Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

0
votes
2answers
50 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
11
votes
1answer
178 views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
4
votes
2answers
847 views

Malware (adware?) infection on linux

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition: I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos ...
0
votes
0answers
15 views

Has Anyone Published the Typical Netstat Profile for TAILS Linux?

Using TAILS, and with concerns typical of anyone security conscious enough to be drawn to it in the first place, I was wondering if boum.org or anywhere else has put the typical netstat profile for ...
0
votes
1answer
58 views

Is this attack vector possible?

I had some suspicious pdf files on my linux computer. I opened it in firefox and Evince pdf reader and I forgot to use VM or any other sandbox. Is it possible the pdf to be infected with any kind of ...
5
votes
3answers
694 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
5
votes
5answers
225 views

VPN with client certificate via managed PKI - where did private key come from?

$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to ...
1
vote
2answers
31 views

Protect Public Directories Linux

Just for a brief overview. I have a system that can generate invoices and has a login system for a user to generate his/her invoices. Lets say the platform resides at /platform and the invoices in ...
5
votes
1answer
51 views

Ordering of the PATH environment variable

Locally here on Ubuntu 14.04, my $PATH looks something like this: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" When I manually define the path for ...
1
vote
1answer
384 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt?

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
-2
votes
1answer
39 views

accessing Desktop from Root directory [closed]

I was using aircrack-ng package in my ubuntu 15.04. This package works only under root privileges. Now I want to save .cap file on my desktop using airodump-ng package but everytime I do, it throws an ...
2
votes
1answer
76 views

openssh old version vulnerabilities

My Ubuntu 12.04LTS system currently offers OpenSSH_5.9p1 Debian-5ubuntu1.8, OpenSSL 1.0.1 14 Mar 2012. Besides being old, it does not allow me to use e.g. the option # PubkeyAcceptedKeyTypes ssh-rsa* ...
1
vote
1answer
90 views

Detect port scans on Linux (centos) [closed]

I have OSSEC installed on my hosts. I want to detect port scans and generate an alert in OSSEC. So, how can I detect these port scans? Is it possible reading iptables logs? Do you recommend some ...
0
votes
0answers
51 views

can sudoedit in below context be used to privilege escalate?

We can sudo without supplying a password! Matching Defaults entries for werkzeug on vwebhost: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ...
7
votes
2answers
182 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
1
vote
1answer
63 views

Minimal working configuration for reasonable security in openssh on Linux [duplicate]

I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following ...
0
votes
1answer
149 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
1
vote
3answers
499 views

TSource Engine Query DDoS attack

My gaming machine is under DDoS attack and when I used Wireshark I found the following string "TSource Engine Query" in all UDP packets coming from random IP's. I found using Google that some gaming ...
1
vote
3answers
286 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
1
vote
2answers
317 views

RAM memory data remanence and double boot, risky?

I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation setup: double boot system GNU/Linux and Microsoft Windows GNU/Linux is on 2 ...
11
votes
3answers
5k views

Pitfalls of SSD encryption

Encrypting an SSD is a process that is sometimes warned should be done with caution. E.g. http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS mentions how the SSD may keep hidden space used for wear ...
1
vote
2answers
116 views

Don't encrypt the hard drive, but make it impossible to change things without a password?

I recently bought an SSD drive and realized that my CPU (Celeron 1007U - has no AES instructions) cannot really keep up encrypting it and the SSD doesn't have hardware encryption built in. This made ...
1
vote
2answers
307 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
0
votes
2answers
24 views

Privilege escalation if the privileged ID is known

If I know the ID of a group, whose privilege is higher than mine, is it possible for me to execute programs using that group ID? If so, how do I do it? If not, why not? Will appreciate all answers.
6
votes
1answer
422 views

Is symlink race a very common vulnerability in UNIX systems

As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself ...
0
votes
1answer
429 views

Fishy: VMware sends all traffic through akamai

I'm running Linux inside of VMware on the Mac, and on Linux I'm running a program that has connections open to perhaps 4 different machines. On the OS/X side however VMware has only 1 active network ...
3
votes
1answer
79 views

