Securing Linux systems and applications; understanding Linux security features.
3
votes
1answer
123 views
Amavisd-New and Google safe browsing
I am studying the Google Safe Browsing.
How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing?
Do ...
3
votes
2answers
739 views
NSA RHEL5 Checklist
The NSA has came up with the "Guide to the Secure Conguration of
Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is ...
3
votes
2answers
242 views
Security for home server, wiki
I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
3
votes
2answers
214 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
1answer
323 views
Why ESTABLISHED,RELATED for INPUT only?
In many places and tutorials I see people add this line to their iptables:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
And they do it only and only for "INPUT". What about OUTPUT and ...
3
votes
1answer
793 views
ARP-poisoning on wireless network - no packets
I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command:
ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ ...
3
votes
1answer
344 views
Two questions about learning Linux exploit development fundamentals
getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information.
First, I plan on reading "Understanding the Linux ...
3
votes
1answer
392 views
Firewall rules to block unwanted protocols on given ports
Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?:
i only want to allow these connections [on the output chain]:
on port 53 output only allow udp - dns
on ...
3
votes
2answers
117 views
Safely remove an expired PGP key file
since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
3
votes
1answer
190 views
What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
Obvious things:
Disable root login (rather, don't enable it)
Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
IP Tables firewall whitelisting ...
3
votes
1answer
78 views
Do public keys make Kerberos more secure (RFC4556)?
We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556.
From my ...
3
votes
1answer
195 views
How to forward an specific FTP User to a Honeypot?
What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
3
votes
2answers
139 views
How do shared hosts protect different sites?
I host all my websites from a single Linode VPN, and am about to sell some limited space of my Linode to a friend to host their new blog (it's going to be a simple wordpress blog).
It'll simply be ...
3
votes
0answers
82 views
Apparmor policies w/ subprocess failing [closed]
Can anyone possibly explain why Apparmor is not picking up profiles for sub-processes of a process? Right now we use God to launch an unstoppable Ruby process (in this case it's /usr/local/bin/remote) ...
2
votes
3answers
984 views
Privilege Escalation Ubuntu
I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
2
votes
2answers
121 views
vulnerable getlogin
I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin).
I fail to understand the attack vector ...
2
votes
3answers
483 views
Disable Perl for some/most Linux users?
One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
2
votes
2answers
534 views
Need advice on linux server being hacked
I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
2
votes
2answers
180 views
Can the `system` function pose severe security threats on a shared hosting server?
I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects.
So I created a ticket and asked them to enable it. This is what ...
2
votes
3answers
510 views
discover virus or spyware under Linux
I suspect to be the target of very skilled hackers.
5 or 6 years ago I found spyware on my Linux webserver, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 ...
2
votes
1answer
100 views
Trust linux images burned from untrusted systems
For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack.
I've downloaded some linux images and burned them to do a re-install.
Since I can't ...
2
votes
2answers
201 views
Possible implementations of networked+encrypted filesystem
Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
2
votes
2answers
365 views
Allow apache to write to users' .ssh dir's
I know the title is just baiting the "your setup is insecure", but allow me to explain.
I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web ...
2
votes
2answers
389 views
Securing a Ubuntu system on Amazon Web Services
I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following:
A relatively simple Java-based website (using the Noir framework)
A Java-based ...
2
votes
3answers
101 views
Could an Encrypted VG/Image compromised?
I mean if I encrypt my ""full system"" so that everything (besides the /boot) is in an encrypted VolumeGroup (Linux).
So I store my /boot on a flash drive, thats always next to me.
Q: can the ...
2
votes
2answers
79 views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
2
votes
2answers
150 views
How likely is an infection with an outdated skype on linux? [closed]
Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:
deb http://download.skype.com/linux/repos/debian/ stable non-free
Doesn't have the new version, ...
2
votes
2answers
110 views
Is it possible to boot into root's /bin/bash on a LUKS encrypted device?
I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters.
I'd like ...
2
votes
3answers
374 views
Truecrypt Plausible Deniability - Linux
As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
2
votes
3answers
823 views
Open Source Vulnerability Scanner
I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
2
votes
1answer
115 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
2
votes
5answers
448 views
Security purpose of asking admin password to mount partition on Linux
So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
2answers
386 views
up2date tools for security audit linux / centos
I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server.
There are a lot of non up2date tools out ...
2
votes
3answers
708 views
Writing a sample virus (not harmful)
I don't know if such a question is allowed on this site, sorry if it's not
For educational purposes I am asked to write a small virus running on Linux, which should just be able to inject itself into ...
2
votes
1answer
111 views
What is the actual value of disabling remote root login using ssh?
I have read the answers regarding why you should disable remote root login, but there is something nagging me. Assume this:
Scenario 1:
Remote server A.
Remote root login disabled.
Password ...
2
votes
2answers
172 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
2
votes
1answer
278 views
NFS and encrypted File systems
Can a NFS mounted file system be used for encrypted /home, and can the encrypted Home Directories be mounted/decrypted for the user when they login?
2
votes
1answer
77 views
tshark - dump the data section
As the name suggests, im trying to dump the data section of the packet,
man would suggest that its something like tshark -r file.pcap -t fields but im not having any luck
2
votes
1answer
115 views
Why must VMX instructions trap?
What would happen if each of these instructions didn't trap into VMX root when executed in VMX non-root?
INVEPT, INVVPID, VMCALL,VMCLEAR, VMLAUNCH, VMPTRLD, VMPTRST, VMREAD, VMRESUME, VMWRITE, ...
2
votes
2answers
691 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
2
votes
2answers
857 views
Issues with preserving $HOME on sudo
On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...
2
votes
1answer
185 views
Windows 8 in a VDI environment and the use of Secure Boot
I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
2
votes
2answers
416 views
Skype security (linux)?
From the following article skype & from archlinux skype wiki some major skype insecurity in linux are:
The skype binary is disguised against decompiling, so nobody is (still) able to reproduce ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
2
votes
2answers
688 views
What are the best IT auditing guidelines for Red Hat Linux 5.x+, including the critical data protection?
Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own ...
2
votes
1answer
336 views
Victim system's internet connection slow after ARP spoof?
I've been using Nemesis 1.4 to test ARP spoofing on a local victim machine. I've been spoofing both the victim machine and the default gateway to ARP redirect to my machine.
Spoofing victim's source ...
2
votes
1answer
228 views
Using mysql root account to execute root commands
Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
2
votes
2answers
33 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
2
votes
1answer
75 views
Force all user processes to be ptraced
I'm implementing a ptrace based tool for logging system call use. It is much more simple than strace, but I'm doing this so I can learn how these tools work. I'd like to trace all user processes since ...
