Questions tagged [debian]

One of the earliest Linux distros and officially consist of only free software. Many distros has been derived from the Debian codebase, like Ubuntu and Knoppix.

Filter by
Sorted by
Tagged with
33
votes
2answers
9k views

Is having a hidden directory under /etc safe?

On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
9
votes
2answers
451 views

Remote Code Execution in apt/apt-get

Recently, a vulnerability has been found in apt that allows arbitrary code execution, see here. Is it reasonable just to update the system? Or we should be worried that this has been used and so ...
8
votes
2answers
3k views

Prevent ARP spoofing with dynamic static entry on Linux

ARP spoofing detection/prevention seems to be quite popular here. With other techniques like port stealing aside, I'm wondering if the following could work to prevent it: Whenever my Linux ...
6
votes
1answer
2k views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
5
votes
1answer
3k views

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

According to NIST and HIPAA guidance, I miss one cipher on a new web server: TLS_RSA_WITH_3DES_EDE_CBC_SHA Despite I read this one is discouraged, I am curious as to how do I add it? I am on Linux ...
5
votes
1answer
925 views

All weak Debian openssl DSA keys

More weak keys? 32768 weak keys can be downloaded for analysis, but are there more? Three times as many? There is much information about DSA-1571-1 openssl -- predictable random number generator. ...
5
votes
2answers
490 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
4
votes
3answers
1k views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
3
votes
3answers
199 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
3
votes
2answers
2k views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
3
votes
1answer
318 views

Is binding all private services to the 127.0.0.1 address and then accessing them via SSH using an RSA key pair of 4096 bits secure?

Is it secure to bind all private services only to the 127.0.0.1 address, and then use a local SSH client's local port forwarding with an RSA public / private key pair file of 4096 bits and a ...
3
votes
1answer
406 views

Hacked debian server alternative boot

The server of a customer has been hacked last night. It is a standard debian distribution with mysql, apache and ssh for remote access. The way it has been hacked is very peculiar. The standard URL ...
3
votes
1answer
270 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
2
votes
2answers
3k views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
2
votes
4answers
2k views

Unauthenticated packages in debian

Yesterday I updated my debian server using: apt-get update && apt-get upgrade I received message that some of the packages cannot be authenticated being in a rush I hit yes to install ...
2
votes
1answer
177 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
2
votes
1answer
82 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
2
votes
1answer
322 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
2
votes
1answer
891 views

How fix warnings from Debsecan

I'm new in linux admin and security approach, and need some tips about warnings from Debsecan scanner tool. I have some warnings returned by simple check, like this below: CVE-2017-1000158 python2.7-...
2
votes
1answer
65 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
2
votes
1answer
308 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
2
votes
1answer
193 views

How to understand how someone had ssh access, and how to remove CVE-2017-0358

I have a home server that was compromised recently, it has been used to mine some crypto currencies. I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
2
votes
1answer
1k views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
2
votes
1answer
1k views

ClamAV findings under Debian 9: LibreOfficeMacros and PUA.Win.Exploit.CVE_2012_0110-1 - false positives?

I'm running a recently installed Debian 9.1 with KDE and a ClamAV scan gives me these findings: /usr/lib/libreoffice/share/extensions/wiki-publisher/WikiEditor/Module1.xba PUA.Doc.Tool....
2
votes
1answer
2k views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
2
votes
1answer
229 views

Would placing a hardened virtual machine in a VPS provide more security?

I have been working with DigitalOcean for a while now and while I do like that they make it easy to start up with a fully functioning virtual machine ready to go. It makes me cringe a little though ...
2
votes
2answers
120 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
2
votes
0answers
69 views

Can high network usage be detected and prevented in Tor? [closed]

I've already asked this question here but as of yet it has no views/answers. I was wondering if there is any way for Tor to detect high network usage in the context of transferring large files using ...
1
vote
2answers
722 views

How to know if a host has been compromised and re-secure it again? (particular case of a raspberry) [duplicate]

I'm running a raspberry PI and I've accidentally left the 22 port open to it from a public IP for about 24 hours. Raspberries' raspbian distro comes by default with a "pi" user and "raspberry" ...
1
vote
1answer
302 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
1
vote
1answer
600 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
1
vote
2answers
285 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
1
vote
1answer
584 views

protect c ++ application via an automatic hardware binding

I have a Qt App which is running on a raspberry pi (Debian Wheezy). The raspberry image is autogenerated via a python script: - Get the latest version of the generic custom-raspi-image - Mount the ...
1
vote
2answers
745 views

Is wiping LUKS header needed?

So I previously had an encrypted install of Debian, and wanted to install a new distro with full system encryption again. Now I understand that you don't need to fill the disk with random data if you ...
1
vote
1answer
87 views

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
1
vote
1answer
539 views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
1
vote
1answer
73 views

Remove sync user to harden the system

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, ...
1
vote
1answer
530 views

Suspicious SSH connection

this is the situation: vps with debian 8x32 virgin (new template of the provider's repository); exotic "user" and strong "password" ; 30 seconds later: command (apt-get update); 30 seconds later: ...
1
vote
1answer
475 views

How can I check whether file modified time has been spoofed on ext4?

On Debian based system (Ubuntu 14.04.3 server specifically), using ext4 filesystem. How would I discover if files have been changed, but the modified times have been made to look like the files have ...
1
vote
1answer
51 views

Sufficient to only install security updates on Debian?

On my Debian, I only do security updates: deb http://security.debian.org/debian-security/ buster/updates main deb-src http://security.debian.org/debian-security/ buster/updates main For example, ...
1
vote
1answer
142 views

Can not setting password for root when installing linux be exploited?

Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
1
vote
1answer
154 views

Is there a way to ask cracklib-check to go through a list of passwords?

I know cracklib-check can be used to check individual password, like - $ echo "12345" | /usr/sbin/cracklib-check 12345: it is too short If not wanting to be super-user as on Debian it requires to ...
1
vote
2answers
775 views

OpenVPN and running other services on same server

What security implications should I know about/look for when running OpenVPN on the same server as my network cloud controller and apt-cache-ng? I plan on using the same server to run apt-cacher-ng ...
1
vote
0answers
25 views

Create signed release binaries and distribute with custom repository (debian)

I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther. I set up a ...
1
vote
1answer
70 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
1
vote
0answers
75 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
0answers
24 views

Version earlier than 0 in Debian OVAL feeds

I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
1
vote
1answer
2k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
1
vote
0answers
201 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...