Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
1answer
52 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
1
vote
2answers
887 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
1
vote
2answers
1k views

How to defeat ASLR in linux kernel? [duplicate]

Possible Duplicate: Stack Overflows - Defeating Canaries, ASLR, DEP, NX is there anyway to disable ASLR in Linux kernel 2.6.32-71.el6.x86_64, with Apache privileges?? I tried this commands: ...
0
votes
2answers
174 views

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. Am I missing something here? EDIT: ...
0
votes
3answers
212 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
0
votes
1answer
139 views

Is BSD more secure than GNU/Linux? [closed]

BSD controls the OS while Linux is just a kernel. BSD is less popular than Linux, but which one is better in terms of security?
0
votes
4answers
404 views

How can I use netcat like ping?

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?
0
votes
1answer
190 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
0
votes
2answers
477 views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
0
votes
2answers
173 views

Store a file on a harddisk without root having access to it

Is there a way to store a file on a disk as a user so that even the root user has no access to it? I tried EncFS but that is no solution because the root user can switch to every user, so he/she can ...
0
votes
2answers
335 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...
0
votes
2answers
387 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
0
votes
1answer
50 views

Is this attack vector possible?

I had some suspicious pdf files on my linux computer. I opened it in firefox and Evince pdf reader and I forgot to use VM or any other sandbox. Is it possible the pdf to be infected with any kind of ...
0
votes
2answers
132 views

How hard would it be to scramble crypto keys in memory on command?

I'm looking for a way locate a set of keys in memory on command. Use case would be cold boot attack prevention: a trigger on rack open, scramble the keys in memory followed by shutdown in full disk ...
0
votes
1answer
402 views

SSH Log: “Accepted password for user…”

I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 190.101.200.100 port 55805 ssh2 saying that a connection was accepted ...
0
votes
5answers
985 views

What voip client support manual encryption?

In pidgin there is a plugin that we can use to encrypt our messages in chat windows .. Is there anything simular for voip (pc to pc) ? any client that support manual encryption for voice data?(linux)
0
votes
1answer
340 views

Moving /tmp to an encrypted tmpfs

BLUF: I'm using an SSD on my system, so my primary reason to use tmpfs to increase the life of my drive by moving high read/write files to volatile memory. But from a security point of view, I'd also ...
0
votes
2answers
205 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
0
votes
3answers
6k views

What is the hack attempt going on when I see: did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

When I look at my sendmail logs, by far the most common "error" I see is the following: Nov 22 16:49:50 MyHostname sendmail[18832]: rAMMnj2u018832: [IP address redacted to hide the guilty] did not ...
0
votes
1answer
488 views

Would adding root to a group open a security hole? [closed]

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...
0
votes
2answers
616 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
0
votes
2answers
45 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
0
votes
1answer
56 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
0
votes
1answer
548 views

Find and kill process that create malicious connections

State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 3640 my.public.ip.xx:https xxx.xx.xxx.xx:56206 SYN-SENT 0 1 ...
0
votes
2answers
397 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
3answers
546 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
0
votes
2answers
9k views

Hydra https-form-post [closed]

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
0
votes
2answers
329 views

Danger in opening spam emails on Ubuntu operating system [closed]

Some emails are suspected to be viruses; Because of that, the email service store categorizes them as spam. Or some pages are suspected to be viruses, and new browsers classify them as harmful pages. ...
0
votes
1answer
1k views

mprotect at kernel level

What would happen if a kernel-level process sets some of its memory pages as PROT_NONE with mprotect and another kernel-level process tries to read one of these protected pages? What is the ...
0
votes
2answers
248 views

Tracing root compromises

In regards to the following: 0day Linux/CentOS SSHd Spam Exploit — libkeyutils.so.1.9 SSHD Rootkit There apparently seems to be a bunch of redhat server being backdoored via a library. Does ...
0
votes
1answer
18 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
0
votes
1answer
84 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
0
votes
2answers
93 views

Is there a tool to detect what technologies a website uses? [closed]

I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site. For example that the site is running Apache, using ...
0
votes
2answers
73 views

Testing shellshock with PHP

I have been trying to test shellshock vulnerability on PHP similar to this answer. I am running Apache server with PHP running as mod_php. The PHP version is 5.3.10. I have a phpfile (phptest.php): ...
0
votes
1answer
98 views

When can the exploit for CVE: 2006-7098 be used?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
0
votes
2answers
164 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
0
votes
1answer
56 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like ...
0
votes
1answer
453 views

Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu?

i Encrypted my files with EFS in windows 8.1 so i logged in ubuntu and without any warning , its shown my files actually not Exactly the file but shown the path of file and the name and i can ...
0
votes
1answer
72 views

Bogus HostName Causing Suspicion of Man In The Middle

I have servers on a LAN reporting my laptop with a bogus hostname. This is making me suspect a man in the middle attack. Here are some details: From an Ubuntu Linux 14.04 laptop, I logged into an ...
0
votes
1answer
123 views

SELinux ignoring /etc/sysconfig/selinux directive

I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go ...
0
votes
2answers
103 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
0
votes
2answers
9k views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
0
votes
1answer
122 views

Do you really have to go to the extremes this guide says? [duplicate]

http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498876762 Alright, so here's a lifehacker guide on how to remain anonymous. Do you really have to go to this high level of extreme to remain ...
0
votes
1answer
215 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
0
votes
1answer
160 views

How secure is user-mode Linux, in terms of protecting the host system?

Two questions about User-Mode Linux: Suppose that a privilege escalation attack is used to gain root in a UML guest. Assuming modern (3.0 or later) host and guest kernels, is it trivial to escape ...
0
votes
1answer
230 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
0
votes
1answer
1k views

In return to libc how do you know the address of system() in a remote machine?

I have the following scienarion: a vulnerable program running in a server and can be accessed using netcat I have a copy of that program locally and I can exploit it locally using ROP: ./vuln ...
0
votes
1answer
602 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
0
votes
1answer
163 views

Do the Linux binary blobs contain any intentional security holes?

This question covers the risks of accepting Binary blobs in one's distribution. This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
0
votes
1answer
137 views

Strange Virus Infecting My Server

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind. When I access some domains on that server (every ...