Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

7
votes
2answers
323 views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
11
votes
2answers
1k views

RdRand from /dev/random

"Linus Torvalds, in response to a petition on Change.org to remove RdRand from /dev/random, has lambasted the petitioner by called him ignorant for not understanding the code in Linux Kernel. ...
6
votes
2answers
690 views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
0
votes
3answers
819 views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
-1
votes
1answer
225 views

If someone downloaded 600GB , can that be ddos attack [duplicate]

Last night some one exploit some vulnerability in my site and then upload php script in my images folder . I have the Amazon EC2 server with centos. Now the Hacker downloaded 600GB and increased my ...
0
votes
1answer
925 views

Using Volatility Framework with Linux memory dumps

I am using Volatility Framework 2.2 to anlayze a Linux memory dump. This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23 I have the profile for it and ...
15
votes
3answers
816 views

Why doesn't Linux randomize the address of the executable code segment?

I've recently been learning about how ASLR (address space randomization) works on Linux. At least on Fedora and Red Hat Enterprise Linux, there are two kinds of executable programs: Position ...
1
vote
1answer
293 views

How to authenticate to racoon with a certificate chain if only the root CA is known

I'm trying to setup IPsec using x509 certificates on Linux. I'm using racoon for that task. I've come to the point where the authentication works fine if I keep every link of the certificate chain on ...
5
votes
4answers
288 views

Is Encrpyting Home Sufficient?

I currently have a fully encrypted Windows System, and I'm looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient? On windows this would be problematic due to ...
0
votes
1answer
251 views

Would adding root to a group open a security hole?

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...
-4
votes
2answers
9k views

Why do some people think Linux is more secure than Windows? [duplicate]

I have no idea if Linux is more secure than windows. I think Linux is more secure but I want to know what is going at kernel level. Somebody told me that Linux have only one main kernel and has it ...
10
votes
2answers
1k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
2
votes
0answers
90 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
0
votes
3answers
1k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
2
votes
1answer
188 views

Preventing access to file for process running as root

I have a client with a legacy application running on RH 3 (=the latest version supported by app). There is a process that has to run as root (and not in a chroot environment). I need to prevent this ...
0
votes
2answers
207 views

Danger in opening spam emails on Ubuntu operating system [closed]

Some emails are suspected to be viruses; Because of that, the email service store categorizes them as spam. Or some pages are suspected to be viruses, and new browsers classify them as harmful pages. ...
0
votes
1answer
112 views

What risk does EC2/Ubuntu User-Data pose

The cloud-init Ubuntu package accepts something called user-data to configure a machine in the cloud (eg EC2 on AWS). I think AWS also use this for their Amazon Machine Image. My question is. What ...
6
votes
2answers
425 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" ...
4
votes
0answers
131 views

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down ...
3
votes
1answer
128 views

SNMPv2 and Community Security

When working with servers on the internet and doing monitoring is there any dangers using SNMPv2? I am working with observium and have the following: /etc/snmpd.conf com2sec readonly default ...
2
votes
4answers
155 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
3
votes
2answers
647 views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
5
votes
2answers
4k views

Ubuntu LVM Encryption

I recently installed Kubuntu and I noticed the option for having an encrypted LVM. The behavior suggests it's full disk encryption since I need to put in a password before I can boot. This article and ...
3
votes
1answer
811 views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
0
votes
1answer
600 views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
25
votes
6answers
3k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
-5
votes
4answers
502 views

How can I use linux and disguise myself as a windows computer over a LAN? [closed]

My computer is currently running windows XP on a LAN Network. I'd like to use linux but I want to hide myself. I don't want to be the only linux system on a network full of windows XP computers. Is ...
1
vote
1answer
246 views

Small encrypted network setup [closed]

Several partners and I have just started a small business and we would like to employ a good secure setup from day one. This is a problem however as there are many piecemeal packages, and I am stuck ...
2
votes
2answers
545 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
1
vote
2answers
512 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
-1
votes
1answer
391 views

mprotect at kernel level

What would happen if a kernel-level process sets some of its memory pages as PROT_NONE with mprotect and another kernel-level process tries to read one of these protected pages? What is the ...
2
votes
3answers
326 views

Encrypting Backups on Linux

I'm working on an automated backup solution to protect my files on my Linux servers. However, I'm not sure about how to securely encrypt the resulting archives. I am using 64bit linux, and I am ...
2
votes
2answers
710 views

How to protect Linux partition from access from Windows partition?

In a dual-boot environment (windows? and linux mint 15) What would be best best way to prevent access to the linux partition(s) when the system is booted into windows 7? The goal would be to ...
1
vote
5answers
1k views

Encrypt-function inside PHP code that you have to publish

If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include ...
2
votes
2answers
460 views

Mixing stateless and stateful firewall rules

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this? Take the following two rule sets ...
5
votes
1answer
611 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
3
votes
3answers
272 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
2
votes
1answer
99 views

DBus proxy Javascript binding issues

Recent Gnome-3 (under GNU/Linux, BSD or other Un*x) offer a gnome shell with nice presentation, but where the configuration and theming are to be done via Internet Browser (and a public URL, on a ...
1
vote
1answer
328 views

Files to monitor in linux

All, I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit. so far i ...
4
votes
2answers
752 views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
3
votes
4answers
589 views

does switching to linux remove existing computer virus

if you change from a malware/spyware infected windows setup to a linux setup will infections migrate to linux if they were on the computer? (when you are hacked/infected is it the op system that is ...
2
votes
1answer
216 views

How are IaaS Virtual Machines Isolated?

I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
1
vote
2answers
1k views

Is user password in ubuntu 13.04 in plain text?

Is it stored in plain text or not? Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?
-1
votes
2answers
168 views

my websites got infected with a malware i cannot get any info on [closed]

we have a server, on which we host about 30 sites. these are test sites for our customers. most of them are not even indexed by google. some run on php, some on nodejs, some on ruby. all of them that ...
2
votes
2answers
255 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
5
votes
3answers
331 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
2
votes
1answer
192 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
3
votes
2answers
3k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
3
votes
1answer
115 views

What about AD2P vulnerability?

My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter. My question is, how secure is the audio(in my case voice) being ...
4
votes
2answers
522 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...