Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

5
votes
2answers
883 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
5
votes
3answers
1k views

Increase security without using “dynamic” kernel modules?

I recently read that NOT using loadable kernel modules could increase security. In my interpretation this consist about recomplying the kernel with only built-in kernel modules. (how to disable ...
5
votes
4answers
791 views

Is Encrpyting Home Sufficient?

I currently have a fully encrypted Windows System, and I'm looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient? On windows this would be problematic due to ...
5
votes
1answer
177 views

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but ...
5
votes
3answers
861 views

Live Linux which does not mount any hard drive in the computer

I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer. I want to prevent any possiblity to write something on the hard drive of the computer and on ...
5
votes
2answers
97 views

Securely decommissioning a dedicated server

One of my dedicated hosting CentOS servers hit 12 years. I received an end-of-life notice on it, and I started receiving SMART errors as well. I guess it's time to let it go. But before I do, I'd like ...
5
votes
3answers
224 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
5
votes
2answers
2k views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
5
votes
2answers
2k views

Securing USB flash drive on linux

We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or ...
5
votes
2answers
11k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
5
votes
2answers
290 views

Securing data on laptop's hdd

I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption? I am mostly concerned about having my laptop lost or what ...
5
votes
1answer
1k views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
5
votes
1answer
2k views

How are shopkeepers getting the MAC address of wifi enabled smartphones?

It is clear that some big malls are tracking all the wifi-enabled mobile phones before they are connected to the network... How can this be done? I have a similar issue... how to get the MAC address ...
5
votes
3answers
914 views

Is it possible to USB whitelist in Linux?

After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux. Is there currently a mechanism that will allow ...
5
votes
2answers
229 views

You've just acquired a newly created CentOS server, what should you do to secure it?

I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?
5
votes
4answers
3k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
5
votes
2answers
74 views

Can malicious software be installed inside Linux swap partition?

Is it possible for a virus of any kind to be installed inside Linux swap partition? If so, could it be transferred to the system even after formatting the Linux partition only and reinstalling the OS ...
5
votes
1answer
630 views

Why is plain dm-crypt only recommended for experts?

I am curious about the following claim from the Cryptsetup FAQ: 2.4 What is the difference between "plain" and LUKS format? First, unless you happen to understand the cryptographic background ...
5
votes
2answers
387 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
5
votes
2answers
1k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
5
votes
3answers
1k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
5
votes
2answers
2k views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
2answers
86 views

SSH: Security of Pubkey Authentication vs Password

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and ...
5
votes
2answers
125 views

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...
5
votes
1answer
91 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
5
votes
1answer
7k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
5
votes
3answers
5k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
5
votes
2answers
84 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
5
votes
1answer
141 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
5
votes
1answer
137 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
5
votes
2answers
192 views

Four eyes authentication for command execution on Linux. (OS level) [closed]

I reached the end of the internet with no success, so now I turn to you guys. What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux. Example : The ...
5
votes
1answer
248 views

Explain the last part of how Mitnick hacked Tsutomu Shimomura with an IP sequence attack

I was reading up on why TCP ISNs need to be randomized, which led me to this write up by Tsutomu Shimomura. I understood how IP address spoofing and predicting the ISN helped the attacker establish a ...
5
votes
2answers
4k views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
5
votes
1answer
1k views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
5
votes
1answer
2k views

ARP-poisoning on wireless network - no packets

I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command: ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ ...
5
votes
1answer
147 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the ...
5
votes
1answer
134 views

My dlink router seems to be compromised

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 ) Just out of curiosity about what I would find, I tried to send some ...
5
votes
2answers
222 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
5
votes
2answers
215 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
5
votes
1answer
206 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
5
votes
1answer
531 views

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
5
votes
2answers
92 views

Is it possible become root through a broken symlink owned by root and globally writeable?

I'm looking for a vulnerability on a server. I'm looking in the /var directory and I get something like this: drwxr-xr-x 3 root root 4.0K Aug 14 21:02 kerberos drwxr-xr-x 12 root root 4.0K Nov 11 ...
5
votes
2answers
583 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
5
votes
1answer
238 views

Is symlink race a very common vulnerability in UNIX systems

As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself ...
5
votes
1answer
1k views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
4
votes
3answers
4k views

Is Linux spying on its users? [closed]

If you install some kind of Linux distributions on your computer, is their a possibility that their owners may spy on you? For example, can Ubuntu, Kali or Arch linux send data to its owners on what ...
4
votes
2answers
12k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
4
votes
2answers
264 views

How secure is BSD sockets?

BSD sockets API was released in 1983. As it was implemented 3 decades ago and still being widely used, is it secure in today's scenario where every software has to be actively protected against ...
4
votes
3answers
1k views

Pseudo Random Generator is not initialized from the (entropy pool)?

The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block. But when ...
4
votes
3answers
135 views

Specific Dangers in Joining a Linux Botnet?

Between the PHP-as-cgi-bin problem, and shellshock, I've seen 4 or 5 different Perl scripts that, when run, purport to make your machine part of some scary, heinous botnet. What, specifically, would ...