Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [centos]

CentOS is a free operating system distribution based upon the Linux kernel. It is derived entirely from the Red Hat Enterprise Linux (RHEL) distribution.

1
vote
0answers
47 views

Rationale for removing cronie-anacron

My Nessus scanner reports that I need to remove cronie-anacron. What is the rationale for this? The Nessus output is: 3.3.b(2) Disable Anacron checking that the anacron RPM package is not ...
1
vote
0answers
20 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
1
vote
1answer
651 views

Is TLS 1.3 supported in Dovecot 2.3.4 and Postfix 3.3.2?

I would like to configure an email CentOS 7-based server to use TLS 1.3. Currently it uses TLS 1.2 for securing the SMTP and POP3 sessions. For SMTP I use Postfix software and for POP3 I use Dovecot ...
1
vote
1answer
58 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
0
votes
1answer
38 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
2
votes
1answer
46 views

php-fpm.log shows a mass of unusual attempts to open primary script with random filenames [duplicate]

I recently happened to inspect my php-fpm.log and found a lot of suspicious activity that looks like malicious attempts to get access to my host. Here're some of the logs: [07-Oct-2018 22:01:31] ...
3
votes
2answers
605 views

OpenSSL Certificate Renewal with same keys and NO CSR

I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is ...
0
votes
0answers
66 views

Disable SSLv3 in IPSec CentosOS

I have been told to shut down support to SSLV3 - TLS 1.0 - TLS 1.1 to all encrypted communications towards external web services. Now, I have an IPSec/CentOS gateway in front of my Data Center.How ...
2
votes
1answer
168 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
0
votes
0answers
300 views

Linux Kernel ldso_hwcap_64 Stack Clash Privilege Escalation

Linux Kernel ldso_hwcap_64 Stack Clash Privilege Escalation I want to test this exploit on a CentOS 7.3.1611-based VM. However after having compiled the executable, say privesc, I run it with privesc ...
5
votes
2answers
202 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
0
votes
3answers
225 views

Tor exit node as CentOS mirror

Today we saw traffic going from CentOS servers to a Tor exit node. This caused some raised eyebrows and led us to investigate what was going on. In the end it turned out that this exit node also acts ...
1
vote
1answer
189 views

How to acquire security advisory for CentOS?

I've been seeing security advisory number like CESA-2017:1842, and after search I could only find some of them in mailing list archives such as this. Is there a website like https://usn.ubuntu.com or ...
0
votes
1answer
243 views

Are there open by default ports with Centos 7's firewalld?

My Centos7 firewalld has TCP ports 8083, 8086, and 5000 open. I don't recall opening them, except for maybe 5000 when first learning about firewalld. Are there any ports that might come out of the ...
5
votes
3answers
2k views

How secure is ssh key-based authentication

I have a newly installed (and updated) Centos 7 server I use for testing. I implemented RSA key based authentication for ssh and set PermitRootLogin to without-password When I logged on this morning ...
-1
votes
1answer
575 views

Does anybody know if CentOS have official support for OVAL definitions?

I saw it here that CentOS have no official support for OVAL security definitions(patch, vulnerabilities). Based on what I observe at oval.mitre.org, it looks like they don't even have a vulnerability ...
0
votes
1answer
818 views

Android pinning SSL handshake Exception after SSL renewal of website

i've an android app with ssl pinned it was working fine but after i've renewed the SSL now its throwing exception javax.net.ssl.SSLHandshakeException: java.security.cert....
1
vote
1answer
131 views

Impacts of running “./CA newca” command in /etc/pki/tls/misc/ when CA already exists

After accidentally running "./CA newca" from /etc/pki/tls/misc, I noticed a few files getting updated in /etc/pki/CA, and possibly more. But there weren't any prompts when running the command like ...
0
votes
0answers
3k views

Bot called “gweerwe323f” accesing ssh?

we've got an abuse mail to our server that says 'your server is attempting to hack ssh of another server etc...'. Then we've checked our server and in History command we've seen some logs as shown ...
5
votes
1answer
907 views

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
3
votes
1answer
225 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
-1
votes
1answer
131 views

Buffer overflow process in my server(How detect rootkit)? [duplicate]

Today i'm update my web server on Cent OS 6 and like this if see top 2593 root 20 0 196m 5228 212 S 730.6 0.1 484:18.06 wjeackglrl 8648 bitrix 20 0 399m 85m 7580 R 42.5 2.2 0:23....
3
votes
1answer
90 views

Preventing Website Directory Listing

When my CentOS 7 Apache web server was compromised recently, which hosts multiple sites, a script was uploaded to one of the sites and then used to add files to any other sites on the server that had ...
9
votes
3answers
18k views

Privilege escalation using passwd file

If I have a world writeable /etc/passwd file on a system, how can I escalate my privileges to root? I am currently a underprivileged user. The underlying OS is CentOS 7.2 in case you are wondering I ...
2
votes
1answer
872 views

What Does This Command Do? Should i be worried?

