3
votes
1answer
80 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
3answers
110 views

Moving /var, /home to seperate partition

I am in attempts to move some folders such as /var, /home to a separate partition after reading the guide 3.2.1 Choose an intelligent partition scheme I was able to move one folder successfully ...
1
vote
1answer
56 views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
1
vote
2answers
107 views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
6
votes
1answer
585 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
0
votes
1answer
31 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
1
vote
1answer
95 views

File monitoring to pre-empt hacker

We have a hacker occasionally attempting to hack a site, and so far unsuccessful, but I would like a way to determine if the site has been compromised (i.e., files edited). The type of attacks are LFI ...
5
votes
1answer
33 views

Need More Information About KDE Job Notification

I installed Debian 7.2 on a new laptop a couple of days ago, and now I'm getting a strange job notification every once in a while. It just says the following: Source: ...
2
votes
2answers
217 views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
3
votes
1answer
88 views

New webserver: What all user accounts should I create and permissions to provide for

This is a followup on my question here. I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have. ...
2
votes
2answers
335 views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I know debian ...
0
votes
1answer
631 views

Difference between Debian 7.1 and Linux Mint 15 Debian

What is the main difference between Debian 7.1 and Linux Mint 15 Debian besides look and Desktop Environment. Basically with a special reference to security stability, and updates if you are going to ...
0
votes
1answer
150 views

What is the effect of setting immutable bit on /boot partition [closed]

What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the ...
2
votes
3answers
142 views

Is running GUI apps on server a security issue?

To edit system files for example /etc/named/named.conf, I use: su - Password: gedit And then opens and edit above like files, instead of: nano /etc/named/named.conf or: vi ...
3
votes
1answer
271 views

Is it a bad idea to add myself to the sudo group?

Members of the sudo group in my Debian install can execute anything without entering a password. This is convenient, but seems like a bad idea. NOTE: My computer is an ordinary desktop, not a server ...
1
vote
1answer
82 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...
2
votes
1answer
238 views

ufw firewall rules for security.debian.org

What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)? My understanding is ...
6
votes
1answer
200 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
2
votes
1answer
161 views

Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?

By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
2
votes
1answer
671 views

su-to-root fails when root user locked?

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account? Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
1
vote
1answer
453 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
2
votes
0answers
135 views

When was this vulnerability fixed in Debian? (CVE-2012-2088 affecting libtiff4) [closed]

I have Debian Squeeze installed on my one of my workstation. On my Ubuntu 10.04 workstation there have been two security updates to the libtiff4 package in the last couple of weeks, addressing the ...
10
votes
2answers
630 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
7
votes
5answers
994 views

Securing a Debian installation for general home usage

Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, ...
3
votes
1answer
601 views

Disabling Web camera

My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
10
votes
1answer
630 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
2
votes
2answers
2k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
9
votes
2answers
2k views

Automatic security updates on Debian squeeze server

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
11
votes
3answers
4k views

Why does the 'bin' user need a login shell?

During an audit of /var/log/auth.log on one of my public webservers, I found this: Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
1
vote
1answer
547 views

rpc.statd and avahi-daemon listening on all networks?

Background: - I'm running a home Debian GNOME desktop connected to the internet through an ethernet cable to an ethernet router. - I have a printer connected directly to my PC with a USB cable. - My ...
2
votes
2answers
441 views

Security with Kernel IP Forwarding Enabled

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
3
votes
1answer
127 views

Running proprietary software on Linux safely [closed]

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that ...
1
vote
1answer
595 views

Best practices for secure, separated virtualhost LAMP environment

What are the best practices for a Debian Squeeze + Grsecurity/PAX based system when multiple, and therefore insecure, websites must run on the same server? I mean how can I mitigate an attack, so that ...
2
votes
1answer
359 views

Debian unstable chroot security issues

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot. When doing this, ...
6
votes
4answers
6k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
2
votes
1answer
231 views

How do I make a certain command sudo-only on Debian?

What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
3
votes
1answer
202 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
6
votes
4answers
3k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...