Securing Linux systems and applications; understanding Linux security features.
5
votes
2answers
160 views
Linux forensics questions (ssh config, user activity)
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.
We're supposed to answer:
...
5
votes
6answers
634 views
Using linux to combat windows flash drive malware?
I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
2
votes
1answer
81 views
Force all user processes to be ptraced
I'm implementing a ptrace based tool for logging system call use. It is much more simple than strace, but I'm doing this so I can learn how these tools work. I'd like to trace all user processes since ...
2
votes
2answers
69 views
What kind of privacy leakage do stuff printed to stdout pose?
1- When a program outputs to stdout, is that normally logged anywhere else?
2- When is it an issue to make a command verbose in printing to stdout instead of working quietly or redirecting to a file?
...
0
votes
2answers
298 views
How to completely password protect login into Ubuntu 12.10?
I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...
3
votes
3answers
225 views
Using /usr/bin/passwd as login shell
I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.
I have set up a separate user account (say 'tunnel') ...
1
vote
1answer
155 views
Can exploit vulnerability if program started with gdb, but segfaults if started without gdb
i'm currently trying to exploit a simple program called basic_vuln.c
#include <stdio.h>
int main(int argc, char** argv) {
char buf[64];
strcpy(buf, argv[1]);
}
I'm using xubuntu ...
-5
votes
1answer
51 views
LUG war games — suggested strategies? [closed]
My LUG on campus once in awhile holds a mock wargames on a VM. I'm trying to figure a way to get root access and make everyone else not be able to have root (king of he hill).
I have a few ideas, but ...
3
votes
3answers
1k views
Besides OpenVas and Nessus, what are my other options for vulnerability detection?
I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like).
I use Linux so do I have any other options for vulnerability detection?
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
0
votes
3answers
695 views
Retrieve auto saved Skype password from Ubuntu 12.04 LTS
The email address I used to create Skype profile has been disabled and I can't get it back.
Unfortunately, I don't remember the Skype password now.
As the password is auto saved in my local machine I ...
3
votes
2answers
151 views
Proper Linux user authentication through PAM aware applications
Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
15
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
1
vote
1answer
132 views
Dual Linux System with Whole Disk Encryption
(This is a continuation of my question on Ask Ubuntu.)
My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) ...
2
votes
1answer
198 views
Tacacs+ scenario: can I permit user to configure only for one interface and deny others
I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here: http://www.shrubbery.net/tac_plus/
My scenario is: I want to permit a user to configure my router but only for a ...
5
votes
3answers
1k views
Is CentOS a good choice from a security perspective?
How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
3
votes
2answers
238 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
1
vote
2answers
326 views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
0
votes
2answers
136 views
Tracing root compromises
In regards to the following:
0day Linux/CentOS SSHd Spam Exploit — libkeyutils.so.1.9
SSHD Rootkit
There apparently seems to be a bunch of redhat server being backdoored via a library. Does ...
1
vote
3answers
135 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
2
votes
1answer
84 views
tshark - dump the data section
As the name suggests, im trying to dump the data section of the packet,
man would suggest that its something like tshark -r file.pcap -t fields but im not having any luck
0
votes
3answers
437 views
Best practices for firewall hardware
I'm planning to implement a linux based firewall/router with at least 6 x 1Gb NIC's (network with ~300 computers/server with >=8 VLANs)
Can anybody recommend hardware best practices (reference to ...
0
votes
1answer
162 views
How configure tomcat 7 SSL to use AES-NI?
My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and ...
1
vote
1answer
48 views
Does pppd encrypt traffic?
There is pppd program that can be used to create point-to-point conections over various channels (including other network).
It supports authentication and compression. But does it encrypt traffic or ...
2
votes
2answers
638 views
Need advice on linux server being hacked
I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
9
votes
5answers
573 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
6
votes
2answers
114 views
Process authentication for Linux
Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one?
I know that an Linux operating system is only that secure like the way you use it. ...
1
vote
4answers
699 views
Why do I need both root password and user password in Fedora Linux?
I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is ...
4
votes
1answer
130 views
Hidden directory with 0x0d0x0a
Someone has hidden a directory too fool policies on a FTP account. The directory name was 0x0d0x0a.
How does he create that ?
The directory is nearly invisible with ls but discoverable with find.
...
1
vote
1answer
75 views
set uid for reboot binary & pm-suspend : security hole?
I think all the question is in the title :
For the use of my laptop to be more convenient I made a chmod 4755 to /sbin/reboot and /usr/lib/pm-utils/pm-action so I don't have to make a 'sudo' before ...
0
votes
2answers
162 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
5
votes
2answers
665 views
Wine or sandboxie as sandboxes
I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ?
I know a full-blown VM could ...
1
vote
3answers
230 views
Restrict access to a specific directory on Linux
I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
3
votes
7answers
2k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
5
votes
2answers
1k views
Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?
is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.
If it can, how, but if not, is there another ...
4
votes
3answers
244 views
Live Linux which does not mount any hard drive in the computer
I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer.
I want to prevent any possiblity to write something on the hard drive of the computer and on ...
0
votes
1answer
250 views
Retrieving saved password from Firefox on Linux [closed]
I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
0
votes
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
1
vote
2answers
171 views
Linux kernel 3.2 syscalls
Just trying to get the assembler instructions for <__execve> of the code below because i want to build the shell spawn opcode list:
#include <stdio.h>
int main()
{
char *happy[2];
...
4
votes
4answers
10k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
1
vote
2answers
366 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
2
votes
1answer
115 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
1
vote
2answers
158 views
What's the secure way to change UNIX permissions on a harcoded file often?
I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
2
votes
3answers
854 views
Open Source Vulnerability Scanner
I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
6
votes
2answers
262 views
Filling the disk with random data prior to encryption?
Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
5
votes
2answers
883 views
Pitfalls of SSD encryption
Encrypting an SSD is a process that is sometimes warned should be done with caution. E.g. http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS mentions how the SSD may keep hidden space used for wear ...
0
votes
1answer
107 views
Different types of segmentation faults in Linux [closed]
In Linux, when the NX-bit triggers the segmentation fault seems to be "error 15", whereas a more typical error, such as attempting to read from invalid memory, results in "error 7", (seen from dmesg ...
10
votes
1answer
249 views
Slot machine segfault: what can we determine?
We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
4
votes
1answer
295 views
What tools can be use for Security Auditing for Redhat
Are there any good tools that can be used for Security auditing of Redhat Linux.
That can audit all the critical areas of System and provide the detailed output of all the audited sections.
3
votes
2answers
242 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
