Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
1answer
79 views

Malware threats from other mounted hard drives

I am going to install Linux on an external hard drive and my internal hard drive is currently running Windows. When I boot to my Linux and I still have my windows hard drive mounted is it possible for ...
1
vote
0answers
62 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
1
vote
1answer
25 views

Is there an other place than the changelogs to see if a debian package is corrected or not?

I would like to know if there was an other place to see if a debian package is fixing a CVE than the changelog of the packet. For instance the packet bind9 1:9.7.2.dfsg.P3-1 is fixing the ...
0
votes
2answers
315 views

Isolating host machine from external network

How to prevent a host machine from sending/receiving packets with the following network configuration: eth0 - physical NIC :: not configured; tun0 - virtual NIC for VM which role is the gateway for ...
1
vote
1answer
402 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
2
votes
1answer
114 views

DBus proxy Javascript binding issues

Recent Gnome-3 (under GNU/Linux, BSD or other Un*x) offer a gnome shell with nice presentation, but where the configuration and theming are to be done via Internet Browser (and a public URL, on a ...
0
votes
1answer
126 views

Do the Linux binary blobs contain any intentional security holes?

This question covers the risks of accepting Binary blobs in one's distribution. This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot ...
2
votes
2answers
956 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
9
votes
4answers
625 views

What would happen if one of the popular Linux repositories is hacked?

Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling. What ...
1
vote
1answer
71 views

How can I view the contents of a web page without running malicious code? [closed]

I received a strange email which has some strange URL in it. I would like to know what is "behind" the url, but without the risk of running anything malicious. How can see the contents of the URL, ...
3
votes
3answers
517 views

Protecting against Firewire DMA vulnerabilities in Linux

I know there have been questions on this in the past but they all seem quite outdated, or not that specifically relevant. I need to use a 1394(Firewire) connection, however am concerned with possible ...
-2
votes
1answer
912 views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
1
vote
0answers
199 views

Tools to perform benchmark of block/stream ciphers on Linux? [closed]

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
1
vote
1answer
307 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
3
votes
2answers
378 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
9
votes
4answers
3k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
12
votes
2answers
5k views

Available Resources for Securing RHEL 6

Some in our infrastructure group want to upgrade to start taking advantage of the new features in RHEL 6. In the past, I have relied on the NSA Guide to secure RHEL 5 and CentOS 5 installations. I ...
8
votes
5answers
2k views

How can I remotely wipe the contents of a Linux Laptop if its been stolen?

I am currently investigating using Linux Laptops for my development team. We currently run Windows. The one advantage that keeps coming up for Windows over Linux from a system administration / ...
2
votes
0answers
2k views

What is a self-contained cross-platform encryption for USB drive? [closed]

I'm trying to find self-contained encryption solution for USB drives while at the same time being platform independent. For example, Windows' BitLocker only works on Windows and not on OS X or Linux. ...
1
vote
1answer
92 views

What are good ways to check for tampering/bad behaviour on a linux server that has already been set up but it's your first time logging into it

For this I am assuming we have a server that is of a client or a friend, so we the helper are not innately familiar with exactly how things should be be. What are good commands and ways to check to ...
1
vote
1answer
184 views

how to continuously caputre all my network traffic? [closed]

I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
0
votes
2answers
261 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
16
votes
1answer
580 views

Keyboard firmware hack - Linux vulnerable?

I see that Apple patched OS X to mitigate against K. Chen's famous Apple keyboard firmware hack. However: Apple keyboards can be used with computers running other operating systems; and in any ...
1
vote
2answers
103 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
3
votes
3answers
776 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
12
votes
3answers
481 views

Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?

Context: Small business, mostly a software house for web applications but also some desktop software. Many external collaborators, so a variety of outside users with access to the servers. Single ...
6
votes
1answer
3k views

loop-aes or dm-crypt for linux hard encryption?

loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported. dm-crypt keeps it's key on first hard block, is it a ...
2
votes
2answers
470 views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
3
votes
0answers
104 views

Deny Skype video access in Linux? [closed]

I have noticed that despite having configured Skype to not access video, during startups it continues to access the webcam momentarily. Skype is not a user, so I am unsure how to modify its ...
1
vote
1answer
308 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
2
votes
1answer
128 views

Should the root Unix user have a shell?

I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible. With this ...
13
votes
1answer
20k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
2
votes
1answer
414 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
4
votes
1answer
245 views

Are we under hacker control?

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites. You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
2answers
937 views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
0
votes
1answer
291 views

Read-Only USB thumb as Linux boot encryption authentication [closed]

I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me ...
1
vote
2answers
324 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
0
votes
3answers
3k views

What is the hack attempt going on when I see: did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

When I look at my sendmail logs, by far the most common "error" I see is the following: Nov 22 16:49:50 MyHostname sendmail[18832]: rAMMnj2u018832: [IP address redacted to hide the guilty] did not ...
2
votes
1answer
221 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
-2
votes
2answers
29k views

backtrack or kali linux ??? Which is best for a beginner pen tester ? [closed]

I am using backtrack right now but i also wish to switch to kali linux if its more interactive. Because i am just a beginner pen tester. I tried with both bt4 and bt5, but novice in kali linux.
0
votes
1answer
117 views

Strange Virus Infecting My Server

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind. When I access some domains on that server (every ...
3
votes
3answers
2k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
1
vote
0answers
108 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
1answer
1k views

Using Volatility Framework with Linux memory dumps

I am using Volatility Framework 2.2 to anlayze a Linux memory dump. This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23 I have the profile for it and ...
7
votes
4answers
628 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
0
votes
1answer
273 views

Fishy: VMware sends all traffic through akamai

I'm running Linux inside of VMware on the Mac, and on Linux I'm running a program that has connections open to perhaps 4 different machines. On the OS/X side however VMware has only 1 active network ...
-1
votes
2answers
206 views

How to store my contacts encrypted?

I use KeePass for storing my passwords. What should I use if I want to store my several hundred contacts (name, phone number, email, etc) encrypted?
5
votes
1answer
164 views

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but ...
0
votes
1answer
731 views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...