Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

0
votes
0answers
12 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?
0
votes
1answer
7 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
-2
votes
0answers
12 views

how to fix deb command not found in kali linux 2016? [migrated]

i follow tutorial install wine on wine offical website: https://wiki.winehq.org/Debian. but have a trouble, in this picture Please tell me how to fix for completely wine install and run window ...
0
votes
0answers
7 views

XCCDF check with SCE - Suse Linux Enterprise Server 11

I have written some compliance checks for Red Hat based systems with XCCDF. Some of my checks are OVAL definitions others are shell-scripts. It works great. The same checks don't work on an SLES 11 ...
2
votes
1answer
76 views

Linux responds to ARP requests for other interfaces - could this be a security vulnerability?

Linux responds to ARP requests on all interfaces by default. To explain, say you have this setup: Client 1 ---> [eth1] server [eth0] <--- Client 2 And the server's eth1 IP is 192.168.1.1 and ...
0
votes
0answers
18 views

problems in ipv6 firewall configurations [on hold]

For the below configurations, I am not able to connect the system from ip: 2606:a000:122d:113:f456:ca4d:fe2:2656.so, i removed the DROP rule from ipv4 configurations then it is allowing to ...
4
votes
0answers
27 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
20
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
0
votes
1answer
24 views

samdump2 Error reading ControlSet: _RegOpenKey

I copied both SAM and SYSTEM files from my Windows7 OS, and then used this command to read the content of the SAM file samdump2 SAM SYSTEM > mdp_chiffres.txt, but i'm getting this error Error ...
-5
votes
0answers
36 views

how to secure my OS? [closed]

1) i need network intrusion system to see what data is going in and out. how do i install which software? Let's say some malicious force has access to my ISP and monitoring my router. i wish to see ...
0
votes
3answers
168 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
0answers
12 views

Can servers with encrypted root filesystems be made reasonably highly available? [migrated]

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
-1
votes
2answers
39 views

Linux kernel security bugs and hardening Ubuntu? [closed]

I recently read some article about the linux kernel having vulnerabilities, I can't recall exactly where. Being new to linux, do you guys have some references on how I should prevent remote access to ...
3
votes
0answers
36 views

Repeated set of UUIDs from java's UUID.randomUUID() [migrated]

We have observed that set of almost 200,000 UUIDs has replayed two months apart, and I'm wondering if anyone has seen anything similar. The UUIDs are generated using UUID.randomUUID(). In digging ...
3
votes
0answers
48 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
3
votes
2answers
100 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
0
votes
1answer
51 views

Is it safe to host passwordless web applications/software with web GUI in Virtual Machines

I have a Linux Mint Virtual Machine which I use quite a lot with my Windows host. I have lots of Software installed there (mostly with web GUI so I can access them from host easily). So I am ...
2
votes
2answers
73 views

Protecting account ssh keys from root

How can users ssh private keys be protected from root stealing and attempting to brute force them? I cannot use selinux as the vendor will not support the app when it's in use? Thanks
3
votes
1answer
78 views

Hacked debian server alternative boot

The server of a customer has been hacked last night. It is a standard debian distribution with mysql, apache and ssh for remote access. The way it has been hacked is very peculiar. The standard URL ...
0
votes
1answer
56 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
1
vote
0answers
54 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt?

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
9
votes
1answer
4k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
2
votes
0answers
16 views

Linux Mint: pastebin is in /usr/local/bin [migrated]

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
5
votes
2answers
84 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
0
votes
0answers
9 views

Changing MAC address on Virtual Machine [migrated]

Running linux on virtual box with Windows 10 as a host. I want to edit the mac address on linux and was wondering if a network admin would see the spoofed linux mac or my Windows one? Would I have to ...
1
vote
0answers
22 views

From xss to rce in client side [closed]

I found a desktop application in Linux w/c getsvand that displays items from site xyz. xyz is vulnerable to XSS and code injected there is also executed on client side's desktop app.similar to this ...
3
votes
1answer
54 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
1
vote
1answer
48 views

MitM attempt resulting in ICMP redirects

I am trying to 'man in the middle' a device on my wifi network. I have configured it to use my Linux machine (also in the wifi network) as a default gateway. On the Linux (attack) host, I switched on ...
3
votes
5answers
337 views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
6
votes
1answer
63 views

Is there any security risk allowing regular Linux users to run arbitrary code?

I'd like to allow untrusted users to run arbitrary Node apps. If I use iptables to block everything except trusted servers, make each user's home folder only visible to them, and use runuser to start ...
1
vote
1answer
31 views

security updates for embedded firmware Tomato (router) [closed]

I installed on my Linksys router Tomato firmware. I saw and now don't understand how security updates work. It can't be that there is no vulnerability since 2010. Tomato Firmware v1.28.1816 ...
0
votes
1answer
83 views

Is BSD more secure than GNU/Linux? [closed]

BSD controls the OS while Linux is just a kernel. BSD is less popular than Linux, but which one is better in terms of security?
3
votes
1answer
41 views

IPSEC End to End Tunnel Throughput

I have established a IPSEC tunnel ( standard configuration , with ESP) , on two Linux machines (centos6 , core i7) communicating over 1 gbps LAN , and i'am checking the communication throughput. It ...
4
votes
1answer
54 views

Protect sensitive information in a password-free, shared database

I'm working on a webserver that stores resources in Redis. To make swarm-deployments as hassle-free as possible, I'm implementing an option where the server doesn't need to access the filesystem to ...
0
votes
0answers
32 views

Tools or scripts to automatically block IP's from threat feeds via IPTables?

Are there any tools or scripts that can automatically take IP addresses from STIX, TAXII, CybOX, MAEC, or other threat feeds and automatically reconfigure IPTables to block addresses found in those ...
3
votes
0answers
37 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
5
votes
2answers
74 views

Can malicious software be installed inside Linux swap partition?

Is it possible for a virus of any kind to be installed inside Linux swap partition? If so, could it be transferred to the system even after formatting the Linux partition only and reinstalling the OS ...
3
votes
1answer
57 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both ...
-4
votes
1answer
114 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...
1
vote
2answers
110 views

Are there any security benefits in deleting the private key of a https webserver after starting it?

Say you have a web server offering pages via HTTPS. After the process begins running, if you were to delete the private key, would this prevent private key recovery in case of server compromise? ...
10
votes
1answer
81 views

Using TPM with well-known SRK/owner passwords?

First, I will explain roughly how I plan to use the TPM: I am using something called tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then ...
41
votes
2answers
6k views

What is happening now with the Grub backspace key security vulnerability?

I have just read an article about a new Grub vulnerability. The article said that you can bypass the password protection by pressing backspace about twenty eight times. I am a security guy and I am ...
3
votes
0answers
35 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
7
votes
1answer
61 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
3
votes
2answers
97 views

Is using Chrome and Tor Browser at the same time secure?

I question this recently because as I was using the Tor Browser, while in the same time my Google-Chrome was opened, and I right-clicked on a word to search it in 'Disconect', when the page loaded I ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent ...
5
votes
1answer
91 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
0
votes
1answer
44 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
1
vote
0answers
26 views

Under which circumstances is the default security profile of XRDP considered okay?

In xrdp.ini, the base install of xrdp on my raspberry pi*, there I have the following below. I changed crypt_level to high. [globals] bitmap_cache=yes bitmap_compression=yes port=3389 ...
3
votes
2answers
101 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...