Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

4
votes
1answer
66 views

What infection vectors is Trojan.Linux.BillGates usually delivered with?

I just discovered that my server is infected with Trojan.Linux.BillGates.G and is being used to launch DOS attacks. It surprises me as the server is kept up-to-date (CentOS/Tomcat/CouchDB) as much as ...
0
votes
1answer
174 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
66
votes
3answers
118k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
42
votes
5answers
47k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
8
votes
5answers
1k views

Securing Debian Apache PHP server

I have a Debian Apache PHP server. I want to secure it after the classic installation process. My usual steps are : list items update all packages remove all unnecessary services like named, ...
1
vote
1answer
96 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
0
votes
0answers
28 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...
1
vote
1answer
47 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
3
votes
3answers
79 views

Is it safe to manually patch security bugs in an outdated system, that is no longer supported?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on my Nook Simple Touch (2011 Nook)? I need to find ...
0
votes
0answers
88 views

My ISP provider is spoofing DNS [on hold]

My ISP provider is DNS spoofing OpenDNS, Google DNS, Norton DNS, Yandex DNS and all other known DNS servers. So even if I use those, I still can't access some websites. So I need a DNS server which is ...
1
vote
1answer
23 views

How to best manage multiple applications using the internet with Firewall

Im not new too Linux (Ubuntu 14.x) however I must admit that I have never bothered with a Firewall until now. Im currently using Ubuntu's inbuilt firewall (UFW) with a graphical plugin (GUFW), which I ...
1
vote
1answer
26 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
2
votes
2answers
81 views

Is Qubes OS more secure than running a set of activity related VMs?

I'd like to skip the argument about Linux being more secure than Windows, and purely focus on the security boundaries between Host OS and VMs. Is Qubes OS theoretically more secure than say - Windows ...
4
votes
0answers
37 views

Laptop Encryption variables

If you are running such an operating system as Ubuntu among others, you would of seen that it gives you the polite option to encrypt your Home directory OR Whole hard drive with a robust AES 256bit ...
5
votes
3answers
79 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
11
votes
3answers
13k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
1
vote
0answers
22 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
12
votes
4answers
4k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
4
votes
1answer
101 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
134
votes
21answers
21k views

Hardening Linux desktop machine against people from my household

I am looking to make a clean install of a Debian system on my home desktop. To clarify, I am switching from Windows and wish to use it as my day-to-day home OS - I'm not going to be running any ...
3
votes
1answer
63 views

Does posting the technique I used to encrypt my Linux system make the encryption inherently less secure?

I recently encrypted my laptop, but I also wrote notes on how I did it and posted those notes online. The configuration is fairly complicated and, from what I can tell, also fairly unique. I did not ...
2
votes
2answers
52 views

When would group permissions be a security issue?

I frequently hear that 600 and 700 is recommended for security when possible before 660, 770. I'd like to understand the risk that 660, 770 would have that 600, 700 wouldn't.
0
votes
1answer
21 views

Does Dropbear support SSH key revocation?

I'm using Dropbear as an SSH server in my embedded system. I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?
-6
votes
1answer
92 views

Are the only people who can work in security those who were learning from 10 years old? [closed]

I'm a second years Master student in computer science. As time passes, the more my desire to work in computer security increases. I have many friends who are more experienced than I, who told me ...
5
votes
1answer
89 views

After a bufferoverflow does an attacker only have access to calls which are present in the library where the C code was compiled?

Or are there techniques to just get a shell? What I am interested in is if I have compiled some C code using only a small library with insignificant possible calls, does this restrict the attacker ...
0
votes
3answers
659 views

Removing a Redirect Virus from Fedora Linux

Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website ...
6
votes
1answer
540 views

How does SELinux affect the Linux Kernel networking stack?

I'm interested in how SELinux effects the processing of packets through the networking stack. I've found the following questions and answers: Network policies under AppArmor/SELinux Filtering ...
1
vote
3answers
283 views

About SHA1 in default Disk Encryption in Linux

Link to the thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
0
votes
2answers
516 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
2
votes
1answer
74 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
20
votes
2answers
6k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
3answers
500 views

Can I decrypt a DiskCryptor-encrypted hard drive using Veracrypt? [closed]

I have a hardrive I encrypted with DiskCryptor back when I was using Windows. Now that I have Linux I want to decrypt the hard drive but it turned out DiskCryptor is not available for Linux, whereas ...
3
votes
2answers
76 views

How to forget LUKS keys during emergency?

One day, while Alice is downloading some photos from Bobs server, the alarm goes off. Trudy came to steal all the data. Fortunately, the server is setup to shutdown upon server room alarm and has ...
2
votes
3answers
80 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
-4
votes
0answers
74 views

Need help getting Metasploit (MS08-067) to work in Kali Linux 2

I apologize right off the bat for this seemingly common problem, but I cannot seem to resolve it no matter how many fixes I try that I have found from this website and others. I am running Kali ...
4
votes
1answer
151 views

Protecting master password in memory

Assuming I want to enter master password only one time at the start of the program, how is this master password usually protected in memory after that? Is the encryption key after being derived from ...
38
votes
3answers
38k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
3
votes
1answer
60 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
3
votes
1answer
93 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
9
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
1
vote
2answers
64 views

How does allowing breaking grabs with keyboard actions pose a security risk?

While modifying the Gnome Tweak Tool I saw the following option which states that allowing breaking grabs with keyboard actions poses a security risk. How can it be a security risk?
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
2
votes
2answers
99 views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
4
votes
2answers
64 views

Sorting hosts via open ports using NMap

I was tasked with running a NMap scan against our corporate network and compiling a list of only live endpoints. My issue is how to go about separating out the hosts via their open ports (printer/...
0
votes
1answer
81 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
10
votes
1answer
155 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
1
vote
1answer
92 views

How to detect zip file encryption algorithm

As we know zip files supports a simple password-based symmetric encryption system and some vendors use other algorithms. I used the zipinfo command in Linux but it doesn't say what encryption ...
0
votes
0answers
7 views

Can one setup an application whitelist for other applications even encompassing the root user on Linux?

Is it possible to restrict an application program to being used/called only from designated programs without having resorting to specific code testing or wrappers? This restriction has to apply to ...
0
votes
1answer
116 views

Found 0000 Permission Files on a hacked server

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and ...