IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [centos]

CentOS is a free operating system distribution based upon the Linux kernel. It is derived entirely from the Red Hat Enterprise Linux (RHEL) distribution.

Adapted from U&L CentOS tag:

The CentOS Linux distribution is a stable, predictable, manageable and reproducible platform derived from the sources of Red Hat Enterprise Linux (RHEL). Since March 2004, CentOS Linux has been a community-supported distribution derived from sources freely provided to the public by Red Hat. As such, CentOS Linux aims to be functionally compatible with RHEL. It mainly change packages to remove upstream vendor branding and artwork. CentOS Linux is no-cost and free to redistribute.

CentOS is developed by team of core developers. The core developers are supported by an active user community, including: system administrators, network administrators, enterprise users, managers, core Linux contributors and Linux enthusiasts from around the world.

Commercial support is offered via a number of vendors.

Using the CentOS tag

Use this tag if your question relates to CentOS security topics; do not use it if you just happen to be using CentOS and your question is about a specific configuration detail or syntax (e.g. a shell script; a web server configuration question; user or group permissions).

106 questions
21
votes
2 answers

Backdoor account in passwd file

Long story short I was making sure a web app didn't create a LFI vuln by attempting to open /etc/passwd with it. My first attempt to prevent LFI was unsuccessful and listed out the file, and I noticed this at the…
CarlosAllende
  • 353
  • 2
  • 7
18
votes
5 answers

Stop large requests to my server (TOR)

I am being attacked right now from Tor nodes which are doing 404 requests to my HTTP server. It is from one IP but when i use the DROP iptables rule, it starts again from another IP in a matter of seconds. It started to ask requests to the cgi-bin…
Alex
  • 181
  • 1
  • 6
14
votes
1 answer

Determining httpd PHP Scripts with Auditd

Background I have an issue on my server where some hole is allowing malicious PHP files to be written to any world-writable directories beneath the web root. It is not currently causing any harm, as I have all these directories blocked from serving…
user112461
12
votes
3 answers

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't find now. I seem to recall the problem was that…
LanceBaynes
  • 6,149
  • 11
  • 60
  • 91
11
votes
1 answer

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's packages from RHEL, which has that kind of page…
TimC
  • 552
  • 5
  • 12
11
votes
4 answers

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak. 

Note…
user739866
  • 211
  • 1
  • 2
  • 3
11
votes
4 answers

Privilege escalation using passwd file

If I have a world writeable /etc/passwd file on a system, how can I escalate my privileges to root? I am currently a underprivileged user. The underlying OS is CentOS 7.2 in case you are wondering I know that passwd file is not normally world…
Airbourne
  • 271
  • 2
  • 7
  • 17
7
votes
1 answer

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password of the user has to be entered in the add new…
Ijaz Ahmad
  • 1,592
  • 1
  • 11
  • 20
6
votes
2 answers

OpenSSL Certificate Renewal with same keys and NO CSR

I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates. The current server certificate is from Symantec so has to be replaced with a DigiCert. DigiCert is offering free replacements to existing customers…
user339468
  • 163
  • 3
6
votes
3 answers

How secure is ssh key-based authentication

I have a newly installed (and updated) Centos 7 server I use for testing. I implemented RSA key based authentication for ssh and set PermitRootLogin to without-password When I logged on this morning I ran netstat -plant and found a couple of…
Son of Sam
  • 77
  • 1
  • 8
5
votes
3 answers

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS machine in the cloud to build out a machine that…
user2120790
  • 151
  • 1
  • 2
5
votes
4 answers

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated password. I find myself frequently having to…
Steve Bennett
  • 313
  • 2
  • 7
5
votes
2 answers

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the operating system (CentOS 6) via this vulnerability…
user1028
  • 437
  • 4
  • 8
  • 14
5
votes
2 answers

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have secrets. How can I lock down the process that…
Dr.Knowitall
  • 151
  • 4
5
votes
1 answer

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the distribution configuration? CentOS has "fips" mode,…
KostaZ
  • 153
  • 4
1
2 3 4 5 6 7 8