Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

4
votes
1answer
16 views

What security problems does copying .Xauthority to another user present?

If I want to use a GUI application with another user (example: webbrowser), I can copy the .Xauthority file to that given user's home then I can "su - user" and start the GUI app. Question: but what ...
3
votes
1answer
23 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
0answers
2 views

Prevent children of process protected by seccomp from having same seccomp protections? [migrated]

I'm writing an application which is protected by seccomp. This application uses fork() and then execvp() to run certain programs. It seems as though any child process of my program will be constrained ...
1
vote
1answer
80 views

Security of LXC compared to OpenVZ

For years, I'm now using OpenVZ on my server, but support discontinued for Debian and Ubuntu, current releases seem to focus on LXC now, which is not a bad idea from the point of comfort. But what ...
4
votes
2answers
93 views

Is there a way to check for “hollow” processes, or malware hidden within “normal” processes

I recently came across an article on the The Verge, which centers around the concept of commercial malware production and how it's used around the world. The article introduced me to a number of ...
-6
votes
0answers
52 views

is linux NSA-free? [on hold]

Does Linux have backdoors for 3-letter agency? or 3-letter agencys have to hack to access a computer running linux? I asked it, beacuse i believe close-source programs etc. windows, osx has nsa ...
1
vote
1answer
46 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
-1
votes
0answers
12 views

VA Scan for Linux server Running with Apache and SQL [on hold]

I want to do VA for Ubuntu server installed with Apache and SQL. Which open source tool you recommend?
7
votes
1answer
203 views

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down ...
-1
votes
0answers
22 views

How to identify the script that's sending spam from my server? [on hold]

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
3
votes
0answers
21 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux? [migrated]

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
-2
votes
0answers
65 views

Am I a victim of industrial espionage? [on hold]

I had a weird experience, that I don't quite know how to explain. My setup is this: I have my desktop machine, which I connect to my company's VPN. On this machine I also run a VirtualBox VM with ...
0
votes
0answers
23 views

Threats faced by IPC in multi user system [on hold]

I am learning about IPC in Linux. I see that Linux is a multi user system and the programs I start run with my privilege (so programs run with logged in user's privileges - euid). But different user's ...
0
votes
0answers
21 views

What else can we now do with the new GCC5 to improve codebase hardening [on hold]

Noting the recent question: What is the most hardened set of options for GCC compiling C/C++? Is there anything else that can be shared regarding the new version of GCC, v5 for 32/64bit targets. I'd ...
1
vote
2answers
40 views

How to change default cipher in GnuPG on both Linux and Windows?

How can I change the default symmetric cipher used by GnuPG from CAST5 to another? I'm using GPG4Win on Windows, but would also be interested in a solution for Linux.
2
votes
2answers
70 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
0
votes
2answers
270 views

Tails OS for Android and PC?

Can I use Tails OS on a USB-stick on both an Android tablet and a PC, or do I have to have two different versions? Would I have to go into the BIOS to make this work?
1
vote
1answer
78 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
0
votes
1answer
42 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
3
votes
1answer
73 views

Linux/ssh - Forensic question

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal. Is it possible to find on A, informations ...
1
vote
1answer
127 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
0
votes
0answers
16 views

theHarvester not exporting report [closed]

./theHarvester.py -d targetdomain -l 1000 -b all -f output I am using theHarvester python application to gather data on a site for pentesting purposes. Which works well. Accept I am unable to save ...
0
votes
1answer
175 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
0
votes
1answer
37 views

Are paravirtualized drivers a security risk?

Below is a copy of my answer that I gave in some other thread (Would running VMs inside of VMs be a more secure way to study viruses, etc?) about a topic of security of nested virtualization. I would ...
-4
votes
3answers
104 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
0
votes
1answer
40 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
1
vote
2answers
71 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
5
votes
2answers
85 views

Four eyes authentication for command execution on Linux. (OS level) [closed]

I reached the end of the internet with no success, so now I turn to you guys. What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux. Example : The ...
33
votes
3answers
62k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
0answers
54 views

open ports on a netgear N-150 router; disable SPI firewall? [closed]

How do I open all ports? At least internally, for LAN traffic from 192.168.1.x to 192.168.1.x I want all ports open. Even if it creates a security problem. thufir@doge:~$ thufir@doge:~$ nmap -p ...
0
votes
3answers
163 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
0
votes
0answers
33 views

Man in the middle attack, bridging wlan interface to virtual wired interface at0

I'm trying to execute a Man in the Middle attack on my mobile phone, I have two wireless cards, one inbuilt in the laptop, running AR9285 atheros drivers, the 2nd is an Alfa AWUS036NHA card with an ...
1
vote
1answer
65 views

OpenSSH downgrade attack

I have tried to implement a downgrade attack against the SSH protocol as the first steps (encryption protocols exchange) are not signed, as per RFC4253. The idea is to intercept (mitm) these steps and ...
1
vote
2answers
110 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
2
votes
0answers
12 views

Anomaly - avconv tool getting corrupted randomly [migrated]

I am facing a strange problem with avconv which is a tool for processing videos part of libav-tools package. I am on a local ubuntu server 14.04.1 LTS. What happens is that the avconv tool is ...
1
vote
1answer
28 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
4
votes
1answer
95 views

Explain the last part of how Mitnick hacked Tsutomu Shimomura with an IP sequence attack

I was reading up on why TCP ISNs need to be randomized, which led me to this write up by Tsutomu Shimomura. I understood how IP address spoofing and predicting the ISN helped the attacker establish a ...
2
votes
1answer
233 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
0
votes
2answers
86 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
20
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
0
votes
0answers
27 views

Improve the security of a website implementing the least privilege principle [duplicate]

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
85 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
3
votes
3answers
780 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
3
votes
1answer
138 views

My sendmail started sending spam; what is causing it to do so? [closed]

Today my sendmail service started sending e-mail to various addresses. /var/spool/mail: From MAILER-DAEMON@noxcommunity.com Fri Jan 30 22:15:30 2015 Return-Path: ...
9
votes
1answer
988 views

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library: [root@hpproliant1 ~]# ldd /usr/bin/java linux-gate.so.1 => (0xffffe000) libpthread.so.0 => ...
1
vote
2answers
158 views

How should I deal with adware in chrome on ubuntu?

I use chrome (but also have firefox) on ubuntu 14.04 32-bit. Recently I started getting popups from 'softwareupdaterlp.com'. I had the sense to realize it was not legitimate and I didn't click install ...
16
votes
3answers
2k views

Why doesn't Linux randomize the address of the executable code segment?

I've recently been learning about how ASLR (address space randomization) works on Linux. At least on Fedora and Red Hat Enterprise Linux, there are two kinds of executable programs: Position ...
0
votes
1answer
47 views

Bogus HostName Causing Suspicion of Man In The Middle

I have servers on a LAN reporting my laptop with a bogus hostname. This is making me suspect a man in the middle attack. Here are some details: From an Ubuntu Linux 14.04 laptop, I logged into an ...
0
votes
0answers
92 views

Is there any method to prevent/trace ddos attack?

I have a debian linux server which run a few online game services. I have some competitors in this area and i think one of them is behind the ddos attacks. I have full access to the router, so I set ...
4
votes
2answers
3k views

Best method to sandbox X applications in ubuntu

What's the best way to sandbox an X application like firefox or thunderbird in ubuntu (going into the direction of what qubes os does, but only for single applications)? I know there are many ...