Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

8
votes
3answers
2k views

I don't recognise my DNS server's address: does this mean I am compromised?

I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address ...
2
votes
2answers
53 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
1
vote
0answers
31 views

Is that a way break Linux user password by bypassing grub protected?

The best way to delve into others Linux machine is by editing the grub. Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
0
votes
0answers
5 views

Where can i find information about Ipsec Xfrm framework?

I have searched online and found very little information about the ipsec xfrm framework, including the book Networking implementation and Theory.. Where can i get more information about xfrm ...
1
vote
1answer
30 views

A question about arpspoof command

The arpspoof command will spoof default_router_ip's MAC address on all victims in the subnet arpspoof -i <NIC> <default_router_ip> How does it fool the router about the MAC addresses ...
-1
votes
1answer
24 views

Linux distribution on USB stick used to banking for begginers [on hold]

Is it good idea to use up-to-date Linux on USB stick instead liveCD to online banking? What is the best Linux distribution for not advanced people who commonly use Windows to make online payments ...
-1
votes
0answers
30 views

i found a website with mysql error but sqlmap give error [on hold]

so i found a website with an error and i tried to inject him so it give me this error [17:45:35] [WARNING] GET parameter 'pageno' is not injectable [17:45:35] [CRITICAL] all tested parameters ...
0
votes
0answers
14 views

OSSEC error “agent_control(1750): ERROR: No remote connection configured. Exiting”

I am new to OSSEC and trying to figure the tool to deploy it. I have an ubuntu server where I downloaded and installed the security onion packages. I have a few windows systems which I would like to ...
3
votes
1answer
64 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
0
votes
2answers
8k views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
0
votes
0answers
21 views

EVIL AP - Internet connection bridging issue [migrated]

I've been trying to create an EVIL AP scenario in my test lab for a couple of days, but I always face the same issue. I can connect to the WIFI adapter and I receive an IP address etc, via dhcp. ...
-1
votes
1answer
43 views

Open Root File Using Other Users “.bashrc -> .profile” [closed]

If I have access to .bashrc -> .profile for another user which is owned by root with lrwxrwxrwx permissions How could I capture /root/flag.txt? It's a Live CD. Thanks
2
votes
1answer
120 views

Return-to-libc attack with the argument read from registers (EDI/RDI)

I've read that to make a successful return-to-libc attack, the attacker should store the address of the command (for example /bin/sh) in the stack exactly after the return address of the system ...
-1
votes
1answer
25 views

rpm package info leak?

On Linux, rpm -qi <package-name> command would display the package info, which would contain information of build machine - Build Host :<host-name> Does this pose any security risk? Is ...
4
votes
1answer
54 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
-1
votes
0answers
9 views

How to set linux as default OS after reinstalling windows already dual booted envirnment? [migrated]

I have a system running windows and linux in dual boot envirnment. But due to of some problem i have reinstall my windows but now my boot menu only shows windows OS. I want to know that how i can ...
0
votes
0answers
15 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?
9
votes
1answer
4k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
0
votes
3answers
181 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
1answer
10 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
-2
votes
0answers
12 views

how to fix deb command not found in kali linux 2016? [migrated]

i follow tutorial install wine on wine offical website: https://wiki.winehq.org/Debian. but have a trouble, in this picture Please tell me how to fix for completely wine install and run window ...
2
votes
1answer
82 views

Linux responds to ARP requests for other interfaces - could this be a security vulnerability?

Linux responds to ARP requests on all interfaces by default. To explain, say you have this setup: Client 1 ---> [eth1] server [eth0] <--- Client 2 And the server's eth1 IP is 192.168.1.1 and ...
0
votes
0answers
8 views

XCCDF check with SCE - Suse Linux Enterprise Server 11

I have written some compliance checks for Red Hat based systems with XCCDF. Some of my checks are OVAL definitions others are shell-scripts. It works great. The same checks don't work on an SLES 11 ...
4
votes
3answers
447 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
21
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
4
votes
0answers
33 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
0
votes
1answer
35 views

samdump2 Error reading ControlSet: _RegOpenKey

I copied both SAM and SYSTEM files from my Windows7 OS, and then used this command to read the content of the SAM file samdump2 SAM SYSTEM > mdp_chiffres.txt, but i'm getting this error Error ...
1
vote
1answer
77 views

Yersinia raw packet

I'm using Yersinia to pentest my network. There are two options send raw packet and creating DHCP rogue server I don't understand fully. Can someone explain the meaning of these options?
0
votes
0answers
12 views

Can servers with encrypted root filesystems be made reasonably highly available? [migrated]

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
-1
votes
2answers
42 views

Linux kernel security bugs and hardening Ubuntu? [closed]

I recently read some article about the linux kernel having vulnerabilities, I can't recall exactly where. Being new to linux, do you guys have some references on how I should prevent remote access to ...
5
votes
2answers
85 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
16
votes
5answers
4k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
0
votes
1answer
110 views

Online vs offline backups [closed]

Up to this point I was using physical hard drives for backups, typically using dm_crypt as mentioned here. If online storage is used instead, and the provider cannot be trusted how much should the ...
3
votes
0answers
36 views

Repeated set of UUIDs from java's UUID.randomUUID() [migrated]

We have observed that set of almost 200,000 UUIDs has replayed two months apart, and I'm wondering if anyone has seen anything similar. The UUIDs are generated using UUID.randomUUID(). In digging ...
4
votes
1answer
673 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
0answers
50 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
3
votes
2answers
105 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
0
votes
1answer
52 views

Is it safe to host passwordless web applications/software with web GUI in Virtual Machines

I have a Linux Mint Virtual Machine which I use quite a lot with my Windows host. I have lots of Software installed there (mostly with web GUI so I can access them from host easily). So I am ...
0
votes
1answer
58 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
2
votes
2answers
75 views

Protecting account ssh keys from root

How can users ssh private keys be protected from root stealing and attempting to brute force them? I cannot use selinux as the vendor will not support the app when it's in use? Thanks
3
votes
1answer
79 views

Hacked debian server alternative boot

The server of a customer has been hacked last night. It is a standard debian distribution with mysql, apache and ssh for remote access. The way it has been hacked is very peculiar. The standard URL ...
1
vote
0answers
66 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt?

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
2
votes
0answers
16 views

Linux Mint: pastebin is in /usr/local/bin [migrated]

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
55
votes
8answers
12k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
10
votes
1answer
90 views

Using TPM with well-known SRK/owner passwords?

First, I will explain roughly how I plan to use the TPM: I am using something called tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then ...
4
votes
3answers
3k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
0
votes
0answers
9 views

Changing MAC address on Virtual Machine [migrated]

Running linux on virtual box with Windows 10 as a host. I want to edit the mac address on linux and was wondering if a network admin would see the spoofed linux mac or my Windows one? Would I have to ...
2
votes
2answers
1k views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
-5
votes
3answers
2k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
1
vote
0answers
26 views

From xss to rce in client side [closed]

I found a desktop application in Linux w/c getsvand that displays items from site xyz. xyz is vulnerable to XSS and code injected there is also executed on client side's desktop app.similar to this ...