Linux Security Newsletter: Rootkit Detection SSH Hardening Iptables

Did you ever live with the fear that somebody may break into your system one day and steal your files? Well, those days are over, because you can now have an entire encrypted operating system. This was the first time I thought about taking the time to encrypt my whole operating system. Is encrypting the entire operating system worth the time? I feel encrypting persional information like phone numbers or bank information is important but most of what is on my operating system is things I don;t care that others see. However there is a way to encrypt the whole operating system with a Live CD to protect everything on a Linux users computer.

news/cryptography/encrypted-ubuntu-704

On July 26, McAfee will begin offering a new application called Rootkit Detective, designed to detect and remove dangerous rootkit attacks. The software will also help end-users ward off the threats, as well as funnel new intelligence into the company's ongoing research operations. Have you test drove McAfee's Rootkit Detective software? The feature that made me think about trying it out is McAfree says that it has the ability to detect self-cloaking malware attacks that install themselves as kernel modules or drivers. Since any attack that installs them self's in the kernel are very hard for software to detect, I am in interested in how effective they are in finding them. Also, how does this software rank up against other rootkit finders for example, chkrootkit?

A simple means to adding additional anti-spam checks to your mailserver is to place it behind an SMTP-proxy. One common proxy is the extremely flexible qpsmtpd server. The nice part of this setup is that is allows the network to have the SMTP-proxy in front of the Mail Server so there is no need to change mail server. I feel is this a nice feature. But how effective is this from preventing spam and allowing real emails to come through What do you think? Does this method have the ability to learn what is spam?

news/network-security/spam-filtering-with-qpsmtpd

Since 2005 there has been an immense increase in brute force SSH attacks and though Linux is pretty secure by default, it does not stop evil programs from indefinitely trying to login with different passwords. Having good firewalls is one step to help protect your Linux box. Getting the right Iptables is not always easy. The Linux user can certainly manually add Iptable rules to there firewall but is there a better way? One piece of software that can help automate part of creating firewall rules is called Fail2Ban. Do you have any favorites or a review on Fail2ban?

news/network-security/block-brute-force-attacks-with-iptables

It