Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

16
votes
1answer
561 views

Keyboard firmware hack - Linux vulnerable?

I see that Apple patched OS X to mitigate against K. Chen's famous Apple keyboard firmware hack. However: Apple keyboards can be used with computers running other operating systems; and in any ...
1
vote
2answers
101 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
3
votes
3answers
738 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
12
votes
3answers
478 views

Given SSH access, what should I do to protect a server and monitor (dangerous) user actions?

Context: Small business, mostly a software house for web applications but also some desktop software. Many external collaborators, so a variety of outside users with access to the servers. Single ...
6
votes
1answer
3k views

loop-aes or dm-crypt for linux hard encryption?

loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported. dm-crypt keeps it's key on first hard block, is it a ...
2
votes
2answers
448 views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
3
votes
0answers
103 views

Deny Skype video access in Linux? [closed]

I have noticed that despite having configured Skype to not access video, during startups it continues to access the webcam momentarily. Skype is not a user, so I am unsure how to modify its ...
1
vote
1answer
305 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
2
votes
1answer
128 views

Should the root Unix user have a shell?

I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible. With this ...
12
votes
1answer
19k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
2
votes
1answer
403 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
4
votes
1answer
245 views

Are we under hacker control?

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites. You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
2answers
901 views

What are the implications of including binary blobs in the Linux kernel?

According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
0
votes
1answer
279 views

Read-Only USB thumb as Linux boot encryption authentication [closed]

I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me ...
1
vote
2answers
306 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
0
votes
3answers
2k views

What is the hack attempt going on when I see: did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

When I look at my sendmail logs, by far the most common "error" I see is the following: Nov 22 16:49:50 MyHostname sendmail[18832]: rAMMnj2u018832: [IP address redacted to hide the guilty] did not ...
2
votes
1answer
218 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
-2
votes
2answers
28k views

backtrack or kali linux ??? Which is best for a beginner pen tester ? [closed]

I am using backtrack right now but i also wish to switch to kali linux if its more interactive. Because i am just a beginner pen tester. I tried with both bt4 and bt5, but novice in kali linux.
0
votes
1answer
116 views

Strange Virus Infecting My Server

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind. When I access some domains on that server (every ...
3
votes
3answers
2k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
1
vote
0answers
107 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
1answer
1k views

Using Volatility Framework with Linux memory dumps

I am using Volatility Framework 2.2 to anlayze a Linux memory dump. This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23 I have the profile for it and ...
6
votes
4answers
620 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
0
votes
1answer
262 views

Fishy: VMware sends all traffic through akamai

I'm running Linux inside of VMware on the Mac, and on Linux I'm running a program that has connections open to perhaps 4 different machines. On the OS/X side however VMware has only 1 active network ...
-1
votes
2answers
206 views

How to store my contacts encrypted?

I use KeePass for storing my passwords. What should I use if I want to store my several hundred contacts (name, phone number, email, etc) encrypted?
5
votes
1answer
163 views

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but ...
0
votes
1answer
694 views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
7
votes
2answers
227 views

What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator?

Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says: Oh, and don’t display filenames. Filenames could contain control ...
2
votes
2answers
718 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
0
votes
2answers
649 views

Disabling SMEP on x86_64

I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer ...
5
votes
1answer
153 views

How is using acces() opening a security hole?

The man page for access(2) tells : Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the ...
1
vote
2answers
2k views

Any reasons to why not use randomize_va_space?

I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
44
votes
5answers
3k views

What does Mark Shuttleworth mean by “we have root”?

In a blog post in response to the Amazon privacy controversy, Mark Shuttleworth wrote: Don’t trust us? Erm, we have root. You do trust us with your data already. You trust us not to screw up on ...
11
votes
1answer
644 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
64
votes
9answers
12k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
4
votes
3answers
158 views

How can you know what is distributed with your Linux

I'm curious, in theory, how can one know if for example kernel that is distributed with Ubuntu Linux is really what is on https://github.com/torvalds/linux and not some modified kernel which contains ...
0
votes
1answer
883 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
8
votes
5answers
1k views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
0
votes
1answer
319 views

Would adding root to a group open a security hole? [closed]

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...
-1
votes
2answers
152 views

Linux: Blocking outside attempts at attacking computer

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: ...
4
votes
1answer
2k views

What tools can be use for Security Auditing for Redhat

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.
2
votes
3answers
515 views

Is there an internal equivalent to fail2ban?

fail2ban is a protection against brute-force that locks a user out after a definable maximum failed login-attempts. But if a user already has access to a server with another username already fail2ban ...
6
votes
2answers
4k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
5
votes
2answers
1k views

Securing USB flash drive on linux

We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or ...
-1
votes
1answer
707 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
3
votes
3answers
2k views

Alternative to AirPcap for Linux?

I need to sniff WiFi packets, but according to AirPcap FAQ page, it just supports Microsoft Windows, not other platforms. Does any alternative of this product work in Linux? Please don't offer Alfa ...
1
vote
1answer
242 views

SSH authorized_keys

Can you correct me on this. I create a keypair on my PC. Copy the public key (append to authorized_keys) on the server. Disable password auth on the server, and SSH to server from my PC. I have ...
1
vote
1answer
88 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
4
votes
2answers
2k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?