Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

3
votes
2answers
331 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
5
votes
1answer
49 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
5
votes
1answer
153 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
2
votes
1answer
85 views

Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt)

Using Linux, I have system and swap/hibernation partitions encrypted with LUKS, and data partitions encrypted with Truecrypt, and I am wondering when I put my laptop to hibernation if the encryption ...
2
votes
1answer
95 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
2
votes
1answer
57 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
2
votes
1answer
330 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
8
votes
0answers
470 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
2
votes
0answers
16 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
2
votes
0answers
45 views

GUI isolation in X11 when entering Truecrypt password

I have been getting a bit paranoid regarding some of my old TrueCrypt containers. The paranoia has got nothing to do with suspicions regarding TrueCrypt itself (after the shut-down last year), rather ...
2
votes
0answers
142 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
1
vote
0answers
23 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
1
vote
0answers
65 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
1
vote
0answers
26 views

Linux PAX, execute and write permissions

I would like to know what happens when a section of a program is compiled with both execute and write permissions and PAX is enabled on the system? Is the program successfully loaded? Is the section ...
1
vote
0answers
57 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
1
vote
0answers
107 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
1
vote
0answers
161 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
0answers
103 views

IPtables accepting SMTP without being configured?

Well i was building a new server and inputed there some IPtables rules, i set postfix and send me an email to try it out, to my surprise the email reached perfectly without me declaring a rule for the ...
1
vote
0answers
215 views

How should I configure my Tor-dedicated firewall for optimum security?

I'm setting up a Tor-based isolating proxy using the 'Anonymizing Middlebox' iptables rules specified here: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy i.e. iptables -t nat ...
1
vote
0answers
67 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
1
vote
0answers
29 views

Tracking checkins from generic users

Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
1
vote
0answers
246 views

Linux Physical memory analysis using hexeditor for Forensics

I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using ...
1
vote
0answers
116 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
0
votes
0answers
20 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...
0
votes
0answers
39 views

Strange SECCOMP entries for sshd in audit log

I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be ...
0
votes
0answers
87 views

How 'private' is my setup?

I'm currently running QubesOS (so essentially a virtualized Fedora operating system), which I use to access an offshore VPS through I2P (using garliccat). I then route all my traffic through the VPS ...
0
votes
0answers
18 views

At OpenSSH ssh server side key files has 0 data. I would like to know the reason for it

I am using the Monta Vista Linux. In this recently i have observed the ssh keys files has 0 data due to which the keys were not generating and i am not able to login to machine via ssh because of key ...
0
votes
0answers
82 views

TPM Command Line Tools

I am trying to create a key storage hierarchy on TPM (Trusted Platform Module) on Linux (CentOS 6.4). The most commonly recommended TPM tool suite on Linux is TrouSerS. However, the command line suite ...
0
votes
0answers
43 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
0answers
204 views

Discovered unexplained large salted files in root folder on Linux, possible keylogger?

So I had Linux Mint running on my laptop, just installed it a month ago. It has a small hard drive, just 160gb, and I noticed shortly after installing the system, it ballooned to 80-some gigabytes ...
0
votes
0answers
199 views

Man in the middle attack, bridging wlan interface to virtual wired interface at0

I'm trying to execute a Man in the Middle attack on my mobile phone, I have two wireless cards, one inbuilt in the laptop, running AR9285 atheros drivers, the 2nd is an Alfa AWUS036NHA card with an ...
0
votes
0answers
118 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
193 views

Is there any method to prevent/trace ddos attack?

I have a debian linux server which run a few online game services. I have some competitors in this area and i think one of them is behind the ddos attacks. I have full access to the router, so I set ...
0
votes
0answers
198 views

Protecting against bad USB in ubuntu

I am referring to this thread: How to prevent BadUSB attacks on linux desktop Since i want to install ubunto onto a possible infected usbDrive using a live DVD and the installation manager i was ...
0
votes
0answers
81 views

Secure password transfer from stdout to another window

I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username ...
0
votes
0answers
90 views

Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos

Hello I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server. I wanna do this using Netsh advfirewall, In Linux I use IPTables: iptables -I INPUT -p tcp --dport ...
0
votes
0answers
40 views

how can I authenticate a process from kernel side?

I would like to authenticate and integrity check a single process before its execution. That authentication and integrity checks should be on kernel side for obvious reasons. I was thinking to add ...
0
votes
0answers
198 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
0
votes
0answers
190 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
-5
votes
0answers
29 views

generating wordlist + a random digit

Can the Crunch software be used to read word list from a text file and append a random digit at the end of each word?