What are the potential privacy issues in using a TPM chip with GNU/Linux

I'm planning to buy a TPM module to bring more security in my system (GNU/Linux, dm-crypt/LUKS, SED) but I'm not sure with the big debate around it. What are the (possible) privacy concerns in using ...
3
votes
0answers
23 views

using “mount -o bind” in chroot

I have to provide a few, reasonably complete, chrooted ssh accesses to a very small system where disk space is at a premium. I was considering doing something along the lines: mkdir -p newroot/usr ...
0
votes
2answers
186 views

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. Am I missing something here? EDIT: ...
2
votes
2answers
148 views

How could hackers get access to directory after hacking Wordpress at LinuxMint.com?

I am sure many have seen the news of the hack at Linux Mint. The ISOs were changed on 20th Feb with backdoored ISOs. They gained access via the LinuxMint Wordpress blog installation. How could they ...
5
votes
2answers
239 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the ...
6
votes
1answer
214 views

Linux - user can be in forbidden directory if su to it from user with access - is this concerning?

I was in a directory on CentOS as user1 (root in this case) and then did su to user2 which cannot normally get to that directory due to lack of "execute" permission on a parent directory, but as user2 ...
6
votes
4answers
1k views

Is it possible to USB whitelist in Linux?

After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux. Is there currently a mechanism that will allow ...
8
votes
5answers
2k views

I don't recognise my DNS server's address: does this mean I am compromised?

I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address ...
0
votes
1answer
526 views

GNU C Library getaddrinfo() Flaw

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow ...
1
vote
1answer
135 views

What are the advantages and disadvantages of installing an operating system through network? [duplicate]

Netboot is a technology that allows a computer to boot through the network, instead of starting on a hard drive, USB stick or DVD, it connects to a remote server to retrieve a disk image to start. It ...
4
votes
1answer
79 views

Will installing a Graphical User Interface in a server be a security problem?

I'm not a CLI-lover, sometimes I prefer to do some tasks in a server using a GUI rather than using the CLI (it speeds up my work), but I don't know if installing a GUI and accessing it using VNC and ...
1
vote
2answers
147 views

A question about arpspoof command

The arpspoof command will spoof default_router_ip's MAC address on all victims in the subnet arpspoof -i <NIC> <default_router_ip> How does it fool the router about the MAC addresses ...
3
votes
2answers
82 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
1
vote
0answers
58 views

Is that a way break Linux user password by bypassing grub protected?

The best way to delve into others Linux machine is by editing the grub. Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
1
vote
0answers
15 views

Where can i find information about Ipsec Xfrm framework?

I have searched online and found very little information about the ipsec xfrm framework, including the book Networking implementation and Theory.. Where can i get more information about xfrm ...
-1
votes
1answer
61 views

Linux distribution on USB stick used to banking for begginers [closed]

Is it good idea to use up-to-date Linux on USB stick instead liveCD to online banking? What is the best Linux distribution for not advanced people who commonly use Windows to make online payments ...
0
votes
0answers
42 views

OSSEC error “agent_control(1750): ERROR: No remote connection configured. Exiting”

I am new to OSSEC and trying to figure the tool to deploy it. I have an ubuntu server where I downloaded and installed the security onion packages. I have a few windows systems which I would like to ...
0
votes
2answers
10k views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
-1
votes
1answer
54 views

Open Root File Using Other Users “.bashrc -> .profile” [closed]

If I have access to .bashrc -> .profile for another user which is owned by root with lrwxrwxrwx permissions How could I capture /root/flag.txt? It's a Live CD. Thanks
2
votes
1answer
168 views

Return-to-libc attack with the argument read from registers (EDI/RDI)

I've read that to make a successful return-to-libc attack, the attacker should store the address of the command (for example /bin/sh) in the stack exactly after the return address of the system ...
-1
votes
1answer
31 views

rpm package info leak?

On Linux, rpm -qi <package-name> command would display the package info, which would contain information of build machine - Build Host :<host-name> Does this pose any security risk? Is ...
4
votes
1answer
169 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
0
votes
0answers
19 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?