Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
1answer
651 views

Should Windows 2008 R2 be used as an externally facing DNS name server?

When compared to more traditional DNS name servers, what are the benefits / drawbacks of using a Windows 2008 R2 as a public ns record for a company. What limitations, or security issues would I ...
33
votes
6answers
6k views

Keeping secrets from root on Linux

I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background. Many of ...
2
votes
0answers
643 views

Adding an alternative password change scheme to passwd using PAM modules [closed]

I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this: passwd do you want to change authentication token for ...
25
votes
4answers
16k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
8
votes
4answers
438 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
4
votes
2answers
587 views

Protecting data on a laptop with linux

I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making ...
13
votes
1answer
815 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
3
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
2
votes
1answer
506 views

NFS and encrypted File systems

Can a NFS mounted file system be used for encrypted /home, and can the encrypted Home Directories be mounted/decrypted for the user when they login?
9
votes
2answers
481 views

Running proprietary software on Linux safely

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from have access to my personal files. After looking a lot at sandboxing, I've decided that anything ...
17
votes
6answers
3k views

How can I protect my computer from my potentially malicious colleagues?

So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
15
votes
2answers
651 views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
7
votes
5answers
2k views

Browsing on a USB OS (Linux) safe from malware?

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc. I have a USB drive ...
13
votes
4answers
2k views

Recommendations for Changing the Default Shell For Service Accounts

It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
5
votes
3answers
806 views

Increase security without using “dynamic” kernel modules?

I recently read that NOT using loadable kernel modules could increase security. In my interpretation this consist about recomplying the kernel with only built-in kernel modules. (how to disable ...
1
vote
3answers
313 views

Is there a security problem accessing my laptop via WIFI?

I'm developing a web application for mobile devices on my local server in my laptop. My laptop is connected to company network via LAN. And, my project manager, wants to check the web application ...
5
votes
3answers
405 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
6
votes
3answers
542 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
3
votes
2answers
296 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
11
votes
2answers
5k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
19
votes
3answers
2k views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
4
votes
3answers
496 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
8
votes
2answers
602 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
9
votes
2answers
1k views

Securing my web-server / website [closed]

Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
3
votes
1answer
556 views

Two questions about learning Linux exploit development fundamentals

getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information. First, I plan on reading "Understanding the Linux ...
-6
votes
3answers
1k views

Why are people saying that X-windows is not secure?

Why are people saying that X is not secure? With X I mean: https://secure.wikimedia.org/wikipedia/en/wiki/X_Window_System p.s.: The OpenBSD team succeeded with priviledge separation in 2003, WHY ...
23
votes
3answers
22k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
13
votes
5answers
7k views

Linux command logging?

Recently someone broke into one of our linux servers as a non root user. An excerpt from .bash_history: [...] perl perl set +o history set +o history set +o history passwd sdfsdf passwd exit I ...
7
votes
4answers
23k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
4
votes
2answers
139 views

Can my /boot be compromised if I Suspend my notebook?

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel! Or if someone tries (evil maid) to modify the /boot then ...
6
votes
1answer
2k views

Using TPM for full disc encryption?

E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?
5
votes
4answers
174 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
8
votes
3answers
1k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
3
votes
5answers
2k views

Secure mount options + partitioning on Ubuntu

What is the best solution for mount options/partitioning when having e.g.: an Ubuntu minimal install (11.04) for Desktop use? e.g.: put /tmp on different partition to give it mount options like: ...
2
votes
2answers
3k views

IPTables default security rules for a gateway/router?

On a router such as dd-wrt or tomato, what would be some default iptables rules? I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
9
votes
2answers
4k views

Recommend Keylogger for Ubuntu?

I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system ...
31
votes
6answers
4k views

Secure Linux Desktop

I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
9
votes
4answers
4k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
-1
votes
2answers
206 views

How to store my contacts encrypted?

I use KeePass for storing my passwords. What should I use if I want to store my several hundred contacts (name, phone number, email, etc) encrypted?
7
votes
3answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
2
votes
3answers
118 views

Could an Encrypted VG/Image compromised?

I mean if I encrypt my ""full system"" so that everything (besides the /boot) is in an encrypted VolumeGroup (Linux). So I store my /boot on a flash drive, thats always next to me. Q: can the ...
5
votes
1answer
929 views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
81
votes
3answers
12k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
14
votes
1answer
914 views

Did someone really plug an iphone in, or are these symptoms of an exploit attempt?

My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
5
votes
3answers
777 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
8
votes
3answers
4k views

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
10
votes
7answers
3k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
1
vote
4answers
4k views

How To - Learn basic hacking skills? [closed]

I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start. Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a ...
5
votes
1answer
879 views

Linux wireless hacking book

I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
3
votes
1answer
892 views

Firewall rules to block unwanted protocols on given ports

Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?: i only want to allow these connections [on the output chain]: on port 53 output only allow udp - dns on ...