Linux Security Week: August 11th, 2008

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.19 (Version 3.0, Release 19). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

news/vendors-products/engarde-secure-community-3019-now-available

Rootkit can be difficult to detect, especially when they are running in kernel. And therefore more difficult to prevent against. This is because they are running into kernel, they can alter functions used by all applications running on the system. These applications will include antivirus, anti-spyware, anti-rootkit etc. Whatever changes made by anti-rootkit or rootkit detectors to prevent against rootkit can simply be unblocked by the better rootkit. The same powers are available with infectors and preventers. This does not mean that all is lost for preventers. But one thing has to be always on the mind of detectors/preventers that what works today, may not work tomorrow.

Detecting rootkits can be a challenge but this article looks at a tool called ProcL. Do you use any other tools for finding hidden processes?

The ssh-xfer project uses the local SSH agent to allow you to easily grab files using an existing SSH shell connection. You do not have to modify either the SSH client or server programs to use ssh-xfer -- but you will need to patch your ssh-agent. Although having to patch the ssh-agent is not ideal, you do gain one major advantage by doing this: you can send a file through more than one SSH connection.

Have you ever used ssh-xfer? This article shows the user how to use ssh-xfer to get files over a network using a SSH shell connection.

news/network-security/ssh-xfer-quickly-grabbing-files-over-an-existing-ssh-connection

TrueCrypt is a free opensource software system for establishing and maintaining an on-the-fly-encrypted volume (data storage device). On-the-fly encryption means that data are automatically encrypted or decrypted right before they are loaded or saved, without any user intervention. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. Entire file system is encrypted (e.g., file names, folder names, contents of every file, free space, meta data, etc).

Have you ever wondered how to encrypt a filesystem? This article does this by showing user's how to use TrueCrypt. Do you use any other tools for encrypting your data?

news/cryptography/truecrypt-opensource-on-the-fly-disk-encryption-tool

The size and scope of security problems are growing to be so large that security experts are having more difficulty than ever protecting end users from emerging threats. That was evident in the Black Hat Briefings security conference that opened Wednesday.Case in point: IOActive researcher Dan Kaminsky detailed for the first time the specific nature of the DNS flaw reported recently and its overarching scope, providing example after example of how various Internet technologies that rely on the accuracy of the DNS information they received could be compromised. Kaminsky warned the audience that the DNS vulnerability could let entire countries and entire top-level domains be hijacked.

Regarding security, the new phones will be able to identify their owners. If, by chance, a stranger uses the phone and requests downloads at odds with the owner's profile, Mr. Gillis said the phone's security feature will kick in and shut it down. Profile information would also make it easier for a consumer to find points of similar interest when they are traveling in, say, Barcelona or Kyoto.

Managing e-mail is made easy with the use of e-mail client, also known as e-mail reader. Some e-mail clients can also function as feed reader and can support plug-ins and themes. When it comes to picking the right e-mail client, Linux users have tons of choices. I have here a list of 8 of the best free and open source e-mail clients that are available for Linux.

This article looks a 8 E-mail client but which one is the most secure. Email security is important to keep ones privacy when send and receiving emails. What do you think is the most secure? Thunderbird?

news/network-security/8-best-e-mail-clients-for-linux

WESTLAKE VILLAGE, Calif. -- Xirrus, Inc., the only Wi-Fi "Power-Play" that can replace Ethernet workgroup switches with Wi-Fi as the primary network connection, announced today the release of its Wi-Fi Monitor utility as an open source desklet application for Linux.The Xirrus Wi-Fi Monitor enables users to monitor, secure, and troubleshoot Wi-Fi networks quickly and easily. Key features of the Xirrus Wi-Fi Monitor for Linux include:

Have you every used Xirrus Wi-Fi Monitor? Well the maker just released it as open source. This article goes into more detail on the security features of this Wi-Fi Monitoring software.

Since this week has been all over the map, I thought we'd spend today going back and dipping into the over-the-top-security well ;) You may recall a post from last year that we did on making generic user accounts su-only and, maybe even more so, a post we just recently did on using mkfifo and script to keep tabs on user account usage. Both of these were aimed at providing relatively decent security for the Unix or Linux admin, while allowing the user the freedom to do his or her job without too much of a hassle. Both of these posts assumed a box that had consistent user activity, but needed to be secured from those "ooops" moments that end up burning up your night-time hours and, possibly, creating a financial problem as well (most places I've worked have at least one box that is fairly lax, security-wise, but hemorrhages cash the instant it gets taken offline.

SELinux has achieved its goal of protecting Linux systems from intrusion by unauthorized access. But the effort remains in the early adopter stage, and its supporters need to work on broader implementation and greater ease of use, according to Doc Shankar, an IBM Corp. distinguished engineer. In a preview of his LinuxWorld Conference & Expo workshop, Shankar said that the biggest benefit of SELinux is that systemwide policies automatically and absolutely enforce access controls. No one gets the unrestricted access of a "root" superuser; instead, each user is confined to what he needs to know, he said. In the case of a breech, an intruder is boxed in and can destroy only a portion of the system, he said.

This article is an interesting look at one IBM Engineer's opinion about SELinux. Do you agree with what he says?