Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

5
votes
1answer
174 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
5
votes
1answer
383 views

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
5
votes
2answers
377 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
5
votes
1answer
392 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
5
votes
1answer
915 views

Are Linux vendor-supplied security updates enough for PCI Compliance?

I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of ...
5
votes
1answer
49 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
5
votes
1answer
152 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
4
votes
3answers
2k views

Is Linux spying on its users? [closed]

If you install some kind of Linux distributions on your computer, is their a possibility that their owners may spy on you? For example, can Ubuntu, Kali or Arch linux send data to its owners on what ...
4
votes
3answers
602 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
4
votes
2answers
257 views

How secure is BSD sockets?

BSD sockets API was released in 1983. As it was implemented 3 decades ago and still being widely used, is it secure in today's scenario where every software has to be actively protected against ...
4
votes
3answers
1k views

Pseudo Random Generator is not initialized from the (entropy pool)?

The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block. But when ...
4
votes
3answers
124 views

Specific Dangers in Joining a Linux Botnet?

Between the PHP-as-cgi-bin problem, and shellshock, I've seen 4 or 5 different Perl scripts that, when run, purport to make your machine part of some scary, heinous botnet. What, specifically, would ...
4
votes
3answers
162 views

How can you know what is distributed with your Linux

I'm curious, in theory, how can one know if for example kernel that is distributed with Ubuntu Linux is really what is on https://github.com/torvalds/linux and not some modified kernel which contains ...
4
votes
2answers
4k views

Need advice on linux server being hacked

I'm currently trying to find out how one of our centos servers was compromised. We were experiencing malware on our sites. After searching I finally found the malware injecting into the sites. As it ...
4
votes
1answer
2k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
4
votes
1answer
161 views

Is Linux's 'W' command a security breach?

I was surprised that the out of the box 'W' command on Linux provides so much information without needing any SUDO or admin permissions. In particular, the command shows the command line of each ...
4
votes
1answer
1k views

Can this be a DoS Attack?

When I'm checking my log, I found like 15k events of " PAM service(sshd) ignoring max retries; 6 > 3 " I know this might be normal, and considered as Brute-Force attack, but can it be classified as ...
4
votes
3answers
2k views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
4
votes
9answers
911 views

I only use windows for games. Do I need anti virus protection?

I use Linux, and even though I'm not pretending my system is virus-free, it's generally accepted that even an aggressive firewall is not a requirement. I want to install Windows 7 on a machine which ...
4
votes
2answers
9k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
4
votes
2answers
671 views

Protecting data on a laptop with linux

I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making ...
4
votes
2answers
1k views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
4
votes
2answers
1k views

Impact of Mathew Garrett's Secure GRUB Bootloader on UEFI Secure Boot

My eyebrows rose with Matthew Garrett announcing his Secure GRUB Bootloader less than three hours after no longer being a Red Hat employee. This work and its impact on the trust chain design of the ...
4
votes
3answers
1k views

Restrict access to a specific directory on Linux

I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access ...
4
votes
2answers
1k views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
4
votes
4answers
694 views

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
4
votes
2answers
909 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
1answer
6k views

what does it mean to be setuid root?

I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is SETUID root in UNIX (or has Administrator power in Windows). The ...
4
votes
1answer
6k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
4
votes
1answer
84 views

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
4
votes
1answer
213 views

Does dual boot hurt security?

On my laptop I have a well secured Linux installation that I would like to stay this way. It has in the past and could in the future contain confidential medical data I use for my study. I also have a ...
4
votes
2answers
204 views

You've just acquired a newly created CentOS server, what should you do to secure it?

I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?
4
votes
2answers
1k views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
4
votes
1answer
381 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
4
votes
1answer
2k views

What tools can be use for Security Auditing for Redhat

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.
4
votes
3answers
529 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
4
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
4
votes
2answers
2k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
4
votes
2answers
64 views

SSH: Security of Pubkey Authentication vs Password

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and ...
4
votes
2answers
102 views

What does a signed Linux kernel image get me?

On Ubuntu and possibly Debian systems, you can install packages which contain images which are signed by Ubuntu's EFI key. For example, linux-signed-image-generic-lts-trusty is one of these packages. ...
4
votes
2answers
196 views

Do `sudo` and `su` belong to capability-based security?

In Linux, do sudo and su belong to Capability-based security ? For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
4
votes
1answer
5k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
4
votes
2answers
707 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
4
votes
1answer
248 views

Are we under hacker control?

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites. You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
2answers
163 views

Can my /boot be compromised if I Suspend my notebook?

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel! Or if someone tries (evil maid) to modify the /boot then ...
4
votes
2answers
276 views

What does a MCSE need to learn to be proficient regarding *nix security?

I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago. What ...
4
votes
1answer
86 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
4
votes
1answer
90 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
4
votes
2answers
771 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
1answer
812 views

Can auditd track events that occured over NFS

I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X. Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa When events occur on Server X ...