Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

3
votes
1answer
96 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both ...
-4
votes
1answer
156 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...
1
vote
2answers
114 views

Are there any security benefits in deleting the private key of a https webserver after starting it?

Say you have a web server offering pages via HTTPS. After the process begins running, if you were to delete the private key, would this prevent private key recovery in case of server compromise? ...
10
votes
1answer
156 views

Using TPM with well-known SRK/owner passwords?

First, I will explain roughly how I plan to use the TPM: I am using something called tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then ...
42
votes
2answers
6k views

What is happening now with the Grub backspace key security vulnerability?

I have just read an article about a new Grub vulnerability. The article said that you can bypass the password protection by pressing backspace about twenty eight times. I am a security guy and I am ...
3
votes
0answers
41 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
7
votes
1answer
77 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
3
votes
2answers
135 views

Is using Chrome and Tor Browser at the same time secure?

I question this recently because as I was using the Tor Browser, while in the same time my Google-Chrome was opened, and I right-clicked on a word to search it in 'Disconect', when the page loaded I ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent ...
5
votes
1answer
103 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
0
votes
1answer
56 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
1
vote
0answers
38 views

Under which circumstances is the default security profile of XRDP considered okay?

In xrdp.ini, the base install of xrdp on my raspberry pi*, there I have the following below. I changed crypt_level to high. [globals] bitmap_cache=yes bitmap_compression=yes port=3389 ...
3
votes
2answers
159 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
0
votes
1answer
57 views

Test the security of my Linux setup [closed]

I have a Ubuntu installation running in VirtualBox. I have made a few modifications to it (some kernel modules and startup scripts) that I hope would make it very secure. Is there anyway I can test ...
2
votes
1answer
102 views

Linux antivirus and files bigger then 4GB

I wish to scan files that are bigger then 4GB. For example video files. I noticed many antivirus software are limited to a maximum of 4GB (ClamAV for example). So: Is there a antivirus software ...
4
votes
1answer
44 views

Is protecting a parent folder secure enough to protect files within that folder?

So this topic came up during a hardening exercise on Unix/Linux machines where a parent folder was marked with chmod 740 but files within that folder were marked chmod 644, and the argument went that ...
-4
votes
1answer
60 views

Hydra saying cracking done and displaying random passwords

I have Hydra on my Linux machine. I want to test cracking security with Hydra on SMTP but I get no success. After about 20 messages that SMTP mechanism and a random message like [465][smtp] host: ...
0
votes
2answers
93 views

Is there a tool to detect what technologies a website uses? [closed]

I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site. For example that the site is running Apache, using ...
1
vote
1answer
158 views

Can a root user inside a Docker/LXC break the security of the whole system?

My question is probably more about the LXC than about Docker, but I wonder what are the security mechanisms to prevent a root user inside a Docker image to access the whole host. More precisely, I ...
3
votes
3answers
202 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
0
votes
1answer
127 views

Online vs offline backups [closed]

Up to this point I was using physical hard drives for backups, typically using dm_crypt as mentioned here. If online storage is used instead, and the provider cannot be trusted how much should the ...
0
votes
0answers
8 views

How to prevent future attacks from Trojan.Agent.Linux.A? [duplicate]

One of our servers was just infected by Trojan.Agent.Linux.A (see https://www.virustotal.com/en/file/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed/analysis/1448647113/). I am ...
-1
votes
2answers
156 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
3
votes
4answers
210 views

How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it ...
5
votes
2answers
118 views

Securely decommissioning a dedicated server

One of my dedicated hosting CentOS servers hit 12 years. I received an end-of-life notice on it, and I started receiving SMART errors as well. I guess it's time to let it go. But before I do, I'd like ...
-2
votes
1answer
75 views

Use the Shellshock vulnerability to get a root console as a normal user [closed]

Owner is root and also made a Set-UID for the following code snippet: # include <stdio .h> void main () { setuid ( geteuid ()); system ("/ bin/ls -l"); } How might the Shellshock ...
0
votes
4answers
400 views

How can I use netcat like ping?

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?
1
vote
1answer
515 views

ClamAV Flagging application .swf files as malware

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). ...
12
votes
4answers
1k views

When using multiple operating systems, can they affect each other?

Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it ...
5
votes
2answers
122 views

Is it possible become root through a broken symlink owned by root and globally writeable?

I'm looking for a vulnerability on a server. I'm looking in the /var directory and I get something like this: drwxr-xr-x 3 root root 4.0K Aug 14 21:02 kerberos drwxr-xr-x 12 root root 4.0K Nov 11 ...
-2
votes
1answer
93 views

Honeypot used as as a proxy?

I'm running Kali Linux on my system at home to practice pentesting. If I implement a honeypot on my system could it be possible to use that as some sort of proxy server? I was thinking it wouldn't be ...
2
votes
1answer
80 views

Give only execute permissions to a Linux binary (prevent inspection)?

I'm writing an assignment for a security course, and I'm trying to create an executable which students can interact with (ie, execute), but not inspect. In particular what I'd like is for them to be ...
1
vote
2answers
247 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
15
votes
8answers
4k views

Why is it possible for the root user to delete the logs?

I always thought the greatest benefit of the logs is to confirm to you that your machine has been hacked. However I see hackers bragging about "rooting" servers all over the Internet. Whats stopping a ...
2
votes
1answer
47 views

Running rkhunter on Linux

Currently each time before an application and after an application is either installed or updated including regular patches, the command rkhunter --propupd is run, followed by the command rkhunter ...
1
vote
1answer
70 views

Debian 8 and few questions about Graphical Firewall?

I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up. ...
2
votes
3answers
121 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
6
votes
3answers
1k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
2
votes
1answer
78 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
1answer
45 views

Prevent snapshots of VPS

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; ...
1
vote
1answer
100 views

Automate certificate signing in Linux

In a private network I wish to automate signing for new clients/servers. Something like this: New client is created (dockers & etc) The client create a new private key and a CSR The client send ...
1
vote
2answers
83 views

Ettercap Remote Poisoning

I have a question about one parameter and that's it. When I'm doing DNS spoofing I have to use arp:remote. Can someone explain to me what arp:remote means? I read the man page, but did not ...
1
vote
1answer
95 views

Yersinia raw packet

I'm using Yersinia to pentest my network. There are two options send raw packet and creating DHCP rogue server I don't understand fully. Can someone explain the meaning of these options?
3
votes
1answer
129 views

Do major linux distributions differ with regard to releasing security patches? [closed]

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this ...
-1
votes
1answer
44 views

SSLStrip with autologin [closed]

What can I do to sniff the traffic by SSLStrip when the user has automatic login to the site?
4
votes
1answer
102 views

RSA fingerprint automatic change or have I been hacked?

today I tried to connect to my Digital Ocean VPS through Putty(kitty) as usual, but I got the message that the server's cached fingerprint had changed, and that it could be a security compromise. I ...
5
votes
2answers
218 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the ...
4
votes
1answer
140 views

Mitm attack problem [closed]

I have a problem with implementing this attack. I have a kali linux machine on vmware workstation. My router is - 192.168.1.1 My victim ip is - 192.168.1.254 arpspoof -i eth0 -t 192.168.1.1 ...
1
vote
2answers
145 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
1
vote
0answers
50 views

What is the security value of chattr +s?

Most modern Linux file systems support extended attributes. +s is secure deletion which ensures (at least intends) that the data in a file is overwritten with zeros when the file is deleted. Some ...