Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

35
votes
8answers
4k views

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
0
votes
1answer
67 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
2
votes
0answers
46 views

chroot ssh users [closed]

I am using CentOS 7. I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for ...
1
vote
1answer
50 views

Linux Kernel module signing

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it ...
4
votes
1answer
81 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
5
votes
1answer
1k views

ARP-poisoning on wireless network - no packets

I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command: ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ ...
4
votes
1answer
92 views

/dev/random in EC2 cloud

is /dev/random any good in AWS EC2 for use in making a shared key that will be passed over a secure channel? i am concerned that a launched instance would have not much entropy to begin with. what ...
1
vote
0answers
38 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
1
vote
2answers
117 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If i install Ubuntu using this infected DVD drive could my system be taken over during installation process or later when ...
15
votes
7answers
3k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
0
votes
2answers
63 views

How hard would it be to scramble crypto keys in memory on command?

I'm looking for a way locate a set of keys in memory on command. Use case would be cold boot attack prevention: a trigger on rack open, scramble the keys in memory followed by shutdown in full disk ...
-1
votes
1answer
71 views

Can I use a VPN to disguise internet traffic at work? [closed]

I have seen this question asked before; I want to know if I can use a VPN to disguise my internet traffic so my employer can't see what websites I'm visiting while at work. However, unlike most ...
2
votes
1answer
679 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
2
votes
1answer
351 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
1
vote
2answers
103 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
3
votes
1answer
55 views

What does a signed Linux kernel image get me?

On Ubuntu and possibly Debian systems, you can install packages which contain images which are signed by Ubuntu's EFI key. For example, linux-signed-image-generic-lts-trusty is one of these packages. ...
0
votes
1answer
74 views

Moving /tmp to an encrypted tmpfs

BLUF: I'm using an SSD on my system, so my primary reason to use tmpfs to increase the life of my drive by moving high read/write files to volatile memory. But from a security point of view, I'd also ...
2
votes
3answers
181 views

How bad is it to *not* reboot a server after kernel updates?

I’m administrating a few Debian Linux server, and install package updates when apticron notifies me of them. Occasionally I see updates to linux-image-[something] packages, but don’t bother to reboot ...
0
votes
0answers
30 views

Vulnarability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnarability databases such as http://www.cvedetails.com/ mentioned the vulnarability CVE-2014-2483 for java in linux RHEL systems. I ...
2
votes
0answers
33 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
10
votes
1answer
883 views

How to check if my USB stick firmware can be rewritten via the USB port?

How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB. I was thinking about ...
0
votes
0answers
26 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
4
votes
2answers
968 views

Security of LXC compared to OpenVZ

For years, I'm now using OpenVZ on my server, but support discontinued for Debian and Ubuntu, current releases seem to focus on LXC now, which is not a bad idea from the point of comfort. But what ...
66
votes
9answers
13k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
5
votes
0answers
135 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
42
votes
7answers
9k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
0
votes
0answers
35 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
3
votes
1answer
66 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
1
vote
1answer
182 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
56 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
2
votes
1answer
42 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
28
votes
4answers
20k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
6
votes
2answers
378 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
5
votes
2answers
319 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
0
votes
2answers
5k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
2
votes
1answer
204 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
5
votes
2answers
88 views

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...
2
votes
1answer
85 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
1
vote
0answers
39 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
2
votes
0answers
76 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
22
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
-2
votes
1answer
72 views

Official proof (document) that Linux is safer and faster than Windows [closed]

I work for the Mexican government, and even though everyone involved in Linux knows that it is safer and runs faster in most instances, I have not found an official document or authority that I can ...
22
votes
6answers
10k views

How to prevent BadUSB attacks on linux desktop

What can I do to protect my linux laptop from BadUSB attacks as described here? Perhaps writing an appropriate apparmor profile would help?
7
votes
0answers
295 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
1
vote
2answers
132 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
6
votes
1answer
134 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
1
vote
2answers
158 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
0
votes
1answer
52 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like ...