Brute Force Defense And SELinux Insights: Key Security Updates

This tutorial shows how you can install and use F-PROT Antivirus on an Ubuntu Feisty Fawn desktop. Although there aren't many Linux viruses out there, this can be useful if you often exchange files with Windows users - it can help you to not pass on any Windows viruses (that don't do any harm to Linux systems) to Windows users. F-PROT Antivirus for Linux is free for home use. This was the first time I have heard of F-PROT Antivirus. Personal I don't use any virus scanners on my Linux machines, but I happy to see that they are out there. Do you use any antivirus software on your Linux box?

news/network-security/virus-protection-with-f-prot-antivirus-on-ubuntu-feisty-fawn

The malware blocker, which was first mocked up in June, will block Web sites thought to contain malicious downloads. The feature, a companion to the phishing site alert system in the current Firefox 2.0, will use information provided by Google Inc. to flag potentially-dangerous sites, warn anyone trying to reach those URLs with Firefox and automatically block access to the site. Have you tested out Firefox 3.0 Alpha 8? The ability to alert a users of a possible malware sites is an important security feature. I am interested in how this add-on works. Will there be any performance lose in using it extension?

news/network-security/firefox-30-alpha-blocks-malware-secures-plug-in-updates

In this article I will show how to install and configure BlockHosts on a Debian Etch system. BlockHosts is a Python tool that observes login attempts to various services, e.g. SSH, FTP, etc., and if it finds failed login attempts again and again from the same IP address or host, it stops further login attempts from that IP address/host. By default, BlockHosts supports services that use TCP_WRAPPERS, such as SSH, i.e. services, that use /etc/hosts.allow or /etc/hosts.deny, but it can also block other services using iproute or iptables. What do you think about software like BlockHosts? If users have strong passwords then software like BlockHosts will not be useful. Personal I don't like having my firewall change depending on if a script kiddie is trying a brute force attack on my network.

news/network-security/preventing-brute-force-attacks-with-blockhosts

Even companies that provide us protection against spam are targets themselves. SURBL has recently announced a public thanks to Prolexic for providing their DDOS mitigation services to protect the website. Due to their efforts the ongoing attacks are now virtually invisible. Read on for a summary of the project - maybe you should check to see if your SURBL list providers or other spam protection services are protected themselves?

news/security-projects/prolexic-defends-anti-spam-services-against-ongoing-ddos-attacks

Admins with the Gentoo Project say they have disconnected major parts of its website a week after discovering it could be vulnerable to a command injection attack that allows bad guys to remotely execute code on the machine. Gentoo seems to be taking no chances here, maybe because they where hacked earlier this year. What does this mean for Gentoo's OS security? Does this cause a concern for Gentoo users?

It was, for some reason, a common misconception that chroot can be utilized for security purposes. According to a post on Kernel Trap, such an assumption is not only wrong, but can be badly misused. An interesting discussion follows...

As SELinux continues to gain in popularity, more and more sites will take it upon themselves to give it another go around. Here is a great, quick intro from another standpoint, into SELinux and setting up the system.

Also nice, is the explanation of DAC versus MAC, and how they inter-relate. If you haven't learned much about SELinux, here's a nice way to start.

Stephen Smalley has announced the latest release of core SELinux userland code, with highlights including dynamic object class and permission discovery, per-command PAM configuration for the newrole utility, and several general updates and improvements. This release update some of the SELinux core userspace programs. One interesting change is per-command PAM configuration for the userland command newrole. I am glad to see updates to the userspace utilizes being release on a regular bases. Do you think that the NSA is pushing SELinux in the right direction?

What I discovered is that part of SELinux