Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1,778
questions
0
votes
1answer
26 views
Any known vulnerabilities for thttpd 2.25b 29dec2003
Quick question, having trouble finding any information online relating to that specific year for the given version thttpd 2.25b 29dec2003. Need to explain what vulnerabilities this may have had, if it ...
0
votes
0answers
21 views
Possible to verify the integrity of AIDE itself?
I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
0
votes
0answers
18 views
What can be a reason if testssl stops scanning in the process? [closed]
I'm scanning servers with testssl, but it seems like that some of them have stopped running, or maybe they are paused. I'm using linux screen and there are 15 detached processes running. Half of them ...
0
votes
0answers
25 views
OSSEC HIDS Alerts from agents [closed]
Which directory or location does the OSSEC server receive the alerts or logs from OSSEC agents and where is this path defined in the OSSEC configuration file?
1
vote
0answers
53 views
How to disabel relro to overwrite fini_array element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
0
votes
0answers
23 views
Secure partitioning: does LVM affect hardening guidelines?
this is the second of a series of questions on hardening Linux servers at the filesystem level. The first is here. The same scenario applies; I copy it here for convenience:
At work I'm hardening an ...
0
votes
0answers
22 views
Secure mount options in Ubuntu CIS benchmarks too narrow?
this is the first of a series of questions on hardening Linux servers at the filesystem level.
At work I'm hardening an Ubuntu 18.04 Server following the CIS benchmark 2.0.1. Instead of just running ...
1
vote
1answer
64 views
Local Burp Proxy not showing routed packets
I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62.
I am trying to route my all packets from my wlp2s0 interface to burp proxy which running on 8080 and I also ...
6
votes
1answer
98 views
Is explicitly disabling a default in the sudoers file the same as not listing it at all?
I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:...
3
votes
0answers
81 views
Is accessing /proc/ inside docker container a security breach?
In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container)
In a meeting, a co-worker said that this ...
0
votes
1answer
65 views
Restore integrity of compromised live boot iso
Assuming that BIOS integrity can be restored by resetting with the manufacturers bypass code, can a USB device running a corrupted/compromised Linux distro be restored to a state of integrity? The ...
-1
votes
1answer
45 views
Run Phone Apps in VM Anonymously and Security Risks of Virtualbox
Would it be possible to run phone apps that connect to the internet (eg. youtube, instagram, etc.) on an Android VM (or any sort of phone VM, doesn't need to be android) in VirtualBox within a host OS ...
0
votes
0answers
45 views
.htaccess File Changed - Question About Possible Breach Or Default Defense Mechanism
Today I got reports about one of my websites becoming inaccessible. I've come to learn that at the time we were under DDOS attack.
After getting through that, the website started throwing a ...
0
votes
0answers
9 views
Why does Docker use the same user and cgroup namespaces by default, when starting a new container? [migrated]
Why does Docker use the same user and cgroup namespaces by default, when starting a new container?
I don't understand why Docker doesn't set up a new user namespace, so that root in the container isn'...
-1
votes
0answers
69 views
How to detect code injection on linux
is there any way to detect code injection in a running process under linux ?
For code injection I don't mean "patching" original binary on the disk, for code injection I mean when for example you ...
0
votes
0answers
58 views
How to globally disable protocols < TLS 1.2 at openssl library level [migrated]
I've been asked to disable the use of all SSL, and TLS < TLS 1.2, globally on one of my Centos boxes. Its been suggested that I should be able to do this in the openssl library.
I'm reasonably ...
0
votes
0answers
49 views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
1
vote
1answer
37 views
How do I make it so aireplay-ng deauth doesnt send a broadcast?
Doing some testing on my home network with Kali and was messing around with deauth commands using aireplay-ng, however when I input my target IP address it will still send a broadcast and deauth all ...
2
votes
1answer
120 views
Can a user hack a server running apache from a website
Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host ...
0
votes
1answer
103 views
How .bashrc can be used to attack a system?
I read about this malicious Sudo function on Nullbyte where by inserting this bash function into a victims .bashrc/.bash_profile an attacker
could exfiltrate sudo passwords fairly easily.
This got ...
-1
votes
0answers
42 views
How to make proxychains work as transparent proxy server [migrated]
my proxychains is configured to use several proxy server and it work fine in local-host, but i need to route all traffic of other host's to routed through proxychains-host! something link this:
my-...
1
vote
1answer
53 views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
0
votes
1answer
30 views
How to block for open Web Shell in my CentOS 6
I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
2
votes
2answers
164 views
“Tor Profile” folder in Brave Browser cache
I am using Brave Browser Version 1.0.0 Chromium: 78.0.3904.97 (Official Build) (64-bit) on Ubuntu 18.04. The browser has an option, open new private window with Tor . When looking into cache files ...
