Tag Info

New answers tagged

0

From your description, I suspect your correct. That is, full disk encryption does not add any real protection for your data on a running server should someone compromise that server to extract the data. This is not what full disk encryption is designed to achieve. However, this doesn't mean there is no case for having full disk encryption on a server. As ...


1

If the malware is copying the files after they have been written to the disk and without requesting the files through the filesystem (which will decrypt them), encryption will protect them. If the malware is intercepting the files before they are written to disk or is accessing them through the filesystem encryption will not help. Encryption only protects ...


6

You could use nmap to get a better view of the (network)services it is running: nmap -sS -v <your_server> -sV -p1-65535 and lsof to view the current inbound/outbound connections to the box. lsof -i If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended ...


1

The kernel normally gets its first 'base' time from the RTC or Real Time Clock so while it won't be as accurate yet as after the NTP protocol has updated the time. it is sufficient to validate a signature of a certificate. you can set this value normally in the BIOS before ever booting an OS.


3

You may want to try: usermod -p '!!' root usermod with the -p parameters takes the raw value to bet set as encrypted password in the /etc/shadow files. The traditional usage of this parameter is to give to usermod an already encrypted password, but it accepts also the '!!' flagging the account as locked. In the end, this command will remove the current ...


0

Thank you everyone for the feedback. In summary, the title question, is FDE for a server in a secure data center pointless? The answer is not necessarily as there could be scenarios where one would want the additional protection on the physical devices. For instance protection during destruction, protection from the host country, or protection in case of ...


1

The potential problem with cloud machines and randomness is VM cloning; see this. Any decent Linux system will be able to produce high-quality randomness from /dev/urandom at any point after boot, regardless of whether it sits in the cloud or not. However, if a VM is cloned, then the two machines will start at the same internal state, and there is no safety ...


1

Quote: " . . .they have done little to nothing to actually reduce risk associated with unencrypted data. . ." Ok, yeah, I think you are right. The simple answer is "it is pointless", but "it is also NOT pointless." Which is why, and forgive me for saying this, I think you may be barking up the wrong tree. Let me explain. The full disk encryption (FDE) does ...


7

Consider what you mean by 'secure' data center. Generally, I don't consider anything secure against a determined and well-resourced attacker. True, having 18" of reinforced concrete, double man-traps, and armed security provides a fair amount of protection, but it's rare that this protection is all just for you. In most co-location facilities, the only ...


1

Not surely. It depends on, against what you want to defend yourself. Some examples: If you live in a country, where the government can confiscate your server to analyze its content and then use it against you, or your employer. If you are the owner of the server, but won't give the possibility of your employee/collegues having physical access to it, that ...


7

There are attacks on the firmware of hard disks. Googling for hard drive firmware attack will return some results about what the NSA does or can do, which probably isn't very relevant to you; but even hobbyists are able to modify the firmware of drives. This guy even installed a linux kernel on his hard disk - no, it wasn't the PC that ran linux, the hard ...


1

As @kjetil-limkjær points out, Powershell version 4 and up includes the Get-FileHash cmdlet. powershell get-filehash -algorithm sha1 <file_to_check> Use doskey to make a persistent alias that's easier to remember. doskey sha256sum=powershell get-filehash -algorithm sha256 "$1" doskey sha1sum=powershell get-filehash -algorithm sha1 "$1" doskey ...


13

If the decryption key is stored in plain on the very same media as the encrypted data, then the encryption is pointless. If you have a set of rules, which require data to be encrypted, but permit storing the key in plain on the very same media, then the rules are flawed. If you ever face such a flawed set of rules, you should point out the flaw. If the key ...


60

Two generic things you apparently have missed: In case of disk failure, having the data encrypted at rest solves the issue of having potentially sensitive data on a media you can't access any more. It makes disposing of faulty drives easier and cheaper (and it's one less problem) Full disk encryption also makes it harder for an attacker to retrieve data ...


