1
vote
2answers
48 views

Secure the content of a hard disk

I have to prepare a computer to give away, and I do not know who is going to use it. The computer has Debian installed, and the HDD is entirely encrypted. All users have their storage on the server. I ...
3
votes
1answer
83 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
3answers
152 views

Moving /var, /home to seperate partition

I am in attempts to move some folders such as /var, /home to a separate partition after reading the guide 3.2.1 Choose an intelligent partition scheme I was able to move one folder successfully ...
1
vote
1answer
78 views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
1
vote
2answers
114 views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
6
votes
1answer
588 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
0
votes
1answer
33 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
1
vote
1answer
95 views

File monitoring to pre-empt hacker

We have a hacker occasionally attempting to hack a site, and so far unsuccessful, but I would like a way to determine if the site has been compromised (i.e., files edited). The type of attacks are LFI ...
5
votes
1answer
33 views

Need More Information About KDE Job Notification

I installed Debian 7.2 on a new laptop a couple of days ago, and now I'm getting a strange job notification every once in a while. It just says the following: Source: ...
2
votes
2answers
227 views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
3
votes
1answer
91 views

New webserver: What all user accounts should I create and permissions to provide for

This is a followup on my question here. I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have. ...
2
votes
2answers
358 views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I know debian ...
0
votes
1answer
647 views

Difference between Debian 7.1 and Linux Mint 15 Debian

What is the main difference between Debian 7.1 and Linux Mint 15 Debian besides look and Desktop Environment. Basically with a special reference to security stability, and updates if you are going to ...
0
votes
1answer
156 views

What is the effect of setting immutable bit on /boot partition [closed]

What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the ...
2
votes
3answers
147 views

Is running GUI apps on server a security issue?

To edit system files for example /etc/named/named.conf, I use: su - Password: gedit And then opens and edit above like files, instead of: nano /etc/named/named.conf or: vi ...
3
votes
1answer
278 views

Is it a bad idea to add myself to the sudo group?

Members of the sudo group in my Debian install can execute anything without entering a password. This is convenient, but seems like a bad idea. NOTE: My computer is an ordinary desktop, not a server ...
1
vote
1answer
82 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...
2
votes
1answer
249 views

ufw firewall rules for security.debian.org

What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)? My understanding is ...
6
votes
1answer
202 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
2
votes
1answer
162 views

Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?

By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
2
votes
1answer
678 views

su-to-root fails when root user locked?

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account? Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
1
vote
1answer
476 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
2
votes
0answers
137 views

When was this vulnerability fixed in Debian? (CVE-2012-2088 affecting libtiff4) [closed]

I have Debian Squeeze installed on my one of my workstation. On my Ubuntu 10.04 workstation there have been two security updates to the libtiff4 package in the last couple of weeks, addressing the ...
10
votes
2answers
634 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
7
votes
5answers
1k views

Securing a Debian installation for general home usage

Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, ...
3
votes
1answer
621 views

Disabling Web camera

My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
10
votes
1answer
632 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
2
votes
2answers
2k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
9
votes
2answers
2k views

Automatic security updates on Debian squeeze server

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
11
votes
3answers
4k views

Why does the 'bin' user need a login shell?

During an audit of /var/log/auth.log on one of my public webservers, I found this: Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
1
vote
1answer
553 views

rpc.statd and avahi-daemon listening on all networks?

Background: - I'm running a home Debian GNOME desktop connected to the internet through an ethernet cable to an ethernet router. - I have a printer connected directly to my PC with a USB cable. - My ...
2
votes
2answers
442 views

Security with Kernel IP Forwarding Enabled

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
3
votes
1answer
128 views

Running proprietary software on Linux safely [closed]

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that ...
1
vote
1answer
599 views

Best practices for secure, separated virtualhost LAMP environment

What are the best practices for a Debian Squeeze + Grsecurity/PAX based system when multiple, and therefore insecure, websites must run on the same server? I mean how can I mitigate an attack, so that ...
2
votes
1answer
362 views

Debian unstable chroot security issues

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot. When doing this, ...
6
votes
4answers
6k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
2
votes
1answer
232 views

How do I make a certain command sudo-only on Debian?

What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
3
votes
1answer
203 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
6
votes
4answers
3k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...