Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

2
votes
2answers
193 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
3
votes
2answers
251 views

Safely remove an expired PGP key file

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
2
votes
1answer
118 views

Trust linux images burned from untrusted systems

For securitys sake I'm assuming my system is successfully compromised after a targeted and/or non-targeted attack. I've downloaded some linux images and burned them to do a re-install. Since I can't ...
1
vote
1answer
101 views

How to forbid one directory only in TOMOYO (2.5)?

(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two ...
3
votes
1answer
197 views

“WICKED” entries in the default nginx vhost's logs

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs: 109.x.x.121 - - ...
3
votes
1answer
316 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
1
vote
3answers
187 views

Protect linux kiosk display

We use a small computer with linux attached to a big tv to display some data to the public. Normally, there is no keyboard connected. When a keyboard is connected at boot, we start the configuration ...
5
votes
5answers
535 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
4
votes
2answers
1k views

Impact of Mathew Garrett's Secure GRUB Bootloader on UEFI Secure Boot

My eyebrows rose with Matthew Garrett announcing his Secure GRUB Bootloader less than three hours after no longer being a Red Hat employee. This work and its impact on the trust chain design of the ...
0
votes
1answer
211 views

SSH Log: “Accepted password for user…”

I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 190.101.200.100 port 55805 ssh2 saying that a connection was accepted ...
3
votes
1answer
353 views

How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?

Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
12
votes
4answers
421 views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
9
votes
1answer
14k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
2
votes
1answer
143 views

Why must VMX instructions trap?

What would happen if each of these instructions didn't trap into VMX root when executed in VMX non-root? INVEPT, INVVPID, VMCALL,VMCLEAR, VMLAUNCH, VMPTRLD, VMPTRST, VMREAD, VMRESUME, VMWRITE, ...
1
vote
2answers
212 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
2
votes
1answer
179 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
3
votes
3answers
628 views

Online security check via command line

My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential ...
97
votes
8answers
5k views

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
3
votes
2answers
689 views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
3
votes
1answer
80 views

auditing mod security rule sets

Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold? I know with fire fox I can ...
1
vote
1answer
500 views

Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?

I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario: "macbox" OS X using OpenSSH_5.2p1 ssh client "sunbox" Solaris 10 ...
5
votes
2answers
871 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
3
votes
3answers
120 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
5
votes
3answers
4k views

What key does Linux use when storing user passwords?

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow. Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
3
votes
1answer
135 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
2
votes
1answer
772 views

Victim system's internet connection slow after ARP spoof?

I've been using Nemesis 1.4 to test ARP spoofing on a local victim machine. I've been spoofing both the victim machine and the default gateway to ARP redirect to my machine. Spoofing victim's source ...
0
votes
2answers
425 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
6
votes
2answers
319 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
1
vote
2answers
273 views

Changing IP ID generation of a server

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into ...
2
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
1answer
440 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
20
votes
3answers
42k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
770 views

How to defeat ASLR in linux kernel? [duplicate]

Possible Duplicate: Stack Overflows - Defeating Canaries, ASLR, DEP, NX is there anyway to disable ASLR in Linux kernel 2.6.32-71.el6.x86_64, with Apache privileges?? I tried this commands: ...
7
votes
5answers
857 views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
6
votes
2answers
716 views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
2
votes
2answers
2k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
3
votes
1answer
252 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
0
votes
2answers
326 views

How to verify correct, secure and test setuid?

I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
4
votes
1answer
919 views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
3
votes
3answers
528 views

Truecrypt Plausible Deniability - Linux

As I understand it plausible deniability gives the user the option of having two passwords, one you provide the authorities/extortionist with and another that you might use for your self and files you ...
3
votes
1answer
172 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
2
votes
2answers
288 views

Can the `system` function pose severe security threats on a shared hosting server?

I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects. So I created a ticket and asked them to enable it. This is what ...
8
votes
4answers
515 views

Does UNIX have a dual approval mechanism?

Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
1
vote
2answers
1k views

Any reasons to why not use randomize_va_space?

I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
3
votes
3answers
264 views

Why should every file have a user and a group?

I've been reading in most hardening guides for linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or ...
-1
votes
1answer
2k views

How to hack linux from phpMyAdmin? [closed]

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the ...
5
votes
2answers
3k views

Issues with preserving $HOME on sudo

On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this ...
3
votes
2answers
304 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
4
votes
2answers
541 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...