Securing Linux systems and applications; understanding Linux security features.

learn more… | top users | synonyms

1
vote
3answers
38 views

Mutual authentication of SFTP server

We can use public/private key pairs for client authentication when connecting to a SFTP server. Can we also have mutual authentication so the client also verifies a public key from the server? Both ...
1
vote
0answers
18 views

Can linux cgroups and namespaces assist hiding malware?

Reading about sandboxing/security possibilities I was looking a bit into cgroups and namespaces and asked myself: How do I know that my linux root account is indeed the real root account and not ...
1
vote
1answer
52 views

Raspberry Pi IDS/FireWall - Should I? [on hold]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
1
vote
1answer
76 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
20
votes
4answers
4k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses? [duplicate]

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
5
votes
0answers
49 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
0
votes
0answers
3 views

Why ecryptfs still remain in mtab? [migrated]

I use ecryptfs for encrypted lxc container container start ok and stop ok But i see even after stop this line /var/container-lxc/face/rootfs.crypt on /var/container-lxc/face/rootfs type ecryptfs ...
0
votes
0answers
17 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
1answer
24 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
15
votes
6answers
3k views

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
0
votes
0answers
29 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
1
vote
1answer
26 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
1
vote
2answers
73 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
3
votes
1answer
53 views

Turn RPi3 Wi-Fi adapter into monitor mode using airmon-ng

For some reason, I can't turn the built-in Wi-Fi adapter on the new Raspberry Pi 3 into monitor mode like I used to do on other platforms. First I kill the processes that interfere with sudo ...
2
votes
2answers
44 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
2
votes
1answer
22 views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
25
votes
3answers
3k views

Does using a live CD make you more vulnerable to remote attacks?

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated? I tried installing updates and it required me ...
0
votes
1answer
74 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
0
votes
1answer
178 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
1
vote
1answer
32 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
1
vote
0answers
34 views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), ...
3
votes
1answer
58 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
0
votes
0answers
48 views

Tuning auditd to be more operational friendly

We are in the process of pushing for a passing SOC-2 audit report, and part of that is to get our auditing act together. Specific to what I'm working on right now auditd. I have a nice set of rules, ...
0
votes
0answers
31 views

How do I execute a file under Linux Mint when it could be 'unsafe'? [duplicate]

Sometimes I find PDF's on the world wide web which I need for a project etc. But I'm afraid to get some sort of malware, virus or whatever on my PC too. I'm using Linux Mint. I would like to download ...
-2
votes
0answers
11 views

Double Free - crash or no crash [migrated]

Can someone explain me why freeing a twice in a row causes a crash, but freeing a first, then b, and then a again does not crash? I know that a free will insert the heap chunk in a double linked free ...
0
votes
1answer
33 views

X windows security: VNC and X server vs xpra

I have a CentOS server that currently has no X server on it. It will be used for doing statistical crunching and providing other services (probably via a web interface). The main security for the ...
4
votes
5answers
142 views

How to verify if a source code is safe before compiling it?

Sometimes Linux users need to to download a source code to be compiled then executed (the root privileges is granted). Is it possible for a source code to hide malicious code as a part of it? And how ...
1
vote
0answers
26 views

Port Knocking origination matching problem

I set up port knocking using first this method using knockd and then I tried using this method using only iptables directly but when both failed I thought I'd check a bit deeper into the problem. ...
3
votes
1answer
32 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
3
votes
1answer
65 views

What are some vulnerabilities of environment variables (on any platform)?

I am writing a small cross platform Python application (a package manager to be used internally by my corp), and I'm thinking of using something similar to this answer on Stack Overflow to check for ...
0
votes
0answers
12 views

Timeout after setting up proxychains

I've installed ProxyChains on my linux machine and I'm trying to hide my IP over the internet. I went on one of those sites that gives you a list of ips, in this case, proxylist.hidemyass.com and got ...
1
vote
0answers
8 views

How do I use Client9's IPCat with IPTables [migrated]

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
2
votes
0answers
39 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
23
votes
5answers
4k views

Why should one use sudo? [duplicate]

Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
1
vote
2answers
35 views

Would saving GPG and SSH keys as another user improve security?

Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder. Say that there is ...
-3
votes
1answer
126 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
4
votes
2answers
43 views

How to determine the minimum Linux Kernel version required for a given vulnerability

I have to track vulnerabilities for a legacyish (3.12) Linux Kernel. For this purpose I'm searching on various sites like NVD for new vulnerabilities. Recently I encountered a problem where the ...
-2
votes
1answer
88 views

anti cloning hard disk [closed]

I'm trying to create an "anti-cloning" system. I'd like to know if there's a way to check a unique label on the hard disk, during the boot phase, in order to avoid the machine to continue booting if ...
1
vote
1answer
53 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
1
vote
0answers
38 views

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
-1
votes
1answer
56 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
7
votes
4answers
994 views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
0
votes
0answers
22 views

Crackle does not work?

I've used to intructions for Crackle but, cannot get this kind of results like in the example. All it does is open up the wireshark like plugin and does not show any results like the picture below. ...
0
votes
2answers
45 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
2
votes
3answers
65 views

Does any malware target Tails?

Tails is not a popular OS and is optimized for security, which makes me doubt there is a significant amount of malware that targets it. I googled "malware targeting tails," and found no relevant ...
0
votes
0answers
14 views

Has Anyone Published the Typical Netstat Profile for TAILS Linux?

Using TAILS, and with concerns typical of anyone security conscious enough to be drawn to it in the first place, I was wondering if boum.org or anywhere else has put the typical netstat profile for ...
0
votes
1answer
51 views

Is this attack vector possible?

I had some suspicious pdf files on my linux computer. I opened it in firefox and Evince pdf reader and I forgot to use VM or any other sandbox. Is it possible the pdf to be infected with any kind of ...
1
vote
2answers
28 views

Protect Public Directories Linux

Just for a brief overview. I have a system that can generate invoices and has a login system for a user to generate his/her invoices. Lets say the platform resides at /platform and the invoices in ...