2

I'd recommend reading the original paper on the Cold Boot attack. Section 6 explains "Identifying keys in memory." They wrote an app called "keyfind" that you might be able to search for.


3

It highly depends on what software you're using to manage the keys. For example, the proprietary crypto library we use here splits the key over several memory locations, flips them big-endian / little-endian, etc and only reassembles them when they're needed. Any good crypto / key management tool will have its own bag of similar obfuscation tricks. This will ...


0

PPTP is not secure How can I tell if a PPTP tunnel is secure? If you want to browse the Internet without being monitored then use a program like OpenVPN. Please see the comment below your question as it is important.


6

No, having keys for your root user does not impact your security profile. It is wise though to disable root login in ssh and NOT have an authorized_keys in your /root/.ssh/ folder. However. I got the feeling your going about this the wrong way. Personally, I would not use the root user in this manner (but a system user like www-data) and make several ...


3

With your unencrypted boot partition, malware could theoretically replace your unsigned kernel with its own (say, a hypervisor running your original kernel). This malware would then be undetectable by your system, while having full access to it. A signed kernel closes this hole, at least in theory: since the malware hypervisor isn't be signed, a EFI BIOS ...


1

This is an attempt to exploit CVE-2014-6271 (the “shellshock” vulnerability, if we must). Its appearance in this message is no indication that it was successful; any client can include any string in the Referer: header and have it included in logs here. The attempt didn't succeeded in this specific case, because the log message is telling you there was no ...


1

So it looks like someone is trying to use the shellshock vulnerability which was recently discovered in the bash shell. The key give-away is the part of the log which reads: referer: () { :;}; /bin/bash What the attacker (or unknowing participant) has done is to set their web browser's http referer header to everything you see after the word "referer" in ...


2

I agree that the execise is intended to detect the race condition, but as there's no error checking in place (just a set -e would work), there are more holes available: As /tmp is a shared folder, I can create a /tmp/shadowcopy with mode 666 (so you can open and write it, but not chmod). If your script were run by a being member of shadow group (so ...


4

If you consider that attackers may recover the RAM contents (a cold boot attack) then you have to take into account that attackers may recover the RAM contents. Your /tmp filesystem is used by application as a temporary repository for some data elements, but the same applications read it back -- into RAM. That is, the RAM-based filesystem is unlikely to ...


3

The cat binary doesn't implant flock() calls using the LOCK_EX for exclusive write access so your assumption is correct. You can verify that by following the system calls issues by that or any binary by running strace cat file. A way to prevent the problem would be as follows: #!/bin/bash set -e ( flock -n 200 echo > /tmp/shadowcopy chmod 600 ...


5

In short, there is no way to know this. There are to many 'badly written' USB controller chips out there that either not report that you can write to them. or worse report you can. but simply ignore any attempt to write to them. So without knowing specifically what chip it is you can not know how it reacts to such an instruction. As a even worse case ...


2

(Disclaimer: I am not an authority on OpenVZ. This answer is more opinionated than my answers usually are, so feel free to criticise!) OpenVZ might be "more" secure in that it does not integrate with the entire kernel, so that its attack surface is a bit lower. Though, essentially OpenVZ is what served as inspiration for namespaces and hence ultimately, LXC ...


1

As others said, putting SSH on a port other than 22 will make more unlikely to be hit with a random scan. You will be targetted if the attacker is trying to get your server, not any server. I have a server with ssh bound to a random high port. And I have a ssh honeypot on port 22, that will reply to any and every login attempt with a 'access denied' ...


1

This is something of a philosophical question: "is control X helpful?" And as the best answer pointed out, you should also consider "what are the costs (client support, doc exemptions, system support, monitoring support, and I'd throw in direct costs, licensing costs, etc) of control X?" Anything is helpful in certain contexts. It is a good idea to ask ...



Top 50 recent answers are included