Linux SecuritySponsored by jamf

The Linux operating system, in all its flavors, has its own share of security flaws that allow intrusions, but there are various mechanisms by which these flaws can be removed, generally divided into two parts: authentication and access control. Authentication is responsible for ensuring that a user requesting access to the system is really the user with the account, while access control is responsible for controlling which resources each account has access to and what kind of access is permitted.

Share tech news, updates, or what's on your mind.

Sign up to Post

We need to have a standalone IPS solution put in.  We currently run two pfSense firewalls in an HA setup.  I was looking around on eBay and saw a Tipping Point 210E (two of them).  Are they still good with updates to definitions?  Any other less cost recommendations?
pfSense HA works a little odd too, so I'm not sure if this will even work.
Firewall 1 WAN IP x.x.x.1
Firewall 2 WAN IP x.x.x.2
Firewall Shared WAN IP x.x.x.3

Same setup with internal LAN IPs.  Each firewall has its own physical connection to the modem via ethernet for the WAN side and LAN side.
0
Hello Folks,
I have a few users to create for centos, and I would like to set them with restrictions such "system tools, create shortcuts, folders...similar to a kiosk " is there any way to do that or is there a special profile that needs to be created?

thanks for looking
0
I need to connect a Virtual Machine hosted somewhere running CentOS 6 to a client which is allowing connection through VPN only. However I have almost no knowledge about VPNs. The client has given me following info for connection:

VPN Remote Endpoint: <IP Address given by the client>
VPN Hardware: NGX R75.45 (SPLAT)

IKE (Phase 1)
==================
Authentication Method: Pre shared key (TBA)
DIffie-Hellman group: DH-2
Encryption Algorithm: AES-128
Hashing Algorithm: SHA-1
Renegotiate IKE: 14400 seconds

IPSEC (phase 2)
======================
Encryption Algorithm: AES-128
Hashing Algorithm: SHA-1
Renegotiate IKE: 3600 seconds
PFS Enabled: Yes

I am not sure where to put all these info in CentOS to make it to connect to the client's network.

I will be much thankful for any help.
0
Hi,
what are differences between
user defined, environmental. local, global variables

when to use which one. what are advanatages, disadvantages of using each with practical examples.
please advise
0
Hi,

I like to write a unix shell script to check calendar year, date, current working directory.

how to write and shave .sh file(Say test.sh) and how to execute to see the output.

Any detailed link explaining these steps with screenshots. please advise
0
What are differences between
touch cat vi differences

which one is better to use to create a file. When to use which one. please advise
0
Hi,

I like to delete matched pattern in a file using vi editor and sed command

i tried as below not working

$ sed 'hello' aaaa.txt :% aaaa.sh


please advise
0
Hello,

I'm using Alienvault Ossim v. 5.3.79 together with ossec v. 2.8.

I'm trying to extend the following rules:
1002 - Unknown error somewhere in the system - bad words;
1003 - Non standard system message (size too large).

As these two rules give me a lot of false positive alerts, I've prepared custom rules in the local_rules.xml:
Original rules (syslog_rules.xml):

<rule id="1002" level="2">
    <match>$BAD_WORDS</match>
    <options>alert_by_email</options>
    <description>Unknown problem somewhere in the system.</description>
  </rule>

  <rule id="1003" level="13" maxsize="1025">
    <description>Non standard syslog message (size too large).</description>
  </rule>

Open in new window


Custom rules (local_rules.xml):

<rule id="100002" level="0">
    <if_sid>1002</if_sid>
    <program_name>nfcapd</program_name>
    <match>Sequence Errors: 0, Bad Packets: 0</match>
    <description>False positive</description>
  </rule>

  <rule id="100003" level="0">
    <if_sid>1003</if_sid>
    <hostname>host1</hostname>
    <description>Ignoring 1003 from specified host</description>
  </rule>

Open in new window


Unfortunately looks like above custom rules are ignored when I'm trying to use ossec-logtest:
For 1003:
echo "Apr 27 11:10:04 host1 user1[21565]: ./logtest.sh - Lorem ipsum dolor sit amet libero et lacus vestibulum vel, nibh. Fusce nonummy risus sit amet quam tempus vehicula, dui tellus, at lorem odio adipiscing at, egestas non, nulla. Maecenas in nulla quis 

Open in new window

0
Dear All,

We have created a chrooted jail environment for our SFTP access. Using chrooted environment, we restrict users either to their home directory or to a specific directory. Now my question is if there's anyway we can an additional username to access the same home directory for other username? Or any other words, is there anyway I can assign different usernames to the same home-directory and have it chrooted jail?

Below is our current config if that helps:

group add sftponly


vi /etc/ssh/sshd_config

#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group sftponly
ChrootDirectory %h
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no

systemctl restart sshd.service

useradd USERNAME –g sftponly –s /bin/false
passwd  USERNAME


mkdir /home/USERNAME/SFTPWRITE
chown root /home/USERNAME
chmod 755 /home/USERNAME
chown USERNAME /home/USERNAME/SFTPWRITE
chmod 755 /home/USERNAME/SFTPWRITE

setsebool –P ssh_chroot_rw_homedirs on
0
I am conducting a penetration test against a fake Apache Tomcat server.  I have exploited the vulnerability in Metasploit and was able to open a Meterpreter session.  Some of my commands work with Meterpreter; however, commands such as "run hashdump" and "getsystem" return an error of this version of Meterpreter is not supported with this script.  I am running a virtual environment of Metasploit v4.10.0.  Is there any other script that can be used to complete this hashdump? Below is the exploit and payload that I used to open meterpreter:
use exploit/multi/http/tomcat_mgr_upload
set payload java/meterpreter/reverse_http

I have tried all other payloads that are are shown from the "show payloads" command.
0
Dear Colleagues,

I have a problem with executing SU command in Ubuntu 16.04.02. LTS.
The output is « -bash: /bin/su: Permission denied » (see attached screenshot).

