Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 1 articles for you...
67
data encryptiondigital certificatessl certificateUnderstanding Digital Certificates for SSL/TLS Security
Let. Digital certificates are used to encrypt data traffic between a computer and a server using SSL/TLS (Secure Sockets Layer/Transport Layer Security) and for checking that a website isn. Digital certificates are used to encrypt data traffic between a computer and a server using SSL/TLS . digital, certificates, encrypt, traffic, between, computer, server, using. . LinuxSecurity.com Team
Jun 17, 2015
•
Cryptography
67
data protectionencryptionweb securityEnhancing Business Web Security Through SSL Certificates Subscription
SSL and its successor, TLS (Transport Layer Security), which encrypt data exchanged between two machines, are at the heart of web security. Signified by "https" in the browser URL, they underpin almost all Web transactions that requires privacy. Companies and organisations are using more and more SSL certificates as the need for secure machine-to-machine communication has increased with cloud computing, virtualisation and mobile devices, The link for this article located at TechWorld is no longer available. . Companies and organisations are using more and more SSL certificates as the need for secure machine-. successor, (transport, layer, security), which, encrypt, exchanged, between. . LinuxSecurity.com Team
May 04, 2015
•
Cryptography
67
web securitybrowser securityattack risksExploring SSL Certificates And Risks of Man-in-the-Middle Attacks
A decade ago, I observed that commercial certificate authorities protect you from anyone from whom they are unwilling to take money. That turns out to be wrong; they don't even do that much. SSL certificates are the primary mechanism for ensuring that secure web sites -- those displaying that reassuring "padlock" icon in the address bar -- really are who they purport to be. In order for your browser to display the padlock icon, a web site must first present a "certificate", digitally signed by a trusted "root" authority, that attests to its identity and encryption keys.. Unfortunately, through a confluence of sloppy design, naked commercial maneuvering, and bad user interfaces, today's web browsers have evolved to accept certificates issued by a surprisingly large number of root authorities, from tiny, obscure businesses to various national governments. And a certificate from any one of them is usually sufficient to bless any web connection as being "secure". What this means is that an eavesdropper who can obtain fake certificates from any certificate authority can successfully impersonate every encrypted web site someone might visit. Most browsers will happily (and silently) accept new certificates from any valid authority, even for web sites for which certificates had already been obtained. An eavesdropper with fake certificates and access to a target's internet connection can thus quietly interpose itself as a "man-in-the-middle", observing and recording all encrypted web traffic traffic, with the user none the wiser. But how much of a threat is this in practice? Are there really eavesdroppers out there -- be they criminals, spies, or law enforcement agencies -- using bogus certificates to intercept encrypted web traffic? Or is this merely idle speculation, of only theoretical concern? The link for this article located at Matt Blaze Blog is no longer available. . Unfortunately, through a confluence of sloppy design, naked commercial maneuvering, and bad user int. decade, observed,commercial, certificate, authorities, protect, anyone. . LinuxSecurity.com Team
Mar 25, 2010
•
Cryptography
67
web securityserver configurationssl certificateStep-By-Step StartSSL Certificate Installation For Apache Web Server
Owning a web server that has its own SSL certificate from a registered Certificate Authority (so it won't trigger any browser warnings) does have its advantages. However, the price of a certificate issued by Verisign or a similar vendor usually tends to put a quick end to such fanciful ideas. Israeli vendor StartSSL offers free SSL server certificates that are valid for a year.. Since StartSSL's root certificates are already included in all the mainstream browsers, opening a certificate from the vendor doesn't trigger any error messages. This article gives examples of all the steps required to add StartSSL certification, from signing up with StartSSL to integrating the certificate into an Apache web server under Linux. The only requirement for obtaining a certificate for a domain is that a user must be able to receive emails to an administrative account (postmaster, hostmaster or webmaster). There are no additional checks to verify whether the user actually owns the respective domain (incidentally, this is similar to other CAs such as RapidSSL). Furthermore, an issued certificate is only useful if it can subsequently be installed on a server. Those who own a "business card" type of home page with a web hosting service cannot, therefore, use such a certificate because they don't have access to the server configuration. The procedure is similar for Apache under Windows and Internet Information Server (IIS) under Windows. With IIS, the required steps need to be executed on the Microsoft Management Console (MMC). The link for this article located at H Security is no longer available. . Since StartSSL's root certificates are already included in all the mainstream browsers, opening a ce. certificate, owning, server, registered, authority. . LinuxSecurity.com Team
Jan 22, 2010
•
Cryptography
83
phishingweb vulnerabilitiesssl certificateJacob Appelbaum's SSL Certificate Trick and Associated Risks
On the Noisebridge hacker mailing list, security specialist Jacob Appelbaum has published an SSL certificate and pertinent private key that together allow web servers to avoid triggering an alert in vulnerable browsers - irrespective of the domain for which the certificate is submitted. Phishers, for example, could use the certificate to disguise their servers as legitimate banking servers . For his trick, Appelbaum modified the certificate according to the method demonstrated by Moxie Marlinspike at the Black Hat conference, entering a zero character (\0) in the name field (CN, Common Name). Unlike Marlinspike, however, Appelbaum didn't enter the zero between the domain name and the name of Marlinspike's thoughtcrime.org domain. Instead, he entered *\00thoughtcrime.noisebridge.net, effectively creating a wild card certificate for arbitrary domain names: The link for this article located at H Security is no longer available. . The misuse of SSL certificates allows potential threat actors to mask malicious servers as authentic, creating considerable dangers.. ssl certificate, phishing attack, browser exploits. . LinuxSecurity.com Team
Sep 30, 2009
•
Hacks/Cracks
67
opensslcertificate authorityssl certificateManaging SSL Certificates: Setup and Best Practices for Security
A first hand approach on how to manage a certificate authority (CA), and issue or sign certificates to be used for secure web, secure e-mail, or signing code and other usages. This HOWTO will also deal with non-linux applications: there is no use to issue certificates if you can't use them.. . .. A first hand approach on how to manage a certificate authority (CA), and issue or sign certificates to be used for secure web, secure e-mail, or signing code and other usages. This HOWTO will also deal with non-linux applications: there is no use to issue certificates if you can't use them. .. All applications won't be listed here, but please, send me additional paragraphs and corrections. As indicated in the introduction, this documents is an hand-on HOWTO, and it is therefore required that you consult the man pages of the OpenSSL software. You should as well read security books to learn how your security could be compromised. Certificates are meant to increase the security of your transactions, it is VERY important that you understand all the security implications of your actions and what security OpenSSL does not provide. The link for this article located at TLDP is no longer available. . A first hand approach on how to manage a certificate authority (CA), and issue or sign certificates . first, approach, manage, certificate, authority, certificates. . LinuxSecurity.com Team
May 10, 2002
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!