Securing Linux systems and applications; understanding Linux security features.
85
votes
8answers
4k views
Attacking an office printer?
I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
43
votes
8answers
6k views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
32
votes
2answers
4k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
22
votes
6answers
2k views
Keeping secrets from root on Linux
I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background.
Many of ...
19
votes
6answers
2k views
Secure Linux Desktop
I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
18
votes
3answers
590 views
What can an attacker do with Bluetooth and how should it be mitigated?
What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine?
...
18
votes
4answers
4k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
18
votes
0answers
569 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
17
votes
2answers
9k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
15
votes
5answers
2k views
How can I protect my computer from my potentially malicious colleagues?
So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
15
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
15
votes
3answers
465 views
If I have two identical linux virtual machine images, will they generate identical random numbers?
A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically?
Or maybe someone could direct me to a helpful research ...
14
votes
1answer
522 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
14
votes
1answer
737 views
Did someone really plug an iphone in, or are these symptoms of an exploit attempt?
My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
13
votes
4answers
340 views
How to safely synchronize time over Internet?
All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
13
votes
4answers
901 views
Recommendations for Changing the Default Shell For Service Accounts
It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
13
votes
2answers
685 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
12
votes
3answers
804 views
Multi factor authentication on Ubuntu workstations, where to start?
Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)
...
12
votes
6answers
799 views
Securely building a local pentest lab in a VM
I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
11
votes
5answers
730 views
Convenient cross-platform help on checking secure hashes like SHA-256
It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash.
...
11
votes
3answers
353 views
Is passing sensitive data through the process environment secure?
Recently I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
11
votes
2answers
327 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
10
votes
8answers
4k views
How anonymous is my setup?
my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came.
Our setup is as follows:
A windows ...
10
votes
5answers
641 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
10
votes
2answers
498 views
How to encrypt data on the server?
I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities:
...
10
votes
5answers
4k views
Linux command logging?
Recently someone broke into one of our linux servers as a non root user.
An excerpt from .bash_history:
[...]
perl
perl
set +o history
set +o history
set +o history
passwd
sdfsdf
passwd
exit
I ...
10
votes
7answers
1k views
Secure memcpy for pure C
Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...
Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
10
votes
3answers
355 views
Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?
Context:
Small business, mostly a software house for web applications but also some desktop software.
Many external collaborators, so a variety of outside users with access to the servers.
Single ...
10
votes
3answers
656 views
VPS security best practice
I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.
I've previously been hosting it off a VM in the house, but I want to ...
10
votes
1answer
249 views
Slot machine segfault: what can we determine?
We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
9
votes
1answer
223 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
9
votes
5answers
574 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
9
votes
1answer
1k views
Effects of DDoS attacks on memory use under Linux
Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
8
votes
3answers
2k views
Installing Development Tools on Production Server? Security Risk?
I am using an Amazon Linux EC2 instance as a web server. My web app uses ImageMagick. Because the Amazon Linux (CentOS) repository doesn't include an up-to-date version of ImageMagick, I am compiling ...
8
votes
3answers
826 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
8
votes
4answers
339 views
Best practices for physically securing a notebook
If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
4answers
320 views
Does UNIX have a dual approval mechanism?
Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
8
votes
2answers
1k views
Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?
My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
8
votes
2answers
2k views
Recommend Keylogger for Ubuntu?
I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system ...
8
votes
1answer
399 views
Relative importance of CHROOT for web servers
I have read extremely mixed opinions on the process of chrooting for a web server (non-shared environment). Some people swear by it, yet others say that it isn't as secure as everyone says.
Given ...
8
votes
1answer
224 views
What shell binary should I use for the root account on a Linux system?
Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
7
votes
2answers
1k views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
7
votes
5answers
1k views
Browsing on a USB OS (Linux) safe from malware?
Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc.
I have a USB drive ...
7
votes
2answers
312 views
Running proprietary software on Linux safely
As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from have access to my personal files. After looking a lot at sandboxing, I've decided that anything ...
7
votes
2answers
354 views
Is a rand from glibc's rand secure for a login key?
Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
7
votes
2answers
1k views
Best way for a hacker to hide a file on Linux?
Suppose a hacker obtains a shell on my Linux host and wants to hide a file. What's the best way for him to do this? You may assume unprivileged or root access.
My thoughts are
Use a .file ...
7
votes
4answers
303 views
What would happen if one of the popular Linux repositories is hacked?
Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling.
What ...
7
votes
3answers
385 views
How to gain a shell?
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the ...
7
votes
1answer
3k views
Available Resources for Securing RHEL 6
Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
