Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
2answers
38 views

How can we know which debian package correct which CVE

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance : ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
1
vote
1answer
254 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
1
vote
4answers
116 views

Why can't just any program use his own file-system-access-system?

This may sound stupid for everyone who knows more than me about the UNIX-System and security in software: Imagine you have a program trying to cause harm by deleting files. You just do something like ...
0
votes
2answers
159 views

Malware getting root access via “sudo” and “sudo -s”

Actually, I'd like to ask 3 questions. But since they are very related, I'll ask them all here. I use Ubuntu 12.04.4. Situation 1: I use Terminator, in one of its terminals I launch sudo iotop ...
0
votes
1answer
107 views

Do the Linux binary blobs contain any intentional security holes?

This question covers the risks of accepting Binary blobs in one's distribution. This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
2
votes
2answers
355 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
1
vote
1answer
195 views

how to protect my linux pc from wifi sniffing

I have a wifi shared connection with other flatmates and I'd like to know how can I protect my Debian pc from being sniffed. Should I use a wifi anti sniffer to detect if any wifi card is in ...
1
vote
1answer
66 views

How can I view the contents of a web page without running malicious code? [closed]

I received a strange email which has some strange URL in it. I would like to know what is "behind" the url, but without the risk of running anything malicious. How can see the contents of the URL, ...
3
votes
3answers
289 views

Protecting against Firewire DMA vulnerabilities in Linux

I know there have been questions on this in the past but they all seem quite outdated, or not that specifically relevant. I need to use a 1394(Firewire) connection, however am concerned with possible ...
4
votes
2answers
209 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
1
vote
1answer
232 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
2
votes
0answers
919 views

What is a self-contained cross-platform encryption for USB drive? [closed]

I'm trying to find self-contained encryption solution for USB drives while at the same time being platform independent. For example, Windows' BitLocker only works on Windows and not on OS X or Linux. ...
1
vote
1answer
72 views

What are good ways to check for tampering/bad behaviour on a linux server that has already been set up but it's your first time logging into it

For this I am assuming we have a server that is of a client or a friend, so we the helper are not innately familiar with exactly how things should be be. What are good commands and ways to check to ...
1
vote
1answer
141 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
0
votes
2answers
207 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
20
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
2
votes
1answer
229 views

How to measure the integrity of the OS (Linux)?

I am working on a project which requires Integrity measurement of OS (Linux). One way to do that is using IMA but I am not sure if it fits in the scenario below. The scenario of the project is some ...
1
vote
2answers
91 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
1
vote
3answers
163 views

Cracking passwords after a patteren with ex. John

So i am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a patteren. ...
15
votes
1answer
451 views

Keyboard firmware hack - Linux vulnerable?

I see that Apple patched OS X to mitigate against K. Chen's famous Apple keyboard firmware hack. However: Apple keyboards can be used with computers running other operating systems; and in any ...
3
votes
0answers
99 views

Deny Skype video access in Linux? [closed]

I have noticed that despite having configured Skype to not access video, during startups it continues to access the webcam momentarily. Skype is not a user, so I am unsure how to modify its ...
0
votes
1answer
207 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
2
votes
1answer
244 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
2
votes
1answer
121 views

Should the root Unix user have a shell?

I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible. With this ...
1
vote
3answers
370 views

Best practice for accessing management port of firewall

I'm in the process of setting up a bunch of servers at the other end of the world (well, 8 hours travel time) in a co-location place. The servers and firewall all have a remote management port (KVM, ...
0
votes
1answer
233 views

Read-Only USB thumb as Linux boot encryption authentication [closed]

I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me ...
1
vote
1answer
289 views

Installing Joomla with nobody:nobody user/group (CentOS/cPanel)

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user ...
0
votes
3answers
217 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
1
vote
2answers
208 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
2
votes
1answer
194 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
0
votes
3answers
1k views

What is the hack attempt going on when I see: did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

When I look at my sendmail logs, by far the most common "error" I see is the following: Nov 22 16:49:50 MyHostname sendmail[18832]: rAMMnj2u018832: [IP address redacted to hide the guilty] did not ...
-3
votes
2answers
22k views

backtrack or kali linux ??? Which is best for a beginner pen tester ? [closed]

I am using backtrack right now but i also wish to switch to kali linux if its more interactive. Because i am just a beginner pen tester. I tried with both bt4 and bt5, but novice in kali linux.
11
votes
4answers
2k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
0
votes
1answer
107 views

Strange Virus Infecting My Server

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind. When I access some domains on that server (every ...
2
votes
3answers
1k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
1
vote
0answers
100 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
3
votes
2answers
297 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
0
votes
1answer
203 views

Fishy: VMware sends all traffic through akamai

I'm running Linux inside of VMware on the Mac, and on Linux I'm running a program that has connections open to perhaps 4 different machines. On the OS/X side however VMware has only 1 active network ...
0
votes
1answer
410 views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
7
votes
2answers
211 views

What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?

Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says: Oh, and don’t display filenames. Filenames could contain control ...
6
votes
4answers
577 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
0
votes
2answers
419 views

Disabling SMEP on x86_64

I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer ...
43
votes
5answers
3k views

What does Mark Shuttleworth mean by “we have root”?

In a blog post in response to the Amazon privacy controversy, Mark Shuttleworth wrote: Don’t trust us? Erm, we have root. You do trust us with your data already. You trust us not to screw up on ...
4
votes
3answers
157 views

How can you know what is distributed with your Linux

I'm curious, in theory, how can one know if for example kernel that is distributed with Ubuntu Linux is really what is on https://github.com/torvalds/linux and not some modified kernel which contains ...
16
votes
7answers
1k views

Defence Against Keyboard Keylogger

I am wondering whether there is a way to defend against USB Keyboard Keylogger (obviously other than physically checking the keyboard every time after leaving my computer unattended). These days, ...
0
votes
1answer
481 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
6
votes
4answers
1k views

Security of the KWallet password encrypting application?

According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt. The key ...
-1
votes
2answers
145 views

Linux: Blocking outside attempts at attacking computer

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: ...