Securing Linux systems and applications; understanding Linux security features.
8
votes
3answers
805 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
3
votes
5answers
981 views
Secure mount options + partitioning on Ubuntu
What is the best solution for mount options/partitioning when having e.g.: an Ubuntu minimal install (11.04) for Desktop use? e.g.: put /tmp on different partition to give it mount options like: ...
0
votes
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
8
votes
2answers
2k views
Recommend Keylogger for Ubuntu?
I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system ...
19
votes
6answers
2k views
Secure Linux Desktop
I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
6
votes
4answers
2k views
How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?
Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
-1
votes
2answers
140 views
How to store my contacts encrypted?
I use KeePass for storing my passwords, ok.
What should I use if I want to store my several hundred contacts (name, phone number, email, etc.) encrypted?
Thanks.
p.s.: under Linux/BSD
5
votes
3answers
1k views
How to detect Meterpreter and similar malware?
Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?
Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
2
votes
3answers
101 views
Could an Encrypted VG/Image compromised?
I mean if I encrypt my ""full system"" so that everything (besides the /boot) is in an encrypted VolumeGroup (Linux).
So I store my /boot on a flash drive, thats always next to me.
Q: can the ...
5
votes
1answer
603 views
Does Fedora 15 still use suid bits?
I heard that Fedora 15 will not use suid bits. Is that true?
Is the suid bit a security design bug?
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
13
votes
1answer
717 views
Did someone really plug an iphone in, or are these symptoms of an exploit attempt?
My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
5
votes
3answers
467 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
5
votes
3answers
1k views
Is CentOS a good choice from a security perspective?
How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
10
votes
7answers
1k views
Secure memcpy for pure C
Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...
Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
1
vote
4answers
2k views
How To - Learn basic hacking skills? [closed]
I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start.
Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a ...
5
votes
1answer
485 views
Linux wireless hacking book
I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
3
votes
1answer
391 views
Firewall rules to block unwanted protocols on given ports
Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?:
i only want to allow these connections [on the output chain]:
on port 53 output only allow udp - dns
on ...
4
votes
3answers
814 views
How to use VNC with SSH tunnel - “is this howto secure”?
PC-A: the local machine, from where i want to see the remote machine [Fedora]
PC-B: the remote machine, where the vnc server will be [Ubuntu]
install a vnc client [from where you want to connect] on ...
4
votes
2answers
375 views
How to improve VPS security?
I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
7
votes
2answers
1k views
Best way for a hacker to hide a file on Linux?
Suppose a hacker obtains a shell on my Linux host and wants to hide a file. What's the best way for him to do this? You may assume unprivileged or root access.
My thoughts are
Use a .file ...
3
votes
1answer
848 views
Does the Ophcrack LiveCD require hash collection via programs like pwdump?
When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
7
votes
1answer
384 views
Relative importance of CHROOT for web servers
I have read extremely mixed opinions on the process of chrooting for a web server (non-shared environment). Some people swear by it, yet others say that it isn't as secure as everyone says.
Given ...
10
votes
3answers
350 views
Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?
Context:
Small business, mostly a software house for web applications but also some desktop software.
Many external collaborators, so a variety of outside users with access to the servers.
Single ...
13
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
42
votes
8answers
6k views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
4
votes
2answers
210 views
What does a MCSE need to learn to be proficient regarding *nix security?
I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.
What ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
12
votes
3answers
795 views
Multi factor authentication on Ubuntu workstations, where to start?
Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)
...
8
votes
1answer
223 views
What shell binary should I use for the root account on a Linux system?
Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