So I was debugging my code when I see these few lines in my log: GET /cgi/common.cgi 302 8.015 ms - 23 GET /stssys.htm 302 2.928 ms - 23 GET / 200 134.922 ms - 9896 POST /command.php 302 33.826 ms - ...
1
vote
1answer
228 views

RFI - Is this possible even if you use an Application Server?

Since JBoss is acting as a middleware - Application Server - I was wondering if it's still possible to face with File Inclusion attacks.(?) The reason I was wandering so is that in such a case, no ...
19
votes
5answers
3k views

Stop large requests to my server (TOR)

I am being attacked right now from Tor nodes which are doing 404 requests to my HTTP server. It is from one IP but when i use the DROP iptables rule, it starts again from another IP in a matter of ...
7
votes
1answer
218 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
14
votes
1answer
763 views

Determining httpd PHP Scripts with Auditd

Background I have an issue on my server where some hole is allowing malicious PHP files to be written to any world-writable directories beneath the web root. It is not currently causing any harm, as ...
21
votes
2answers
7k views

Backdoor account in passwd file

Long story short I was making sure a web app didn't create a LFI vuln by attempting to open /etc/passwd with it. My first attempt to prevent LFI was unsuccessful and listed out the file, and I noticed ...
2
votes
2answers
80 views

To what extent are supplementary yum repositories certified by CentoOS?

I'm building something which uses libsodium and will run on Ubuntu and CentOS 7. Ubunutu has the libsodium-dev package, but CentOS doesn't seem to include it by default. I see instructions to use ...
0
votes
1answer
292 views

Apache: Can I revoke certain client certificate on certain subdomain only

I would like to know if we can make the client certificate valid for certain sub domain (Virtual Host). For example if I have two client certificate A, B. A is valid for subdomainX but not for ...
1
vote
2answers
164 views

Using CentOS, is it OK to encrypt copies of root directories and mount the encrypted copies in place of the original root directories?

I am using a CentOS running on a Cloud Hosted Virtual Machine. The cloud hosting service is Digital Ocean. The cloud hosted VM dose not allow you to use full hard disk encryption as it dose not ...
2
votes
2answers
56 views

Is secure to enable tools like git on shared server?

I want to know if there is a real security reason to not enable tools like git, WP-CLI or npm. I want to run a server (Centos/CPanel), but I want to be sure that enabling them would not be a risk. ...
1
vote
1answer
2k views

OpenSSL version 1.0.1e in CentOS 6 — Heartbleed Vulnerability

I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that version 1.0.1 to 1.0.1f are affected, as shown in below pic. I have CentOS ...
2
votes
1answer
986 views

What's the motivation for excluing /usr/local/bin from root's PATH?

I just discovered that root's PATH on CentOS does not include /usr/local/bin. What's the rationale for this? I'm tempted to add it to the PATH but I don't know what vulnerabilities that might ...
0
votes
1answer
174 views

LFI Why would I not see a response

I have the below two vulnerable PHP code sections in 2 files. I found the sources of these in an anony access FTP backup file home.tar.gz. So I'm getting the content of /etc/passwd with the null byte ...
1
vote
2answers
168 views

DROWN CVE-2016-0800 Patch Missing on Centos 7

My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800). I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5....
-1
votes
2answers
239 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
1
vote
0answers
209 views

What's going on with connections to/from bluecoat?

I'm trying to track down a cause on an Internal Server Failure for an Apache server. The IP address changed recently, so I thought the crash might be related. A quick search of the old IP: $ sudo ...
1
vote
1answer
45 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
-1
votes
2answers
266 views

How can I prevent booting from media devices?

first of all, I deeply apologise because of my silly question. The thing is that I am learning about hardening. I have VMware workstation 12, and I've created a VM CentOS 7 machine (to be integrated ...
3
votes
3answers
181 views

How do I demonstrate OpenSSH redhat/centos patchlevel to auditors?

A common problem is that Redhat backports security fixes leaving OpenSSH with an old, but not vulnerable, rpm version and ssh version string on Redhat and CentOS. This fools auditors. Apparently, the ...
1
vote
1answer
4k views

Monitoring HTTP traffic on openvpn server

I have configured an OpenVPN server and can monitor HTTP traffic via tcpdump. Is there any way to monitor the HTTPS traffic as well? Hints Self Signed SSL certificate as root certificate on VPN ...
6
votes
1answer
2k views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
3
votes
2answers
934 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
2
votes
1answer
217 views

Would placing a hardened virtual machine in a VPS provide more security?

I have been working with DigitalOcean for a while now and while I do like that they make it easy to start up with a fully functioning virtual machine ready to go. It makes me cringe a little though ...
0
votes
1answer
91 views

Mitigating POODLE

First off, let me say that I'm a Windows admin trying to address a vulnerability in Linux, so please use small words. I have a CentOS server that has been identified as being vulnerable to POODLE, so ...
4
votes
3answers
1k views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
-1
votes
1answer
128 views

Are there security implications to not installing the Leap Second patch on Red Hat systems? [closed]

What are Leap Seconds? A leap second is a second which is added to Coordinated Universal Time (UTC) in order to synchronize atomic clocks with astronomical time. The reason we have to add a second ...