Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

2
votes
2answers
228 views

Can a Ubuntu live usb be infected with spyware/ virus?

I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, ...
4
votes
2answers
649 views

What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?

Right now the internet is abuzz with news about a severe breach in GnuTLS. An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
0
votes
2answers
115 views

Debian missing security features?

Debian (stable) is a well respected server Linux distro. I was surprised to see that in their hardening walkthrough (https://wiki.debian.org/HardeningWalkthrough) they do not support position ...
1
vote
1answer
164 views

Why does Debian security guide recommend md5 hashed passwords?

I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
1
vote
0answers
57 views

Fuzzing shared libraries

Are there any tools capable of automatically fuzzing Linux shared libraries, by automatically I mean detect exported function, determine function signature and finally inject random data ? Can ...
1
vote
0answers
30 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
116 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
0answers
24 views

Tracking checkins from generic users

Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
1
vote
2answers
172 views

How big is the threat of Desktop Linux malware? [closed]

Most malware one hears about on the news seems to fit into one of two categories: Windows viruses, trojans, rootkits etc. Linux server "worms", backdoors and similar How big is the threat of ...
0
votes
2answers
200 views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
2
votes
1answer
23 views

bin_random_table and RANDOM_BOOT_ID

The Linux kernel has a few sysctrl's related to random devices packaged in a bin_random_table (http://lxr.free-electrons.com/source/kernel/sysctl_binary.c?v=3.2): static const struct bin_table ...
1
vote
0answers
209 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
0
votes
2answers
105 views

Proxy traffic via MITM script

I want to log and modify outbound traffic on a Linux machine. I currently have one program that sends requests out to the internet, I would like to process these requests and their responses via ...
2
votes
2answers
1k views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
0
votes
1answer
127 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
1
vote
1answer
58 views

ensuring that compiled (and signed) packages don't contain malicious code

I would like to understand how the packaged Linux distributions (i.e. Debian) ensure that their packages don't contain any malicious code. I know that packages are signed, and that I can download the ...
1
vote
1answer
69 views

Malware threats from other mounted hard drives

I am going to install Linux on an external hard drive and my internal hard drive is currently running Windows. When I boot to my Linux and I still have my windows hard drive mounted is it possible for ...
2
votes
1answer
116 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
-6
votes
1answer
97 views

How can mp3blaster vulnerability affect my linux OS? [closed]

Mp3blaster is a terminal mp3 player running a UNIX-like operating system, e.g. Linux, Free/Net/OpenBSD, etc. I usually use this player for playing my music, but yesterday I found a blog which claim ...
1
vote
1answer
24 views

Is there an other place than the changelogs to see if a debian package is corrected or not?

I would like to know if there was an other place to see if a debian package is fixing a CVE than the changelog of the packet. For instance the packet bind9 1:9.7.2.dfsg.P3-1 is fixing the ...
1
vote
2answers
36 views

How can we know which debian package correct which CVE

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance : ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
1
vote
1answer
201 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
4answers
105 views

Why can't just any program use his own file-system-access-system?

This may sound stupid for everyone who knows more than me about the UNIX-System and security in software: Imagine you have a program trying to cause harm by deleting files. You just do something like ...
0
votes
2answers
135 views

Malware getting root access via “sudo” and “sudo -s”

Actually, I'd like to ask 3 questions. But since they are very related, I'll ask them all here. I use Ubuntu 12.04.4. Situation 1: I use Terminator, in one of its terminals I launch sudo iotop ...
0
votes
1answer
101 views

Do the Linux binary blobs contain any intentional security holes?

This question covers the risks of accepting Binary blobs in one's distribution. This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
2
votes
2answers
249 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
0
votes
1answer
172 views

how to protect my linux pc from wifi sniffing

I have a wifi shared connection with other flatmates and I'd like to know how can I protect my Debian pc from being sniffed. Should I use a wifi anti sniffer to detect if any wifi card is in ...
1
vote
1answer
59 views

How can I view the contents of a web page without running malicious code? [closed]

I received a strange email which has some strange URL in it. I would like to know what is "behind" the url, but without the risk of running anything malicious. How can see the contents of the URL, ...
3
votes
3answers
229 views

Protecting against Firewire DMA vulnerabilities in Linux

I know there have been questions on this in the past but they all seem quite outdated, or not that specifically relevant. I need to use a 1394(Firewire) connection, however am concerned with possible ...
4
votes
2answers
180 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
1
vote
1answer
211 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
2
votes
0answers
645 views

What is a self-contained cross-platform encryption for USB drive? [closed]

I'm trying to find self-contained encryption solution for USB drives while at the same time being platform independent. For example, Windows' BitLocker only works on Windows and not on OS X or Linux. ...
1
vote
1answer
68 views

What are good ways to check for tampering/bad behaviour on a linux server that has already been set up but it's your first time logging into it

For this I am assuming we have a server that is of a client or a friend, so we the helper are not innately familiar with exactly how things should be be. What are good commands and ways to check to ...
1
vote
1answer
129 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
0
votes
2answers
185 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
19
votes
2answers
1k views

Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
2
votes
1answer
214 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
2answers
88 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
1
vote
3answers
153 views

Cracking passwords after a patteren with ex. John

So i am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a patteren. ...
15
votes
1answer
400 views

Keyboard firmware hack - Linux vulnerable?

I see that Apple patched OS X to mitigate against K. Chen's famous Apple keyboard firmware hack. However: Apple keyboards can be used with computers running other operating systems; and in any ...
3
votes
0answers
80 views

Deny Skype video access in Linux? [closed]

I have noticed that despite having configured Skype to not access video, during startups it continues to access the webcam momentarily. Skype is not a user, so I am unsure how to modify its ...
0
votes
1answer
183 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
2
votes
1answer
202 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
2
votes
1answer
116 views

Should the root Unix user have a shell?

I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible. With this ...
1
vote
3answers
333 views

Best practice for accessing management port of firewall

I'm in the process of setting up a bunch of servers at the other end of the world (well, 8 hours travel time) in a co-location place. The servers and firewall all have a remote management port (KVM, ...
0
votes
1answer
209 views

Read-Only USB thumb as Linux boot encryption authentication [closed]

I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me ...
1
vote
1answer
269 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
0
votes
3answers
205 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
1
vote
2answers
181 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...