Tagged Questions
5
votes
1answer
58 views
Does fail2ban offer any additional protection to SSH if password login is already turned off?
I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions.
The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
2
votes
1answer
126 views
Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?
By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
2
votes
1answer
459 views
su-to-root fails when root user locked?
How might I use script /usr/bin/su-to-root after I have intentionally locked the root account?
Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
1
vote
1answer
281 views
How to provide a “guest LAN” on one ethernet device
I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each.
eth0 is on 192.168.7.* and has access to the ...
2
votes
0answers
100 views
When was this vulnerability fixed in Debian? (CVE-2012-2088 affecting libtiff4) [closed]
I have Debian Squeeze installed on my one of my workstation. On my Ubuntu 10.04 workstation there have been two security updates to the libtiff4 package in the last couple of weeks, addressing the ...
10
votes
2answers
510 views
How do I prevent programs from sniffing keystrokes to su/gksu?
I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
6
votes
5answers
487 views
Securing a Debian installation for general home usage
Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, ...
4
votes
1answer
260 views
Disabling Web camera
My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
10
votes
1answer
592 views
Why aren't the Fedora GPG keys signed?
Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https.
For example the checksum ...
2
votes
2answers
1k views
Hardening debian?
So I have thought a bit about hardening a Debian squeeze file & VPN server
lately.
Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
5
votes
2answers
771 views
Automatic security updates on Debian squeeze server
For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
10
votes
3answers
2k views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 ...
1
vote
1answer
382 views
rpc.statd and avahi-daemon listening on all networks?
Background:
- I'm running a home Debian GNOME desktop connected to the internet through an ethernet cable to an ethernet router.
- I have a printer connected directly to my PC with a USB cable.
- My ...
2
votes
2answers
303 views
Security with Kernel IP Forwarding Enabled
I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
3
votes
1answer
108 views
Running proprietary software on Linux safely [closed]
As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that ...
1
vote
1answer
415 views
Best practices for secure, separated virtualhost LAMP environment
What are the best practices for a Debian Squeeze + Grsecurity/PAX based system when multiple, and therefore insecure, websites must run on the same server? I mean how can I mitigate an attack, so that ...
2
votes
1answer
288 views
Debian unstable chroot security issues
This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot.
When doing this, ...
6
votes
4answers
3k views
Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]
I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
2
votes
1answer
189 views
How do I make a certain command sudo-only on Debian?
What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
3
votes
1answer
176 views
Is there a standard way to configure what policy iptables loads on startup under Debian?
I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration.
One thing I'd like to configure is a default packet filtering policy. ...
5
votes
4answers
2k views
Debian: Which firewall for a newbie?
I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...
