Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

0
votes
0answers
10 views

Can one setup an application whitelist for other applications even encompassing the root user on Linux?

Is it possible to restrict an application program to being used/called only from designated programs without having resorting to specific code testing or wrappers? This restriction has to apply to ...
0
votes
1answer
43 views

Network configuration: Preventing my computer being used as a proxy?

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a ...
1
vote
2answers
71 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
0
votes
1answer
126 views

Found 0000 Permission Files on a hacked server

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and ...
1
vote
2answers
88 views

Lock down OS to specific hardware device

I know everything is reversible. But how could I lock down an instance of linux to a specific hardware device? Possibly tying the filesystem to a specific serial number on the board for instance.
1
vote
1answer
87 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
3
votes
3answers
51 views

How secure are webservers from linux repos?

how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date. If they ...
0
votes
0answers
23 views

What is purpose of fipscheck utility and fipscheck library on Linux?

So I am messing around with dracut and I am trying to get my Linux system in FIPS 140 mode by passing fips=1 to my linux kernel at the boot time from grub. However, I got confused on why dracut ...
0
votes
0answers
29 views

How crypto module integrity checks mandated by FIPS 140 standard help to make Linux based appliances safer?

After browsing dracut and hmaccalc rpm package source code I found out sha512hmac utility that is used to do do integrity checks for linux kernel (and other binaries) from initramfs boot stage uses ...
3
votes
1answer
52 views

How can I understand this extract, concerning basic heap overflow?

Unfortunately, I dont seem to understand one minor concept in the "Art of Exploitation" book, concerning heap overflow: a new root shell is being added to the passwd file. From page 168: However, ...
1
vote
1answer
19 views

Does altering the routing table to my hub defeat the purpose of a VPN?

I am running a VPN on my server with openvpn. When running openvpn I have a shell script that runs afterwards: ip rule add from 192.168.0.19 table 128 ip route add table 128 to 192.168.0.0/24 dev ...
2
votes
5answers
80 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
1
vote
0answers
47 views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
2
votes
3answers
158 views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
5
votes
2answers
155 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
0
votes
0answers
61 views

Why isn't ettercap working

I am working on an ARP poisoning/browser redirection project with Ettercap but even if I follow all the steps right it still doesn't work. I tried disabling firewalls too. What I do is: Start ...
3
votes
1answer
244 views

Air-gap implementation for personal computer use

I recently read over Bruce Schneier's article on setting up an air-gapped computer and am looking to improve my setup (compared to my current "use one Windows PC for everything" model). The main ...
-4
votes
2answers
71 views

Safe to connect a USB to Linux?

A "friend" offerred me a USB with files. I plugged it into my Ubuntu (version 12 or 14, don't remember) PC and an error appeared (don't remember exactly what was written..). So I wasn't able to browse ...
0
votes
1answer
30 views

Using virtual server for backing up files

I've purchased a virtual server which I need to run some custom tools every once in a while. I actually don't use any server features of my virtual server, I really just need a Linux machine which is ...
1
vote
1answer
43 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
4
votes
1answer
109 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
0
votes
0answers
59 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
0answers
35 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
9
votes
5answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
1
vote
1answer
117 views

How does this privilege escalation vulnerability on Elastix work?

Here is a privilege escalation vulnerability on Elastix: # id # uid=100(asterisk) gid=101(asterisk) # sudo nmap --interactive # Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ ) # Welcome to ...
1
vote
1answer
51 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
1
vote
2answers
456 views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
2
votes
3answers
103 views

Mutual authentication of SFTP server

We can use public/private key pairs for client authentication when connecting to a SFTP server. Can we also have mutual authentication so the client also verifies a public key from the server? Both ...
1
vote
0answers
31 views

Can linux cgroups and namespaces assist hiding malware?

Reading about sandboxing/security possibilities I was looking a bit into cgroups and namespaces and asked myself: How do I know that my linux root account is indeed the real root account and not ...
2
votes
1answer
149 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
1
vote
1answer
150 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
20
votes
4answers
4k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses? [duplicate]

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
10
votes
1answer
166 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
1
vote
0answers
28 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
1answer
50 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
19
votes
6answers
4k views

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
0
votes
0answers
38 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
1
vote
1answer
51 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
0
votes
0answers
52 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
1
vote
2answers
82 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
3
votes
1answer
501 views

Turn RPi3 Wi-Fi adapter into monitor mode using airmon-ng

For some reason, I can't turn the built-in Wi-Fi adapter on the new Raspberry Pi 3 into monitor mode like I used to do on other platforms. First I kill the processes that interfere with sudo airmon-...
2
votes
2answers
88 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
2
votes
1answer
44 views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
25
votes
3answers
3k views

Does using a live CD make you more vulnerable to remote attacks?

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated? I tried installing updates and it required me ...
0
votes
1answer
85 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
0
votes
1answer
261 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
2
votes
3answers
105 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
1
vote
0answers
66 views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
3
votes
1answer
79 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
0
votes
0answers
63 views

Tuning auditd to be more operational friendly

We are in the process of pushing for a passing SOC-2 audit report, and part of that is to get our auditing act together. Specific to what I'm working on right now auditd. I have a nice set of rules, ...