Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

8
votes
2answers
7k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
8
votes
5answers
1k views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
8
votes
2answers
192 views

Why does Android use SELinux?

To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them ...
8
votes
1answer
859 views

What does this attempted Shellshock exploit do, and has my website been compromised?

I grepped my Apache's access.log today for the now infamous () { string, and besides a bunch of what seemed like pings to check how many servers are vulnerable, I found this attempt, which looked like ...
8
votes
1answer
1k views

Linux wireless hacking book

I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
8
votes
1answer
467 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
8
votes
2answers
495 views

Why was LibreSSL PRNG unsafe on Linux?

From the article LibreSSL's PRNG is Unsafe on Linux. The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite the 2.0.x version numbers, ...
8
votes
2answers
380 views

In Linux, when I consider trusting a new software source, what do I need to evaluate?

When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software ...
7
votes
2answers
3k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
7
votes
7answers
4k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
7
votes
4answers
682 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
7
votes
4answers
1k views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
7
votes
2answers
16k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
7
votes
2answers
829 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
7
votes
2answers
518 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
7
votes
2answers
918 views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
7
votes
2answers
2k views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
7
votes
2answers
7k views

How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use. -...
7
votes
1answer
3k views

Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]

Background I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug. I ...
7
votes
1answer
99 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
7
votes
2answers
261 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
7
votes
2answers
442 views

List all files with only arbitrary file path read, but no directory listing nor sudo

I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo. To fully exploit this, I would like to know which files exist in each directory ...
7
votes
2answers
1k views

Does KASLR really provide more security against exploits?

I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with ...
7
votes
3answers
4k views

How to sandbox Iceweasel (Firefox) on Debian? [closed]

Are there any tools for sandboxing Iceweasel (Firefox) on Debian systems? I'm mostly interested in tools distributed by Debian. (An equally trustworthy source would be second best.) (I suppose that ...
7
votes
2answers
645 views

Process authentication for Linux

Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one? I know that an Linux operating system is only that secure like the way you use it. ...
7
votes
2answers
2k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
7
votes
2answers
188 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
7
votes
2answers
274 views

What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?

Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says: Oh, and don’t display filenames. Filenames could contain control ...
7
votes
2answers
338 views

Prevent ARP spoofing with dynamic static entry on Linux

ARP spoofing detection/prevention seems to be quite popular here. With other techniques like port stealing aside, I'm wondering if the following could work to prevent it: Whenever my Linux ...
6
votes
7answers
8k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
6
votes
3answers
1k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
6
votes
4answers
626 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
6
votes
3answers
621 views

Appropriate defense for 404s in my logs - persistent web scans from one region

This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I don'...
6
votes
3answers
9k views

What key does Linux use when storing user passwords?

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow. Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
6
votes
3answers
3k views

Privilege Escalation Ubuntu

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
6
votes
2answers
6k views

Security of Linux Full Disk Encryption (Ubuntu / Mint) -insecure?

I'm wondering, why is Ubuntu and Mint using SHA1 for Full Disk Encryption? I heard several times that SHA1 shouldn't be used anymore because it is weak and it could be cracked. Could you guys ...
6
votes
2answers
2k views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
6
votes
2answers
974 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" "\x5d\...
6
votes
2answers
13k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
6
votes
3answers
971 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
6
votes
5answers
246 views

VPN with client certificate via managed PKI - where did private key come from?

$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to ...
6
votes
1answer
266 views

How is using acces() opening a security hole?

The man page for access(2) tells : Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the ...
6
votes
3answers
562 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
6
votes
4answers
445 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
6
votes
2answers
585 views

How often is ASLR randomness refreshed, in Linux?

Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
6
votes
3answers
2k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
6
votes
2answers
182 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
6
votes
4answers
1k views

Is it possible to USB whitelist in Linux?

After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux. Is there currently a mechanism that will allow ...
6
votes
3answers
7k views

How to scan USB drive with clamav on Linux

Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?