Get the LinuxSecurity news you want faster with RSS
Powered By
Linux Security Week: December 1st, 2008
Source: LinuxSecurity.com Contributors - Posted by Benjamin D. Thomas
This week, perhaps the most interesting articles include "10 Mistakes New Linux Administrators Make," " Linux Role in Botnets Studied," and "OpenSSH Speed Tips and Tricks."
Norwich University's Master of Science in Information Assurance
(MSIA) program, designated by the National Security Agency as providing academically excellent education in Information Assurance, provides you with the skills to manage and lead an organization-wide information security program and the tools to fluently communicate the intricacies of information security at an executive level.
Learn more
LinuxSecurity.com
Feature Extras:
A Secure Nagios Server - Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security.
Never Installed a Firewall on Ubuntu? Try Firestarter - When I typed on Google "Do I really need a firewall?" 695,000 results came across. And I'm pretty sure they must be saying "Hell yeah!". In my opinion, no one would ever recommend anyone to sit naked on the internet keeping in mind the insecurity internet carries these days, unless you really know what you are doing.
Read on for more information on Firestarter.
Thank you for reading the LinuxSecurity.com
weekly security newsletter. The purpose of this document is to provide our readers
with a quick summary of each week's most relevant Linux security headline.
EnGarde Secure Community 3.0.21 Now Available (Oct 7)
Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.21 (Version 3.0, Release 21). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.
In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database, e-mail security and even e-commerce.
For many, migrating to Linux is a rite of passage that equates to a thing of joy. For others, it's a nightmare waiting to happen. It's wonderful when it's the former; it's a real show stopper when it's the latter. But that nightmare doesn't have to happen, especially when you know, first hand, the most common mistakes new Linux administrators make. This article will help you avoid those mistakes by laying out the most typical Linux missteps. If you are new to Linux and want to secure your network with improved Linux Administrator skills, then reading this article would be a good starting point. Read on for more information.
Researchers at a major security vendor are exploring the extent to which Linux systems - especially servers - are involved in the botnet plague. A six-year old Linux virus is still in circulation, and Sophos suspects the high uptime exhibited by servers (compared with the typical home or office Windows PC that spends much of the day switched off or asleep) makes them valuable to bot-herders as central control points.
What do think is the role of Linux in Botnets. This article presents a study on the relationship between Linux and Botnets.
Cyber-Attack on Defense Department Computers Raises Concerns (Nov 28)
Reporting from Washington -- Senior military leaders took the exceptional step of briefing President Bush this week on a severe and widespread electronic attack on Defense Department computers that may have originated in Russia -- an incursion that posed unusual concern among commanders and raised potential implications for national security.
Linux Security and/or World Security? What should be focused? What are your thoughts on this cyber attack after the recent Mumbai attack. This article talks about the cyber security breach on military networks and discuss the software agent.bz for the consequences. Read on for more information.
There is currently a discussion on the Debian-security mailing list about how to protect data which came from an encrypted file. I was going to skip that one until someone summoned me by mentioning SE Linux.
The issue which was raised is that data from an encrypted file can be read from /dev/mem (for all memory of the machine) or /proc//mem (for the memory of the process). It was suggested that SE Linux can prevent such attacks, however it's not that simple.
How do you secure data that came from an encrypted file? This article takes the position that SELinux is the answer. Do you agree after reading it?
A computer security researcher who has inadvertently violated the law during the course of her investigation faces a dilemma when thinking about whether to notify a company about a problem she discovered in one of the company's products. By reporting the security flaw, the researcher reveals that she may have committed unlawful activity, which might invite a lawsuit or criminal investigation. On the other hand, withholding information means a potentially serious security flaw may go unremedied.
Are you a "Grey Hat"? This article looks at how computer security researcher can be breaking the law even if they are working for the good side.
Although using public key authentication instead of passwords is a great method for increasing the security of SSH transfers, transferring SSH identity keys can be a royal pain. First, you create your key pairs; then, you copy the public key into the correct locations on all the machines you want to log into. The keys must be in a particular format, and you must go into the correct directory with the correct permissions. Fortunately, ssh-copy-id, a slick utility included with OpenSSH, makes it easy.
This article looks a ways to make using OpenSSH more efficient. Do you have any tips, for using ssh?
Implementing VoIPER: VoIP Exploit Research Toolkit (Nov 24)
With VoIP devices finding their way into the majority of major enterprises and a significant number of residential installations, the possible consequences of a security vulnerability that can be leveraged by malicious hackers are ever increasing – wrote Terron Williams in his article.
Check out this free hackin9 article, all you need to do is provide an email address!