0
votes
0answers
61 views
Outside Router MitM Attack
I'm trying intercept my router's ACS requests which are behind HTTPS. I don't think my router validates certificates so it is possible to do a MitM attack. I'm using a debian installed laptop with two ...
0
votes
1answer
62 views
Vulnerable stored Linux kernel version
I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:
user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3....
2
votes
0answers
72 views
A bitcoin miner is getting install on my web server with the apache2 process [duplicate]
For a few weeks, someone, probably a bot keep installing a bitcoin miner on my server, I find it because it is taking all the CPU. The process name is kdevtmpfsi located at /tmp/kdevtmpfsi, there's ...
1
vote
2answers
114 views
Is there something insecure about storing secrets in plain text on the host FS?
There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
1
vote
1answer
197 views
Is someone trying to hack into my server?
I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked ...
1
vote
1answer
94 views
Risk of Docker backdoor allowing impersonation
I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.
I work in a company which is developing some ...
0
votes
1answer
62 views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
0
votes
1answer
89 views
Have I used LUKS properly?
I am about to go travelling to some high risk countries where corrupt officials will most likely try to go through my laptop and external HDD.
I am using Linux Mint and LUKS. Could someone please ...
2
votes
0answers
67 views
Disk encryption with automatic reboot and no-network [duplicate]
I am using crytsetup with LUKS to encrypt a data drive, separate to the system drive, under Ubuntu 16.04. The issue I am facing is that this system will also be required to automatically start itself ...
-3
votes
2answers
169 views
Can arch Linux be used for pentesting [closed]
I currently use very much Ubuntu and Kali from the Debian family for penetration testing (Network and Apps) and I want to know if anybody has tested arch Linux or other distros for penetration testing....
1
vote
2answers
91 views
Locking server ‘root’ to IP whitelist, But prevent my lockout
To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file. But getting locked out of my server is even worse than getting ...
2
votes
3answers
191 views
Would services or whole operating systems written in pure Python/Java be safer?
Many Windows and Linux services are written in C and/or C++. Due to that fact, they can be exploited in several ways due to the lack of memory security (buffer overflow, etc.).
Are services written ...
11
votes
1answer
3k views
Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?
Ubuntu 20.04
iptables 1.8.4-1
I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router:
-A INPUT -s <...
2
votes
1answer
108 views
entropy change when reading from /dev/urandom vs /dev/random
I noticed that when reading from /dev/random, I have a very real impact on the entropy available on my linux box.
(reading from /proc/system/kernel/random/entropy_avail),
Yet when reading from /dev/...
5
votes
1answer
196 views
How to hide Kernel Symbols in Linux Kernel Image? Recompliation?
Why hide kernel symbols?
Quote
Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
1
vote
1answer
120 views
Is apparmor default deny?
Is apparmor default deny? For example consider the case under SELinux in enforcing mode, where I install a package with no policy associated with it. SELinux's default behaviour is to deny all ...
4
votes
0answers
70 views
Is there a reason why ARP spoofing would be used for spying instead of sniffing promiscuously?
I am a student trying to demonstrate an ARP spoofing attack. To test whether my attack was working I decided to use wireshark to sniff the packets on the attacking machine. At first I thought I was ...
1
vote
3answers
174 views
Why after dd'ing ISO file to entire USB flash device, only the first partition match the ISO checksum? [closed]
I use dd to "burn" an ISO file to USB stick:
dd bs=4M if=/mnt/media/ISO/Fedora-Workstation-Live-x86_64-31-1.9.iso of=/dev/sdd conv=fdatasync status=progress
Now I can see several partitions has ...
0
votes
0answers
72 views
How to change the default root password on my DIR-819 router (SSH login flaw)?
On my d-link router, a DIR-819, there is by default an open SSH port (22), which accepts a default username and password, namely root/root and admin/admin.
I found this by running a network scanner ...
0
votes
3answers
195 views
ret2libc - why need 4 bytes of garbage
So I started to learn reverse engineering, and I came across the ret2libc exploit.
I tried to understand how it works and I got a bit confused.
They say that when you return to the address of system ...
1
vote
2answers
65 views
Private way to connect to my SQL Server database
I'm running on linux and I am using a SQL Server database server on some other machine.
My python code has to sit in a directory that many other users have read access to.
I also have a "...
1
vote
1answer
80 views
Is there any reason why PHP files require write permissions?
Is there any reason why PHP files would require write access? (Excluding directories that need to be writable)
I'm installing Magento via composer. They recommend the following permissions:
cd /var/...
3
votes
1answer
89 views
How to keep backup servers safe?
I use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these ...
12
votes
5answers
478 views
How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
0
votes
1answer
107 views
MITM setup using airmon-ng, iptables, and isc-dhcp server
I want to set up a MITM-scenario as an exercise for myself. My setup looks like this:
Internet <--------> Laptop <----------> Client
At this stage I just want to route the traffic from my AP ...
0
votes
2answers
76 views
Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?
I have a content site https://www.mysite.com
I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