Plz suggest something to overcome this issue.
ubuntu_terminal_error.jpg
0
Hi All,

Getting the above following message in my auth.log on my server from the above ip and many others ... what does this mean?

J
0
It is some type of Linux honey pot program. I was given a fife, honeymine.py, that is supposed to set the program up to to end to a SIEM to gather information on my internal network. Supposed to be installed on Linux Mint Mate 18. Classified as a "Low-Interaction" HoneyPot.

I have not been able to locate the installer or information more that I have given. Any help would be appreciated.
0
I want firefox to not erase cookies on browser close. I want to set this via a script. Below are gui based instructions for the goal settings.

Anyone know how to do this?

Thanks!

Firefox

At the top of the Firefox window, click the Firefox button and then select Options
Select the Privacy panel
In the History section, set Firefox will: to Use custom settings for history
Select the check box for Clear history when Firefox closes
click the Settings… button. The Settings for Clearing History window will open
In the Settings for Clearing History window, click the check mark box next to Cache.
Click OK
0
On RH 6 systems running rsyslog 5.8.10 we noticed that if we setup a
client system to use TCP to log to a remote server:
*.*       @@192.168.1.2

Open in new window

If the remote log server is not reachable for some reason no logging takes place, not even local logging to the local system log files.
When the log server is available and rsyslog is restarted  both local logging and remote logging work.   I would like to come up with a config that would ensure that local logging still occurs when  the TCP remote server is down?  I think I need to look at action queues, but was hoping someone could provide an example on how to get this to work.
0
What is 'sticky session' when considering web traffic load balancing and how session-stickiness is usually achieved ?

can you please explain me a real world scenario. Like how it is used.
0
I am trying to set up a linux box as router ( packet forwarder to external + NAT). All the references I have found show that can be achieved using  iptables.
The question I have , if for performance  reasons  I can’t use iptables, is there any other alternative to achieve the same result ?

Thanks
0
Hi,
i'm looking for the quickest way to query Windows Event ID's from a Linux CentOS device.
I managed to do it via WMI but the enumerations of security logs using WMI simply takes too long.
what other methods are there to query Windows Event ID's as well as information from Active Directory using Linux?
can i use powershell from linux to query? how do SIEM devices like mcafee\greylog do it? what are the methods that can be done to query this info from linux other then WMI?

any help will greatly be appreciated this is driving me nuts
0
hi all,

I am now learning basic operation of Lunix and unix:

1) how to list active process in linux and unix and kill it accordingly.
2) how to change application start mode so that we can choose to start in administator/root user mode instead of general user mode in lunix and Unix.
3) how to check disk space left in linux and Unix.
4) what is the commonly use Linux and Unix administrative tools so that I don't need to use command mode?
5) how to check existing CPU usage of all CPU core in Linux and Unix, and therefore which application use the most CPU resource can be found.
6) how to check existing RAM usage of all application in Linux and Unix and therefore know which application use the most RAM/
0
Hi,

I want ot learn and practive Linux commands on my windows 10 laptop. how to instal and set up and practice in centos. please advise
I was checking below but not sure where and how to get software etc
http://www.tecmint.com/centos-6-3-step-by-step-installation-guide-with-screenshots/

please advise
0
Hello
Im new to Serverspec and LDAP and I was tasked to create some tests for testing and validating the infrastructure for LDAP is up and running correctly. Are there any good tests that I can code with ruby to validate that LDAP is running and configured properly?

Thanks!
0
Hello guys,
well i wanted to clear root password and admin password (sudo user) , using passwd -l root and then passwd -l admin, the result was successful
well my question how i can reset the password for admin only, knowing it keeps asking for current password which should be empty. no??
admin@mail:~$ passwd admin
Changing password for admin.
(current) UNIX password:

Open in new window

whatever i try old password or enter for none, the result always failed.
what i'm missing in here? it shouldnt be empty already?

thanks guys
0
Fine Tune your automatic Updates for Ubuntu / Debian
0
What is the easiest way to do this , do you have a sample kickstart file you can share with me that would have these options

thanks!!!!!!!!
0
I have a python script that copies some proprietary code from a USB to an app folder on a debian wheezy system.  The usb will be sent to a client site for them to plugin and click a button to do the update.  After the update is complete I use rm to delete the files from the usb but I assume this would be easily recovered.  I'm worried that the client will have this usb laying around and they will attempt to recover the files and have access to our code.

So the question is not of design, I know there are better ways to do it overall.  But in this case is there a simple way in python or using system.os to wipe or otherwise obfuscate the deleted files on the usb?  I can add your suggestion to the source code before we ship the usb (and test it of course)

thanks
0

Linux SecuritySponsored by jamf

The Linux operating system, in all its flavors, has its own share of security flaws that allow intrusions, but there are various mechanisms by which these flaws can be removed, generally divided into two parts: authentication and access control. Authentication is responsible for ensuring that a user requesting access to the system is really the user with the account, while access control is responsible for controlling which resources each account has access to and what kind of access is permitted.

Top Experts In
Linux Security
<
Monthly
>