Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
0answers
4 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
1
vote
1answer
160 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
32 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
1
vote
2answers
81 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If i install Ubuntu using this infected DVD drive could my system be taken over during installation process or later when ...
2
votes
1answer
33 views

How to verify installed packages [on hold]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
28
votes
4answers
18k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
1
vote
1answer
219 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
0
votes
0answers
16 views

Findout address of shellcode dynamically, placed on stack [migrated]

I am using shellcode to spawn a shell,I am curious to findout the starting address of shellcode dynamically,which is placed on stack and not hard code the address in the shellcode kindly share your ...
0
votes
1answer
47 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
1
vote
0answers
37 views

How to increase delay of ssh root access every time login fails [migrated]

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login ...
5
votes
2answers
257 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
5
votes
2answers
251 views

IPsec on multicast

I am trying to implement IPSec for multicast communication, I tried strongSwan for setting up IPSec for unicast but it doesn't support any standard for multicast ipsec as listed here ...
1
vote
1answer
641 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
-1
votes
2answers
5k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
2
votes
1answer
160 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
3
votes
0answers
36 views

Modify the return address of a C function with buffer overflow vulnerability [migrated]

I am trying to modify the following C program so that the main function will skip the printf("x is 1") line and only print "x is 0". void func(char *str) { char buffer[24]; int ...
5
votes
2answers
72 views

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...
2
votes
1answer
45 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
2
votes
0answers
21 views

How to find more details on Invalid Certificates [migrated]

Setup I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command: ...
1
vote
0answers
25 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
2
votes
0answers
35 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
22
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
-2
votes
1answer
62 views

Official proof (document) that Linux is safer and faster than Windows [closed]

I work for the Mexican government, and even though everyone involved in Linux knows that it is safer and runs faster in most instances, I have not found an official document or authority that I can ...
1
vote
0answers
32 views

can we do the full disk encryption of a already installed Linux machine? [migrated]

I need some information regarding any possibility to do full disk encryption for a already installed Linux system(e.g centOS or Ubuntu). Is there any default mechanism for FDE present in Linux like ...
2
votes
1answer
265 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
-2
votes
0answers
18 views

Hydra giving false negative passwords [duplicate]

i used the hydra gui on myself and put my password in the wordlist to see if it worked and it came back no passwords found I did this 2 more times same thing I figured I did something wrong so I ...
20
votes
6answers
9k views

How to prevent BadUSB attacks on linux desktop

What can I do to protect my linux laptop from BadUSB attacks as described here? Perhaps writing an appropriate apparmor profile would help?
7
votes
0answers
192 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
0
votes
0answers
7 views

openssl error: Error Loading extension section server [migrated]

The system is fc21. The objective is to run the examples: http://linuxconfig.org/apache-web-server-ssl-authentication The openssl.cnf file has been created and the following command run: openssl ...
2
votes
1answer
52 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
2
votes
1answer
314 views

Security of LXC compared to OpenVZ

For years, I'm now using OpenVZ on my server, but support discontinued for Debian and Ubuntu, current releases seem to focus on LXC now, which is not a bad idea from the point of comfort. But what ...
1
vote
1answer
93 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
0
votes
2answers
126 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
1
vote
0answers
12 views

How to configure pam to use with two different passwords? [migrated]

Goal: I want to configure pam to use regular user password (pam_unix.so) and extra password. (with success only when I type both passwords correctly and deny (pam_deny.so) in case I type only one ...
7
votes
1answer
229 views

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down ...
7
votes
1answer
84 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
0
votes
2answers
82 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
0
votes
0answers
19 views

What is the most effective way to block IP address in Application Layer? [migrated]

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
0
votes
1answer
49 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like ...
-1
votes
2answers
56 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
2
votes
1answer
78 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
2
votes
1answer
289 views

How does SELinux affect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
0
votes
1answer
46 views

is return-to-libc attacks possible Now?

I'v read that to make a successful return to lib-c attack, the attacker should store the address of the command (for example "bin/sh") in stack exactly after the return address to 'system' function ...
-1
votes
2answers
40 views

How can I detect mode interface of other machine is promiscuous [closed]

I have a project that is to protect my box from attack man in the middle arp poison. I should detect if interface mode of other machine is promiscuous. I must write script python or command linux.
2
votes
1answer
70 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
0
votes
0answers
13 views

I Use Precompiled Open Source Software. Is There a Backdoor? [duplicate]

I'm new to Linux world (3-4 months with Linux). But I did compile some programs from source and had one failed attempt to compile a custom Linux kernel. One thing that I'm wondering about is the ...
4
votes
1answer
67 views

Is symlink race a very common vulnerability in UNIX systems

As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself ...
0
votes
1answer
108 views

Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu?

i Encrypted my files with EFS in windows 8.1 so i logged in ubuntu and without any warning , its shown my files actually not Exactly the file but shown the path of file and the name and i can ...