Linux

When external USB flash drives or external storage media are plugged into desktop Linux distributions, automated desktop daemons (like udisks2 or automount rules) often mount them automatically. If the filesystem is mounted without explicit security constraints, an unprivileged user or malicious physical actor can escalate to root privileges instantly using pre-configured SUID binaries. The Attack Vector: SUID Preservation on Portable Filesystems POSIX filesystems (such as ext4, ext3, xfs) store Unix file permissions—including the SetUID (suid) bit (chmod 4755) and file ownership—directly inside the filesystem’s inode tables. ...

In Block-Level Disk Encryption with LUKS, we explored interactive unlocking via passphrases. However, on unattended servers, secondary data drives or database volumes must frequently unlock and mount automatically during system boot without manual console intervention. This guide outlines configuring keyfile-based authentication for LUKS partitions using /etc/crypttab and /etc/fstab. Security Architecture Note: Storing a plaintext decryption key on the same machine that hosts the encrypted data protects against drive theft (decommissioning or drive pulling), but does not protect against complete machine theft where the root filesystem is unencrypted. Ensure your root partition is also protected or store the key on a dedicated hardware token / TPM / networked keyserver. ...

Linux Unified Key Setup (LUKS) is the standard specification for Linux block-device encryption. Implemented via the dm-crypt kernel module and managed with cryptsetup, LUKS provides transparent disk encryption below the filesystem layer. This guide walks through creating an encrypted partition on a storage device, initializing the LUKS header, formatting the decrypted mapping, and managing its mount lifecycle. Step 1: Partitioning the Target Disk Identify your target drive (e.g., /dev/sdb) using lsblk or fdisk -l. Use fdisk or parted to create a partition: ...

Installing software packages from untrusted third-party repositories poses substantial security risks. In RPM-based systems (RHEL, CentOS, Fedora), an RPM is not merely an archive of binaries—it contains cryptographic signatures, file digests, and embedded shell scripts (“scriptlets”) that execute with full root privileges during installation and removal. Here is how to audit RPM package integrity and inspect scriptlets prior to execution. 1. Auditing Installed GPG Keys When YUM/DNF installs signed packages, it checks them against GPG public keys registered in the local RPM database. ...

Red Hat Enterprise Linux (RHEL) and derivative distributions classify package fixes into structured advisories: RHSA (Red Hat Security Advisory): Contains fixes for security vulnerabilities and assigned CVEs. RHBA (Red Hat Bug Advisory): Contains stability, performance, and bug fixes. RHEA (Red Hat Enhancement Advisory): Introduces non-critical product enhancements or feature additions. Using the yum-plugin-security extension (standard in RHEL 6/7 and integrated directly into dnf on RHEL 8/9), system administrators can audit and apply security-only patches without risking unexpected major version upgrades. ...

When migrating virtual machines from Oracle VirtualBox to VMware Workstation, Fusion, or ESXi, virtual disk formats must be converted to VMware’s native format (VMDK). There are two primary methods to accomplish this: using the universal qemu-img utility or VirtualBox’s native VBoxManage CLI tool. Method 1: Using qemu-img (Recommended) qemu-img is a versatile disk management tool capable of converting between raw, qcow2, VMDK, VDI, and VHD/VPC images. Installation On Ubuntu/Debian: sudo apt-get install -y qemu-utils On Fedora/RHEL/CentOS: ...

In honeypot deployments, captive portals, or specialized traffic inspection environments, administrators often need to forward all incoming traffic—regardless of destination port—to a single listening service (such as an HTTP inspection proxy or logging daemon). This can be accomplished at line rate within the Linux kernel using Netfilter Destination NAT (DNAT) via iptables. Redirecting Inbound Port Ranges via DNAT To redirect all incoming TCP traffic across ports 1 through 65535 arriving on interface eth0 to an internal service listening on port 80 at 192.168.1.10: ...

Default Red Hat Enterprise Linux (RHEL) and CentOS installations include only core system packages. To install modern software stacks, development tools, and updated dependencies, administrators frequently configure trusted third-party repositories. Here are the most common repositories and how to enable them on CentOS / RHEL: 1. EPEL (Extra Packages for Enterprise Linux) Maintained by the Fedora Special Interest Group, EPEL provides a massive collection of high-quality supplemental packages: sudo yum install epel-release -y 2. IUS (Inline with Upstream Stable) Provides up-to-date versions of key software (such as Python and Git) for Enterprise Linux: ...

Level 6 on the Smash The Stack IO wargame takes two command-line arguments (username and password) and prints a greeting: level6@io:/levels$ ./level06 user pass Hi user Notice that the application checks the LANG environment variable to determine which greeting to print: level6@io:/levels$ export LANG=fr level6@io:/levels$ ./level06 user pass Bienvenue user level6@io:/levels$ export LANG=de level6@io:/levels$ ./level06 user pass Willkommen user Vulnerability Analysis The program structure internally organizes credentials into a record: ...

Monitoring volatile market movements often requires immediate notifications without constantly watching browser tabs or mobile trading apps. By combining public REST APIs with native Linux desktop notification tools (notify-send) and speech synthesis engines (espeak), we can build a lightweight background tracker that speaks out when price targets are reached. Prerequisites On Debian/Ubuntu systems, install espeak and libnotify-bin: sudo apt-get install -y espeak libnotify-bin Python Price Alert Script The script queries a public ticker API, evaluates target price thresholds, and delivers desktop notifications alongside synthesized voice alerts: ...