Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

4
votes
2answers
310 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
4
votes
1answer
245 views

Are we under hacker control?

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites. You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
2answers
135 views

Can my /boot be compromised if I Suspend my notebook?

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel! Or if someone tries (evil maid) to modify the /boot then ...
4
votes
2answers
245 views

What does a MCSE need to learn to be proficient regarding *nix security?

I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago. What ...
4
votes
2answers
593 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
1answer
585 views

Can auditd track events that occured over NFS

I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X. Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa When events occur on Server X ...
4
votes
1answer
818 views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
4
votes
2answers
126 views

Why was LibreSSL PRNG unsafe on Linux?

From the source: https://www.agwa.name/blog/post/libressls_prng_is_unsafe_on_linux The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite ...
4
votes
1answer
192 views

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
4
votes
3answers
252 views

What would the cryptographic impact be of knowing the output of /dev/urandom?

Another noob question, I know, but something I'm unsure about. If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
4
votes
2answers
431 views

How to improve VPS security?

I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
4
votes
2answers
696 views

What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?

Right now the internet is abuzz with news about a severe breach in GnuTLS. An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
4
votes
0answers
56 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
4
votes
3answers
1k views

Wrapping system call (in reliable and secure way)

It there reliable method of "wrapping" system calls under Linux ? (Like LD_PRELOAD for wrapping shared library function calls.) Is there reliable, secure method of "wrapping" system calls (and, maybe ...
3
votes
4answers
681 views

does switching to linux remove existing computer virus

if you change from a malware/spyware infected windows setup to a linux setup will infections migrate to linux if they were on the computer? (when you are hacked/infected is it the op system that is ...
3
votes
3answers
748 views

Online security check via command line

My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential ...
3
votes
3answers
330 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
3
votes
3answers
3k views

Besides OpenVas and Nessus, what are my other options for vulnerability detection?

I know of Nessus (which is $1300 for a pro feed) and OpenVAS (which I don't like). I use Linux so do I have any other options for vulnerability detection?
3
votes
5answers
2k views

Secure mount options + partitioning on Ubuntu

What is the best solution for mount options/partitioning when having e.g.: an Ubuntu minimal install (11.04) for Desktop use? e.g.: put /tmp on different partition to give it mount options like: ...
3
votes
1answer
1k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
3
votes
3answers
273 views

Why should every file have a user and a group?

I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
3
votes
3answers
2k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
3
votes
1answer
521 views

Enterprise Anti-virus for Linux?

I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud ...
3
votes
3answers
122 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
3
votes
2answers
5k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
3
votes
5answers
406 views

Blocking network access to host(s) at the kernel level in Linux?

Getting it out of the way: Not iptables! What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could ...
3
votes
2answers
1k views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...
3
votes
2answers
275 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
3
votes
3answers
2k views

Alternative to AirPcap for Linux?

I need to sniff WiFi packets, but according to AirPcap FAQ page, it just supports Microsoft Windows, not other platforms. Does any alternative of this product work in Linux? Please don't offer Alfa ...
3
votes
3answers
1k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
3
votes
4answers
2k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
766 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
3
votes
3answers
2k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
3
votes
2answers
340 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
3
votes
2answers
862 views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
3
votes
3answers
961 views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
3
votes
2answers
371 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
3
votes
2answers
242 views

How likely is an infection with an outdated skype on linux? [closed]

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook: deb http://download.skype.com/linux/repos/debian/ stable non-free Doesn't have the new version, ...
3
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
3
votes
4answers
172 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
3
votes
2answers
78 views

Do `sudo` and `su` belong to capability-based security?

In Linux, do sudo and su belong to Capability-based security ? For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
3
votes
2answers
384 views

any reason not to run tmux/wemux on a bastion host?

Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
3
votes
2answers
895 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
3
votes
3answers
542 views

Truecrypt Plausible Deniability - Linux

As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
3
votes
1answer
182 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
3
votes
3answers
200 views

Protect partition from formatting

How can i protect my Linux and Windows partitions from being wiped,from a windows installation CD,with password?
3
votes
2answers
118 views

security via chsh

I am developing a program that I want people to be able to connect to and use via ssh. I've decided a simple way of doing this would be to create an account for them on my linux server, and change ...
3
votes
1answer
463 views

How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?

Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...