Securing Linux systems and applications; understanding Linux security features.
6
votes
3answers
1k views
nmap showing unknown IPs on private network
I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
5
votes
4answers
343 views
Would running VMs inside of VMs be a more secure way to study viruses, etc?
I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
2
votes
1answer
188 views
Windows 8 in a VDI environment and the use of Secure Boot
I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
7
votes
1answer
3k views
Available Resources for Securing RHEL 6
Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
5
votes
8answers
2k views
Linux or Windows- the security issue [duplicate]
Possible Duplicate:
Open Source vs Closed Source Systems
Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...
2
votes
2answers
418 views
Skype security (linux)?
From the following article skype & from archlinux skype wiki some major skype insecurity in linux are:
The skype binary is disguised against decompiling, so nobody is (still) able to reproduce ...
2
votes
2answers
172 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
3
votes
4answers
883 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
2
votes
3answers
490 views
Disable Perl for some/most Linux users?
One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
1
vote
1answer
72 views
How many connections can TCP_WRAPPERS handle?
As we know that TCP_WRAPPERS is a good way of security on linux/unix system, to disallow or allow remote user to connect to the specific services. Assume that if there have a large number of ...
1
vote
1answer
166 views
Installing applications with different user accounts on linux
I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
1
vote
4answers
4k views
Netcat IP Spoofing
I am connecting to a server
nc -v 192.168.0.1 1111
But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my ...
-1
votes
1answer
371 views
Linux tools to choose suitable Cisco ASA 5500
I have a linux webhosting server which affects a high DDOS.
I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
10
votes
5answers
624 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
0
votes
4answers
439 views
What voip client support manual encryption?
In pidgin there is a plugin that we can use to encrypt our messages in chat windows .. Is there anything simular for voip (pc to pc) ? any client that support manual encryption for voice data?(linux)
4
votes
1answer
198 views
Can auditd track events that occured over NFS
I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X.
Server X has auditd enables with rule:
sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa
When events occur on Server X ...
-3
votes
2answers
112 views
how to protect a personal computer? [closed]
I am Linux user with no knowledge on security , up to now i dont know that is my system was in attack or not . I havent felt anything wrong with my system . but every Computer user must have some ...
4
votes
1answer
71 views
Testing a chroot environment for privilege escalation vulnerabilities
I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here?
I utilized the following packages:
RHEL6
...
3
votes
2answers
152 views
How likely is an infection with an outdated skype on linux? [closed]
Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:
deb http://download.skype.com/linux/repos/debian/ stable non-free
Doesn't have the new version, ...
4
votes
1answer
178 views
Are we under hacker control?
We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.
You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
3answers
162 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
6
votes
7answers
2k views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
4
votes
2answers
564 views
Security Concerns with X11 Forwarding
What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
7
votes
4answers
295 views
What would happen if one of the popular Linux repositories is hacked?
Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling.
What ...
1
vote
3answers
326 views
Danger of Path Traversal Attacks
I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him.
However, I want to understand what more can be done if ...
3
votes
1answer
2k views
what does it mean to be setuid root?
I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is SETUID root in UNIX (or has Administrator power in Windows). The ...
15
votes
3answers
453 views
If I have two identical linux virtual machine images, will they generate identical random numbers?
A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically?
Or maybe someone could direct me to a helpful research ...
4
votes
1answer
1k views
Benefits to ArchPwn over BackTrack
Besides BackTrack having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of ArchPwn over BackTrack?
Are the tools broadly the same, or does one have better ...
6
votes
4answers
1k views
What do I need to configure, to make sure my software uses /dev/urandom?
When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random?
Some servers don't have much entropy in the entropy pool ...
2
votes
3answers
714 views
Writing a sample virus (not harmful)
I don't know if such a question is allowed on this site, sorry if it's not
For educational purposes I am asked to write a small virus running on Linux, which should just be able to inject itself into ...
0
votes
1answer
254 views
Sending Commands using Hping3
I want to send my command to destination server.
I am using hping3. And;
hping3 -p 9999(running daemon and commands executing on this server) -S 127.0.0.1
I want to send my command. How to?
4
votes
2answers
589 views
environment variable accessibility in Linux
Perhaps this is a trivial question, but how accessible are environment variables in Linux between different users?
e.g. if Alice executes
export FAVORITE_FOOD=`cat /home/alice/fav_food.txt`
Can ...
2
votes
3answers
510 views
discover virus or spyware under Linux
I suspect to be the target of very skilled hackers.
5 or 6 years ago I found spyware on my Linux webserver, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 ...
0
votes
1answer
204 views
Looking for virus under Linux [closed]
if I am looking for a virus/spyware under linux, where should I have to look for to find it ?
I suspect to be the target of very skilled hackers.
5 or 6 years ago I found a spyware on my linux box, ...
3
votes
2answers
739 views
NSA RHEL5 Checklist
The NSA has came up with the "Guide to the Secure Conguration of
Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is ...
2
votes
2answers
366 views
Allow apache to write to users' .ssh dir's
I know the title is just baiting the "your setup is insecure", but allow me to explain.
I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web ...
-2
votes
3answers
1k views
Which tool (apart from nmap) can I use to scan a range of IPv6 addresses? [closed]
When I try to use nmap:
# nmap -sP -6 FE80::1-234
[...]
Failed to resolve given IPv6 hostname/IP: FE80::1-234. Note that you can't use '/mask' or '[1-4,7,100-]' style ranges for IPv6.[...]
What ...
1
vote
4answers
2k views
How To - Learn basic hacking skills? [closed]
I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start.
Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a ...
-1
votes
1answer
161 views
dm-crypt and change ask for password text [closed]
I use dm-crypt how can I change ask for password text:
"No key available with this passphrase."
this is store in libcryptsetup.so.1 probably:
# grep "No key" * -R
Binary file ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
2
votes
2answers
693 views
What are the best IT auditing guidelines for Red Hat Linux 5.x+, including the critical data protection?
Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own ...
4
votes
2answers
967 views
How to scan USB drive with clamav on Linux
Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
1
vote
0answers
120 views
Any suggestion for a good readerless smart card (security token) solution? [closed]
I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security ...
2
votes
2answers
122 views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
6
votes
6answers
2k views
Good file encryption tools
Could you please help me find a good file encryption tool? The target OS is Linux, but tools for Windows are welcome, too. FOSS tools are preferred. The tool must be reliable both for the recovery of ...
4
votes
2answers
240 views
Securing data on laptop's hdd
I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption?
I am mostly concerned about having my laptop lost or what ...
2
votes
2answers
388 views
up2date tools for security audit linux / centos
I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server.
There are a lot of non up2date tools out ...
1
vote
0answers
219 views
Unauthorised Perl Scripts [closed]
One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/domainexample.com/cgi-bin/ directory, I managed to stop ...
