Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

3
votes
3answers
2k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
3
votes
1answer
313 views

Enterprise Anti-virus for Linux?

I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud ...
3
votes
3answers
121 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
3
votes
5answers
352 views

Blocking network access to host(s) at the kernel level in Linux?

Getting it out of the way: Not iptables! What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could ...
3
votes
2answers
992 views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...
3
votes
2answers
3k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
3
votes
2answers
253 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
3
votes
3answers
878 views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
3
votes
4answers
2k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
738 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
3
votes
2answers
297 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
3
votes
2answers
682 views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
3
votes
2answers
762 views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
3
votes
3answers
859 views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
3
votes
4answers
436 views

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
3
votes
2answers
326 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
3
votes
2answers
232 views

How likely is an infection with an outdated skype on linux? [closed]

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook: deb http://download.skype.com/linux/repos/debian/ stable non-free Doesn't have the new version, ...
3
votes
2answers
1k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
3
votes
2answers
24 views

Do `sudo` and `su` belong to capability-based security?

In Linux, do sudo and su belong to Capability-based security ? For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
3
votes
2answers
340 views

any reason not to run tmux/wemux on a bastion host?

Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
3
votes
2answers
793 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
3answers
533 views

Truecrypt Plausible Deniability - Linux

As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
3
votes
1answer
176 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
3
votes
3answers
125 views

Protect partition from formatting

How can i protect my Linux and Windows partitions from being wiped,from a windows installation CD,with password?
3
votes
2answers
112 views

security via chsh

I am developing a program that I want people to be able to connect to and use via ssh. I've decided a simple way of doing this would be to create an account for them on my linux server, and change ...
3
votes
1answer
375 views

How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?

Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
3
votes
1answer
81 views

auditing mod security rule sets

Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold? I know with fire fox I can ...
3
votes
2answers
2k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
3
votes
2answers
387 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
3
votes
1answer
1k views

Best method to sandbox X applications in ubuntu

What's the best way to sandbox an X application like firefox or thunderbird in ubuntu (going into the direction of what qubes os does, but only for single applications)? I know there are many ...
3
votes
4answers
187 views

One computer with multiple OSs in different drives

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really ...
3
votes
1answer
156 views

Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?

If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...
3
votes
2answers
897 views

Alternatives to SELinux and AppArmor?

With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on ...
3
votes
1answer
203 views

“WICKED” entries in the default nginx vhost's logs

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs: 109.x.x.121 - - ...
3
votes
2answers
1k views

What are the best IT auditing guidelines for Red Hat Linux 5.x+, including the critical data protection?

Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own ...
3
votes
1answer
1k views

ARP-poisoning on wireless network - no packets

I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command: ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ ...
3
votes
1answer
510 views

Two questions about learning Linux exploit development fundamentals

getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information. First, I plan on reading "Understanding the Linux ...
3
votes
1answer
749 views

Firewall rules to block unwanted protocols on given ports

Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?: i only want to allow these connections [on the output chain]: on port 53 output only allow udp - dns on ...
3
votes
3answers
110 views

How do I ensure that my Ubuntu download has not been tampered with?

I am downloading Ubuntu Linux, and would like to make sure that my download has not been tampered with. Ubuntu has a GPG key, which I could use to make sure that the download is valid -- but how do I ...
3
votes
4answers
209 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
3
votes
1answer
71 views

Does TRESOR protect against attacks like HeartBleed

I was wondering if the linux TRESOR module (http://en.wikipedia.org/wiki/TRESOR) would protect a webserver against HeartBleed or other similar attacks.
3
votes
1answer
137 views

SNMPv2 and Community Security

When working with servers on the internet and doing monitoring is there any dangers using SNMPv2? I am working with observium and have the following: /etc/snmpd.conf com2sec readonly default ...
3
votes
1answer
119 views

What about AD2P vulnerability?

My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter. My question is, how secure is the audio(in my case voice) being ...
3
votes
3answers
486 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
3
votes
2answers
269 views

Safely remove an expired PGP key file

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
3
votes
1answer
321 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
3
votes
1answer
141 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
3
votes
1answer
261 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
3
votes
2answers
171 views

How do shared hosts protect different sites?

I host all my websites from a single VPN, and am about to sell some limited space of my Linode to a friend to host their new blog. It'll simply be another entry in Apache, and then a dedicated folder ...