Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

5
votes
5answers
881 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
5
votes
1answer
127 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
0
votes
2answers
117 views

How to make data in hard disk unrecoverable on linux [duplicate]

I need to wipe completely the data on my hard disk so it's unrecoverable. I'm actually using Linux, i have seen this command on the web, but I don't know if its secure. shred -zvn 35 /dev/sdb
0
votes
1answer
82 views

When can the exploit for CVE: 2006-7098 be used?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
4
votes
1answer
59 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
0
votes
0answers
81 views

TPM Command Line Tools

I am trying to create a key storage hierarchy on TPM (Trusted Platform Module) on Linux (CentOS 6.4). The most commonly recommended TPM tool suite on Linux is TrouSerS. However, the command line suite ...
0
votes
2answers
79 views

PCI-DSS, what is the best distro? [closed]

What is the best distro of Linux to get PCI-DSS compliant? I am using Debian 8 because I think Debian is one of the most stable versions, but it seems not to be enough, I am struggling with a lot of ...
3
votes
1answer
136 views

Why is plain dm-crypt only recommended for experts?

I am curious about the following claim from the Cryptsetup FAQ: 2.4 What is the difference between "plain" and LUKS format? First, unless you happen to understand the cryptographic background ...
0
votes
2answers
137 views

Can I VPN a phone's connection to my home network, and then apply my home firewall to my phones network connections?

I have a decent firewall/router at home, and I was wondering whether it would be possible to use my home firewall for the connections that my phone makes, even when I'm not at home. It would mean ...
1
vote
2answers
50 views

How to use Aircrack-ng when knowing part of the password?

Let's say I know the password starts with "1234" and after that there is a commonly used password. I would like to use the word list I have for the second part of the password, but to include somehow ...
2
votes
2answers
35 views

Which software RNG for linux?

A headless server can suffer from a lack of entropy, which is a problem given that encryption needs random numbers. In the absence of a hardware random number generator (RNG) the numbers must be ...
4
votes
2answers
64 views

SSH: Security of Pubkey Authentication vs Password

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and ...
3
votes
1answer
99 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
0
votes
1answer
78 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
2
votes
0answers
60 views

chroot ssh users [closed]

I am using CentOS 7. I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for ...
1
vote
1answer
56 views

Linux Kernel module signing

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it ...
4
votes
1answer
86 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
1
vote
0answers
57 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
4
votes
1answer
153 views

/dev/random in EC2 cloud

is /dev/random any good in AWS EC2 for use in making a shared key that will be passed over a secure channel? i am concerned that a launched instance would have not much entropy to begin with. what ...
37
votes
9answers
5k views

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...
0
votes
2answers
77 views

How hard would it be to scramble crypto keys in memory on command?

I'm looking for a way locate a set of keys in memory on command. Use case would be cold boot attack prevention: a trigger on rack open, scramble the keys in memory followed by shutdown in full disk ...
-1
votes
1answer
103 views

Can I use a VPN to disguise internet traffic at work? [closed]

I have seen this question asked before; I want to know if I can use a VPN to disguise my internet traffic so my employer can't see what websites I'm visiting while at work. However, unlike most ...
2
votes
1answer
384 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
4
votes
2answers
102 views

What does a signed Linux kernel image get me?

On Ubuntu and possibly Debian systems, you can install packages which contain images which are signed by Ubuntu's EFI key. For example, linux-signed-image-generic-lts-trusty is one of these packages. ...
3
votes
3answers
462 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
1
vote
2answers
120 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
0
votes
1answer
115 views

Moving /tmp to an encrypted tmpfs

BLUF: I'm using an SSD on my system, so my primary reason to use tmpfs to increase the life of my drive by moving high read/write files to volatile memory. But from a security point of view, I'd also ...
2
votes
1answer
57 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
2
votes
0answers
45 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
3
votes
1answer
152 views

How to check whether my USB flash drive was infected by the BadUSB

After failing to check whether my USB stick firmware can be rewritten AT ALL, I want find out, whether it WAS rewritten when I sticked it in another computer. In particular the question is: how to ...
12
votes
1answer
1k views

How to check if my USB stick firmware can be rewritten via the USB port?

How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB. I was thinking about ...
0
votes
0answers
27 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
7
votes
1answer
252 views

Linux Plausibly Deniable File System

Is there any way to encrypt a linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way Truecrypt and Veracrypt work, they only support Windows OS due to low ...
0
votes
0answers
43 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
4
votes
1answer
90 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
0
votes
1answer
73 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
2
votes
1answer
52 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
6
votes
2answers
560 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
2
votes
1answer
159 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
5
votes
2answers
100 views

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...
5
votes
2answers
377 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
2
votes
0answers
125 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
2
votes
1answer
239 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
-2
votes
1answer
74 views

Official proof (document) that Linux is safer and faster than Windows [closed]

I work for the Mexican government, and even though everyone involved in Linux knows that it is safer and runs faster in most instances, I have not found an official document or authority that I can ...
1
vote
2answers
146 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
6
votes
1answer
191 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
1
vote
2answers
295 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
2
votes
2answers
144 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If I install Ubuntu using this infected DVD drive, could my system be taken over during installation process or later when ...
0
votes
1answer
52 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like ...
-1
votes
2answers
70 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...