Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
4
votes
2answers
48 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
11
votes
3answers
13k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
1
vote
0answers
12 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
12
votes
4answers
4k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
4
votes
1answer
100 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
134
votes
21answers
21k views

Hardening Linux desktop machine against people from my household

I am looking to make a clean install of a Debian system on my home desktop. To clarify, I am switching from Windows and wish to use it as my day-to-day home OS - I'm not going to be running any ...
3
votes
1answer
61 views

Does posting the technique I used to encrypt my Linux system make the encryption inherently less secure?

I recently encrypted my laptop, but I also wrote notes on how I did it and posted those notes online. The configuration is fairly complicated and, from what I can tell, also fairly unique. I did not ...
0
votes
0answers
10 views

Pulledpork not disabling all rules in disablesid.conf [on hold]

Every time I run pulled pork, it disables 6 random rules from my disabledsid.conf and leaves the rest alone. I have hundreds of rules in the disablesid.conf and the path is correct. IE: # example ...
2
votes
2answers
50 views

When would group permissions be a security issue?

I frequently hear that 600 and 700 is recommended for security when possible before 660, 770. I'd like to understand the risk that 660, 770 would have that 600, 700 wouldn't.
0
votes
1answer
21 views

Does Dropbear support SSH key revocation?

I'm using Dropbear as an SSH server in my embedded system. I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?
-6
votes
1answer
89 views

Are the only people who can work in security those who were learning from 10 years old? [on hold]

I'm a second years Master student in computer science. As time passes, the more my desire to work in computer security increases. I have many friends who are more experienced than I, who told me ...
5
votes
1answer
87 views

After a bufferoverflow does an attacker only have access to calls which are present in the library where the C code was compiled?

Or are there techniques to just get a shell? What I am interested in is if I have compiled some C code using only a small library with insignificant possible calls, does this restrict the attacker ...
0
votes
3answers
652 views

Removing a Redirect Virus from Fedora Linux

Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website ...
6
votes
1answer
537 views

How does SELinux affect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
1
vote
3answers
279 views

About SHA1 in default Disk Encryption in Linux

Link to the thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
0
votes
2answers
515 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
2
votes
1answer
69 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
20
votes
2answers
5k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
3answers
478 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt? [closed]

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
3
votes
2answers
74 views

How to forget LUKS keys during emergency?

One day, while Alice is downloading some photos from Bobs server, the alarm goes off. Trudy came to steal all the data. Fortunately, the server is setup to shutdown upon server room alarm and has ...
2
votes
3answers
75 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
-4
votes
0answers
69 views

Need help getting Metasploit (MS08-067) to work in Kali Linux 2

I apologize right off the bat for this seemingly common problem, but I cannot seem to resolve it no matter how many fixes I try that I have found from this website and others. I am running Kali ...
4
votes
1answer
146 views

Protecting master password in memory

Assuming I want to enter master password only one time at the start of the program, how is this master password usually protected in memory after that? Is the encryption key after being derived from ...
38
votes
3answers
37k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
3
votes
1answer
59 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
3
votes
1answer
92 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
9
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
1
vote
2answers
62 views

How does allowing breaking grabs with keyboard actions pose a security risk?

While modifying the Gnome Tweak Tool I saw the following option which states that allowing breaking grabs with keyboard actions poses a security risk. How can it be a security risk?
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
2
votes
2answers
95 views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
4
votes
2answers
58 views

Sorting hosts via open ports using NMap

I was tasked with running a NMap scan against our corporate network and compiling a list of only live endpoints. My issue is how to go about separating out the hosts via their open ports (printer/...
0
votes
1answer
80 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
10
votes
1answer
153 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
0
votes
1answer
85 views

How to detect zip file encryption algorithm

As we know zip files supports a simple password-based symmetric encryption system and some vendors use other algorithms. I used the zipinfo command in Linux but it doesn't say what encryption ...
0
votes
0answers
7 views

Can one setup an application whitelist for other applications even encompassing the root user on Linux?

Is it possible to restrict an application program to being used/called only from designated programs without having resorting to specific code testing or wrappers? This restriction has to apply to ...
0
votes
1answer
111 views

Found 0000 Permission Files on a hacked server

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and ...
8
votes
2answers
495 views

Why was LibreSSL PRNG unsafe on Linux?

From the article LibreSSL's PRNG is Unsafe on Linux. The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite the 2.0.x version numbers, ...
1
vote
2answers
11k views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
0
votes
1answer
40 views

Network configuration: Preventing my computer being used as a proxy?

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a ...
1
vote
2answers
65 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
0
votes
1answer
644 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT {...
1
vote
1answer
16 views

Does altering the routing table to my hub defeat the purpose of a VPN?

I am running a VPN on my server with openvpn. When running openvpn I have a shell script that runs afterwards: ip rule add from 192.168.0.19 table 128 ip route add table 128 to 192.168.0.0/24 dev ...
0
votes
1answer
158 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
1
vote
2answers
74 views

Lock down OS to specific hardware device

I know everything is reversible. But how could I lock down an instance of linux to a specific hardware device? Possibly tying the filesystem to a specific serial number on the board for instance.
-3
votes
0answers
15 views

Error messages “VBoxGuest_RTLogBackdoorPrintf” and “RTAssertShouldPanic” when updating a Linux host with VirtualBox installed [migrated]

This has been noticed on the Linux host updates, where the virtualbox has been installed. Notice "VBoxGuest_RTLogBackdoorPrintf", "RTAssertShouldPanic" and more. What is this process please?
1
vote
1answer
77 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
3
votes
3answers
51 views

How secure are webservers from linux repos?

how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date. If they ...
0
votes
0answers
26 views

How crypto module integrity checks mandated by FIPS 140 standard help to make Linux based appliances safer?

After browsing dracut and hmaccalc rpm package source code I found out sha512hmac utility that is used to do do integrity checks for linux kernel (and other binaries) from initramfs boot stage uses ...
0
votes
0answers
15 views

What is purpose of fipscheck utility and fipscheck library on Linux?

So I am messing around with dracut and I am trying to get my Linux system in FIPS 140 mode by passing fips=1 to my linux kernel at the boot time from grub. However, I got confused on why dracut ...