Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

8
votes
2answers
497 views

Why was LibreSSL PRNG unsafe on Linux?

From the article LibreSSL's PRNG is Unsafe on Linux. The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite the 2.0.x version numbers, ...
1
vote
2answers
11k views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
0
votes
1answer
40 views

Network configuration: Preventing my computer being used as a proxy?

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a ...
1
vote
2answers
69 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
0
votes
1answer
650 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT {...
1
vote
1answer
16 views

Does altering the routing table to my hub defeat the purpose of a VPN?

I am running a VPN on my server with openvpn. When running openvpn I have a shell script that runs afterwards: ip rule add from 192.168.0.19 table 128 ip route add table 128 to 192.168.0.0/24 dev ...
1
vote
2answers
76 views

Lock down OS to specific hardware device

I know everything is reversible. But how could I lock down an instance of linux to a specific hardware device? Possibly tying the filesystem to a specific serial number on the board for instance.
1
vote
1answer
80 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
3
votes
3answers
51 views

How secure are webservers from linux repos?

how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date. If they ...
0
votes
0answers
26 views

How crypto module integrity checks mandated by FIPS 140 standard help to make Linux based appliances safer?

After browsing dracut and hmaccalc rpm package source code I found out sha512hmac utility that is used to do do integrity checks for linux kernel (and other binaries) from initramfs boot stage uses ...
0
votes
0answers
17 views

What is purpose of fipscheck utility and fipscheck library on Linux?

So I am messing around with dracut and I am trying to get my Linux system in FIPS 140 mode by passing fips=1 to my linux kernel at the boot time from grub. However, I got confused on why dracut ...
3
votes
1answer
50 views

How can I understand this extract, concerning basic heap overflow?

Unfortunately, I dont seem to understand one minor concept in the "Art of Exploitation" book, concerning heap overflow: a new root shell is being added to the passwd file. From page 168: However, ...
2
votes
3answers
3k views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
2
votes
5answers
76 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
1
vote
0answers
32 views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
3
votes
1answer
980 views

Why does the linux XRDP module use a 512 bit RSA key?

Why does the linux XRDP module use a 512 bit RSA key? 512 bit RSA keys are broken by now. How can this be safe?
2
votes
3answers
150 views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
5
votes
2answers
141 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
0
votes
0answers
46 views

Why isn't ettercap working

I am working on an ARP poisoning/browser redirection project with Ettercap but even if I follow all the steps right it still doesn't work. I tried disabling firewalls too. What I do is: Start ...
-4
votes
2answers
66 views

Safe to connect a USB to Linux?

A "friend" offerred me a USB with files. I plugged it into my Ubuntu (version 12 or 14, don't remember) PC and an error appeared (don't remember exactly what was written..). So I wasn't able to browse ...
3
votes
1answer
192 views

Air-gap implementation for personal computer use

I recently read over Bruce Schneier's article on setting up an air-gapped computer and am looking to improve my setup (compared to my current "use one Windows PC for everything" model). The main ...
0
votes
1answer
27 views

Using virtual server for backing up files

I've purchased a virtual server which I need to run some custom tools every once in a while. I actually don't use any server features of my virtual server, I really just need a Linux machine which is ...
1
vote
1answer
40 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
-1
votes
1answer
515 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| http:/...
2
votes
1answer
117 views

NMAP Scan Returns Odd OS Detection [closed]

I am new to NMAP but I was using it to troubleshoot some issues I have been having. I ran a scan on a device and I know the device runs some sort of Linux or Ubuntu OS and I was attempting to figure ...
1
vote
2answers
233 views

VMware VM run on insecure OS

I run VMware with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
0
votes
0answers
51 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
0answers
26 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
27
votes
11answers
6k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 printable ascii characters (without space). It can use ...
9
votes
5answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
1
vote
1answer
88 views

How does this privilege escalation vulnerability on Elastix work?

Here is a privilege escalation vulnerability on Elastix: # id # uid=100(asterisk) gid=101(asterisk) # sudo nmap --interactive # Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ ) # Welcome to ...
1
vote
1answer
44 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
4
votes
1answer
409 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
2
votes
3answers
810 views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
19
votes
6answers
4k views

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
0
votes
2answers
412 views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
2
votes
3answers
82 views

Mutual authentication of SFTP server

We can use public/private key pairs for client authentication when connecting to a SFTP server. Can we also have mutual authentication so the client also verifies a public key from the server? Both ...
0
votes
1answer
244 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
5
votes
3answers
519 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
1
vote
0answers
28 views

Can linux cgroups and namespaces assist hiding malware?

Reading about sandboxing/security possibilities I was looking a bit into cgroups and namespaces and asked myself: How do I know that my linux root account is indeed the real root account and not ...
1
vote
1answer
117 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
20
votes
4answers
4k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses? [duplicate]

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
5
votes
2answers
376 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
1
vote
1answer
130 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
0
votes
1answer
42 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
1
vote
0answers
27 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
2
votes
1answer
223 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
0
votes
0answers
35 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
0
votes
0answers
49 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
8
votes
1answer
469 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...