General Esm W900
This week, perhaps the most interesting articles include "Securing Joomla Installations," "Gotroot Modsecurity Rules for Apache," and "Top Linux Security Stories of 2007."

Linux+DVD Magazine Our magazine is read by professional network and database administrators, system programmers, webmasters and all those who believe in the power of Open Source software. The majority of our readers is between 15 and 40 years old. They are interested in current news from the Linux world, upcoming projects etc.

In each issue you can find information concerning typical use of Linux: safety, databases, multimedia, scientific tools, entertainment, programming, e-mail, news and desktop environments.

LinuxSecurity.com Feature Extras:

Master's Student: A Quick and Dirty Guide To Kernel Hardening with GrSecurity - Our resident Master's student Gian Spicuzza chimes in this month with a great feature HowTo on Kernel Hardening! There are a number of ways to lock down a system, and RBAC (role based access control) is one of them. Read on to learn more about what makes RBAC so useful, and to read one of the best overviews on Low/Medium/High Security... The combination of the Linux kernel and GNU packages has always been regarded as a secure operating system, but can it be more secure? Kernel hardening is the answer to tightening up the Linux backbone. GrSecurity, a kernel patch for Linux, is one of the more popular approaches...

One of the most significant feature is the addition of a role-based access control system (RBAC) that monitors what each user can execute based on their role and denies execution if they overstep their pre-defined rules.

Creating Snort Rules with EnGarde - There are already tons of written Snort rules, but there just might be a time where you need to write one yourself. You can think of writing Snort rules as writing a program. They can include variables, keywords and functions. Why do we need to write rules? The reason is, without rules Snort will never detect someone trying to hack your machine. This HOWTO will give you confidence to write your own rules.

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.

EnGarde Secure Community v3.0.18 Now Available! (Dec 4)

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.18 (Version 3.0, Release 18). This release includes the brand new Health Center, new packages for FWKNP and PSAD, updated packages and bug fixes, some feature enhancements to Guardian Digital WebTool and the SELinux policy, as well as other new features.

In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database and e-mail security, integrated intrusion detection and SELinux policies and more.
Firefox Hit With Spoofing Bug (Jan 4)

A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher said Wednesday.

Aviv Raff, an Israeli researcher best known for ferreting out browser flaws, revealed the Firefox spoofing vulnerability on his personal blog, and posted a demonstration video there. He did not go public with any proof-of-concept code or working exploit, however.

Have you heard about the latest FireFox vulnerability? When do you think the developers will release a patch fixing the bug?

news/network-security/firefox-hit-with-spoofing-bug
Securing Joomla! Installations (Jan 4)

Joomla! is a well-known content management system, mature enough to be used by thousands of amateur and professional Web portals. Installation is a breeze and consists of six click-next steps. However, a default Joomla! installation is not necessarily a secure one, so let's see how we can protect our portal from potential attackers.

The first rule of security when it comes to Joomla! is "update frequently," because whenever a new version comes out, it usually comprises several user-reported bug and security fixes.

news/network-security/securing-joomla-installations
Gotroot Modsecurity Rules for Apache - Anti-spam and Security (Jan 3)

ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks.

Anything which helps Web application to be more secure is a very good thing. Have you implemented ModSecurity on your Apache server?
Top Linux Security Stories of 2007 (Jan 3)

James Turnball, one of the veterans in Linux and security, chimes in on the biggest stories in Linux security of 2007. It was an eventful year:

Storm bot attacks threatened, but new Linux tools and updates kept storm bots and most other IT security hacks at bay in 2007. That said, new problems -- such as security risks in virtual machines -- cropped up last year. Here's my round-up of the big Linux security events, software releases and controversies that cropped up in 2007.
Events: January - February (Jan 2)

Happy New Year!

Here