Weekly Security Insights: July 21 2008 - Admin Access Threats

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.19 (Version 3.0, Release 19). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

news/vendors-products/engarde-secure-community-3019-now-available

This is likely the last announcement posting for today, and maybe for this month. It is to announce availability of John the Ripper 1.7.3 Pro for Linux (stable release) and 1.7.3.1 Pro for Mac OS X (currently in public beta).I'd like to thank Alain Espinosa for the optimized NTLM code, and for kindly placing it in the public domain. This release of JtR Pro includes Alain's code with slight modifications, as well as replacement code for the password file loader; I am going to roll these into the next revision of the jumbo patch.

Have you heard John the Ripper 1.7.3 Pro for Linux was just release? Test it out for yourself and let us know what you think about this release.

This is to announce several assorted items at once. I intend to post another announcement shortly, focusing on new JtR releases, so I have left those out of this one. A patched version of mod_auth_mysql with support for our PHP password hashing framework's (phpass) portable hashes has been added to the contributed resources list on the phpass homepage: https://www.openwall.com/phpass/

Do you use mod_auth_mysql? The openwall project released a interesting patch that adds support for PHP password hashing framework's.

In an announcement for the 2.6.25.10 stable kernel, Greg KH noted, "it contains a number of assorted bugfixes all over the tree. And once again, any users of the 2.6.25 kernel series are STRONGLY encouraged to upgrade to this release." The emphasis on the word strongly led to a lengthy discussion about how security fixes are handled in the Linux Kernel. Linus Torvalds replied, "I personally consider security bugs to be just 'normal bugs'. I don't cover them up, but I also don't have any reason what-so-ever to think it's a good idea to track them and announce them as something special." Later in the thread he went on to explain, "one reason I refuse to bother with the whole security circus is that I think it glorifies - and thus encourages - the wrong behavior.

This article looks at the how the Linux kernel developers handles security fixes. What do you think about how the kernel team releases security updates? Is there a better way or model?

Linux security may seem daunting, but there are a host of best practices to simplify the maze. Recently, Steve Grubb of Red Hat Inc. outlined some important security principles, including minimizing admin access, the increasing sophistication of SELinux and the importance of auditing systems.

Like many when I think about least privileges, I think about SELinux. What do you think about? This article is a interview with a Red Hat expert that answers questions about SELinux and least privileges.

Lynis is an auditing tool for Unix (specialists). It scans the system and available software, to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes.This is a tool that might be useful for both penetration testers performing white box tests and system admins trying to secure their own systems.

Have you ever heard about the Linux security program called Lynis. This was the first time I have read an article about it. What do you think about this project? Should Linux user test it out?

Fedora 9, released last month, included the first release of FreeIPA, a new free/open source project that comes out of Red Hat with the goal of becoming a complete and integrated security information management solution. In this article we take a look at exactly what FreeIPA is, both what it can do now and what its developers hope it will be capable of in the future. It seems destined to become a key feature of Red Hat Enterprise Linux 6, and with Fedora 9 released and FreeIPA tightly integrated, now seems to be the perfect time to explore this new technology.

From reading this article what do you think about this security project that Redhat introduced? I found it interesting that they used MIT Kerberos for authentication.

Sysadmins have begun noticing a coordinated attack on servers with open SSH ports that tries to stay under the radar by only attempting to guess a password three times from any compromised machine. Instead of mounting an attack form a single compromised host, hackers have worked out a means to relay a brute force attack between multiple assault machines.

Do you have SSH open on your Linux machine? If so make sure that all your user's passwords are strong. Check out your system logs and see if attackers are trying to guess your passwords.

news/network-security/relay-server-attack-tactic-dupes-auto-reporting

Users of the open source VLC media player should download version 0.8.6i to avoid a serious vulnerability in previous releases. According to a security advisory released by the VideoLAN project, a maliciously crafted WAV file could either crash VLC or cause the execution of arbitrary code. In common with so many vulnerabilities that can be exploited through media files, this is another buffer overflow problem.

I use VLC because it supports so many different formats but, why did this security vulnerability got so much attention in the news?