website been compromised?

I grepped my Apache's access.log today for the now infamous () { string, and besides a bunch of what seemed like pings to check how many servers are vulnerable, I found this attempt, which looked like ...
1
vote
1answer
130 views

Can shellshock be used on a system with public webpages but restricted server access?

I want to know if my servers are still vulnerable under the following conditions... My servers are private - only myself and trusted developers have access to them We have enabled executables within ...
2
votes
2answers
162 views

what makes envirnments vulnerable/protected vs shellshock bug

I just tested whether or not my university's environment was vulnerable to the shellshock bug using env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" (code from ...
2
votes
1answer
273 views

Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]

I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below: env X='() { (a)=>\' sh -c "echo date"; cat echo It appears ...
0
votes
0answers
37 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
171
votes
5answers
88k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
1
vote
1answer
82 views

Is this a secure way to connect with Tor?

I was discussing the use of tor with a friend, and he happened to suggest a way to remain secure when using applications on the terminal (Lynx, Nmap etc.) His suggestion was this: ssh-keygen -b 4096 ...
1
vote
1answer
63 views

Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

I have downloaded an image that someone has uploaded to my website with a public upload form. My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ...
14
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
0
votes
3answers
204 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
2
votes
1answer
86 views

Linux Rootkit / BIOS Malware: What packages are necessary to get infected?

Everybody knows about the dangers of Rootkits / BIOS malware. What do you say about this countermeasure? In order to actually get infected the malware needs to use the OS to 'patch' the BIOS chip. ...
2
votes
2answers
119 views

Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft

Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes ...
0
votes
2answers
33 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
0
votes
0answers
11 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
1
vote
1answer
95 views

What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
1
vote
3answers
111 views

Not replacing SSL cert on a rebuilt, formerly rooted Unix Server

If a server was rooted, to the point that we know a Perl script which creates a remote shell was placed on the filesystem remotely, and the server was rebuilt entirely, patching the original Apache ...