Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

3
votes
2answers
141 views

Is using Chrome and Tor Browser at the same time secure?

I question this recently because as I was using the Tor Browser, while in the same time my Google-Chrome was opened, and I right-clicked on a word to search it in 'Disconect', when the page loaded I ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent ...
1
vote
0answers
48 views

Under which circumstances is the default security profile of XRDP considered okay?

In xrdp.ini, the base install of xrdp on my raspberry pi*, there I have the following below. I changed crypt_level to high. [globals] bitmap_cache=yes bitmap_compression=yes port=3389 ...
0
votes
1answer
59 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
11
votes
7answers
1k views

How are open-sourced operating systems and software kept secure?

I have been wondering about his for awhile. I have Linux running on a PC at home. I had a jailbroken iPhone. They both have attributes that make them very attractive, and they are also FREE! But I ...
5
votes
1answer
165 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
3
votes
1answer
45 views

Prevent snapshots of VPS

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; ...
3
votes
2answers
177 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
2
votes
1answer
111 views

Linux antivirus and files bigger then 4GB

I wish to scan files that are bigger then 4GB. For example video files. I noticed many antivirus software are limited to a maximum of 4GB (ClamAV for example). So: Is there a antivirus software ...
4
votes
1answer
45 views

Is protecting a parent folder secure enough to protect files within that folder?

So this topic came up during a hardening exercise on Unix/Linux machines where a parent folder was marked with chmod 740 but files within that folder were marked chmod 644, and the argument went that ...
-1
votes
1answer
99 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
0
votes
2answers
96 views

Is there a tool to detect what technologies a website uses? [closed]

I'm looking for the name of a tool I've used a long time ago, that for a given URL/website address would extract the technologies used for that site. For example that the site is running Apache, using ...
1
vote
2answers
95 views

Ettercap Remote Poisoning

I have a question about one parameter and that's it. When I'm doing DNS spoofing I have to use arp:remote. Can someone explain to me what arp:remote means? I read the man page, but did not ...
-4
votes
1answer
66 views

Hydra saying cracking done and displaying random passwords

I have Hydra on my Linux machine. I want to test cracking security with Hydra on SMTP but I get no success. After about 20 messages that SMTP mechanism and a random message like [465][smtp] host: ...
2
votes
1answer
191 views

Can a root user inside a Docker/LXC break the security of the whole system?

My question is probably more about the LXC than about Docker, but I wonder what are the security mechanisms to prevent a root user inside a Docker image to access the whole host. More precisely, I ...
3
votes
3answers
211 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
0
votes
0answers
8 views

How to prevent future attacks from Trojan.Agent.Linux.A? [duplicate]

One of our servers was just infected by Trojan.Agent.Linux.A (see https://www.virustotal.com/en/file/ca22002822b27562971b1b12bfd61f2f670554ebdb0907270fda4a65f7fd2eed/analysis/1448647113/). I am ...
-1
votes
2answers
178 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
3
votes
4answers
231 views

How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it ...
1
vote
2answers
501 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
7
votes
2answers
290 views

Prevent ARP spoofing with dynamic static entry on Linux

ARP spoofing detection/prevention seems to be quite popular here. With other techniques like port stealing aside, I'm wondering if the following could work to prevent it: Whenever my Linux ...
0
votes
2answers
10k views

Hydra https-form-post [closed]

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
1
vote
1answer
534 views

ClamAV Flagging application .swf files as malware

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). ...
-2
votes
1answer
75 views

Use the Shellshock vulnerability to get a root console as a normal user [closed]

Owner is root and also made a Set-UID for the following code snippet: # include <stdio .h> void main () { setuid ( geteuid ()); system ("/ bin/ls -l"); } How might the Shellshock ...
1
vote
1answer
7k views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
12
votes
4answers
1k views

When using multiple operating systems, can they affect each other?

Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it ...
31
votes
6answers
14k views

How to prevent BadUSB attacks on Linux desktop?

What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here? Perhaps writing an appropriate AppArmor profile would help?
1
vote
2answers
184 views

Open Source OS - code you see vs code you get

In this question I will use the example of Linux OS, but I am also interested in general situation. Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
-2
votes
1answer
95 views

Honeypot used as as a proxy?

I'm running Kali Linux on my system at home to practice pentesting. If I implement a honeypot on my system could it be possible to use that as some sort of proxy server? I was thinking it wouldn't be ...
15
votes
8answers
4k views

Why is it possible for the root user to delete the logs?

I always thought the greatest benefit of the logs is to confirm to you that your machine has been hacked. However I see hackers bragging about "rooting" servers all over the Internet. Whats stopping a ...
2
votes
1answer
87 views

Give only execute permissions to a Linux binary (prevent inspection)?

I'm writing an assignment for a security course, and I'm trying to create an executable which students can interact with (ie, execute), but not inspect. In particular what I'd like is for them to be ...
1
vote
2answers
277 views

Validating security log configuration (rsyslog and syslog-ng) for PCI DSS 10.5

I work for a Level 1 merchant with annual onsite QSA audits, so this is a huge deal. PCI DSS 10.5 requires the entity under test to "Secure audit trails so they cannot be altered". In our Unix and ...
2
votes
1answer
48 views

Running rkhunter on Linux

Currently each time before an application and after an application is either installed or updated including regular patches, the command rkhunter --propupd is run, followed by the command rkhunter ...
1
vote
1answer
75 views

Debian 8 and few questions about Graphical Firewall?

I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up. ...
2
votes
3answers
122 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
6
votes
2answers
301 views

Does the new Fedora package manager allow unauthorized installations?

I just upgraded to Fedora 22. The biggest change from the previous version is that the yum package manager is now replaced with dnf. One change I've noticed is that if you try to execute a command ...
11
votes
3answers
5k views

Are there ransomware infections of Ubuntu Linux in the wild?

Due to the recent media coverage of ransomware attacks several people for whom I've provided personal computer support in the past have expressed concerned. The majority of these people are running ...
5
votes
2answers
366 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
-4
votes
3answers
554 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
6
votes
3answers
1k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
1
vote
1answer
108 views

Automate certificate signing in Linux

In a private network I wish to automate signing for new clients/servers. Something like this: New client is created (dockers & etc) The client create a new private key and a CSR The client send ...
2
votes
1answer
81 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
1answer
140 views

Do major linux distributions differ with regard to releasing security patches? [closed]

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this ...
4
votes
1answer
105 views

RSA fingerprint automatic change or have I been hacked?

today I tried to connect to my Digital Ocean VPS through Putty(kitty) as usual, but I got the message that the server's cached fingerprint had changed, and that it could be a security compromise. I ...
-1
votes
1answer
44 views

SSLStrip with autologin [closed]

What can I do to sniff the traffic by SSLStrip when the user has automatic login to the site?
1
vote
2answers
168 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
1
vote
1answer
48 views

What is the risk of data being recovered from SAN storage after logical deletion?

The specific scenario involves Linux servers on VMware hosts with SAN storage. If files containing sensitive data are deleted by Linux, can they be recovered by a low level tool similar to what might ...
2
votes
0answers
52 views

What is the security value of chattr +s?

Most modern Linux file systems support extended attributes. +s is secure deletion which ensures (at least intends) that the data in a file is overwritten with zeros when the file is deleted. Some ...
2
votes
0answers
52 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using ...
2
votes
1answer
470 views

Man in the middle attack, bridging wlan interface to virtual wired interface at0

I'm trying to execute a Man in the Middle attack on my mobile phone, I have two wireless cards, one inbuilt in the laptop, running AR9285 atheros drivers, the 2nd is an Alfa AWUS036NHA card with an ...