Press "Enter" to skip to content

Posts published in “Security”

Limit Your Linux Super Powers With su & sudo

I recently offered some security tips aimed at new system administrators. And hey, the home users among you should take note, after all, you’re the administrator of your home system! One of the tips was “Don’t run as root.” Today I would like to expand on that a bit. First, we’ll take a look at why you should limit the use of your super powers. Then we’ll look at the best ways to use su and sudo to help you limit your risks.

The NSA, Windows & Antivirus

Poor Microsoft. The beleaguered company just can’t catch a break. We’ve already told you about how Snowden’s revelations have forced the pride of Redmond to spend who knows how many millions opening two “transparency centers” to allow government IT experts to pore through source code to prove there’s no back doors baked into Windows or other Microsoft products. Trouble is, while its engineers have been busy plastering over all traces of old back doors, they’ve left a side door standing wide open, waiting to be exploited.

Boris and NatashaIronically, this side door is intended to be a security door for third party add-ons that every Windows machine needs to keep it safe from cracker hackers — if that’s indeed possible. And this security tool is usually more trusted by Microsoft system admins, especially those outside the U.S., than Windows itself.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Five Security Tips for New Linux Admins

It’s generally fairly easy for new Linux administrators to get up and running with the basics of installing, configuring and managing Linux systems at a basic level. Truthfully, though, it takes years to get the in-depth knowledge required in many server environments today. One thing I really recommend learning early on — i.e. from the beginning — is security.

Monitor padlockI participate in a group of professional penetration testers (the nice folks who help you test your security as if they were the bad guys) called Charlotte Hackers Anonymous. I asked the group what they thought were the most important tips for new system administrators, and below are their tips, along with my thoughts on each.

Don Parris

Don Parris wears a Facility Services cape by day, and transforms into LibreMan at night. He has written numerous articles about free tech, and hangs out with the Cha-Ha crowd, learning about computer security. He also enjoys making ceviche with his wife, and writing about his travels in Perú.

Is the FOSS Infrastructure Crumbling?

It appears as if much of the open source infrastructure we depend on is suffering from neglect. That’s the message brought to the SouthEast LinuxFest (SELF) by David Nalley. Listening to his talk, “The Tragedy of Open Source,” it was hard not to think that some of our infrastructure projects are beginning to resemble some disintegrating municipal water and sewer systems, or maybe compare his examples with our crumbling roads and bridges. Nalley is a South Carolina based “recovering sysadmin” who now wears many hats at Apache as well as being an employee at Citrix.

Heartbleed logoThe neglect he mentions has caused more than a few near misses that fell inches short of disaster, with two major incidents happening last year alone.

Take the Heartbleed vulnerability that affected openSSL. Nalley points out that last year when the bug was discovered, there was only one person, earning a mere twenty grand a year, actively maintaining the openSSL project. Also last year, there was only one person maintaining bash when Shellshock was discovered.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Redmond Fights FOSS Openness With ‘Transparency’ Centers

The allegations that came with the Edward Snowden revelations of Microsoft’s cooperation with U.S. spy agencies is evidently still a problem for Redmond, if a blog item posted yesterday by security VP Matt Thomlinson is any indication. It seems the company has opened a second Transparency Center, this one in Brussels. The news comes eleven months after the announcement of the first such center on the company’s Redmond campus.

Homer Simpson spyAt the height of the media frenzy that developed around Snowden’s initial revelations, there were allegations that Microsoft had not only built back doors in its software for the NSA and other government agencies to use against foreign businesses and governments, but that it was cooperating with U.S. authorities in other ways as well. For example, one report indicated that the company was passing along details of unpatched security vulnerabilities in Windows to the NSA, effectively adding temporary tools to the spy agency’s cyber arsenal.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

WordPress Upgraded to Fix Security Holes

Website publishers using the popular free and open source WordPress content management system (CMS) woke up this morning to find that their sites had been upgraded to version 4.2.2. Users who’s sites somehow missed being automatically upgraded are urged to update immediately, as this update addresses several important security issues. According to Wordfence, maintainers of a popular WordPress security plugin, this release fixes one recently discovered vulnerability and further hardens a security issue that was addressed in version 4.2.1.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Linux Chromebooks, Securing the Web & More…

FOSS Week in Review

Unfortunately, Larry’s a little under the weather today, so here I am…

Put that on your Chromebook and run it

We hear from Softpedia that Chromixium is just about ready for prime time. Well, that may be jumping the gun a little bit. What we really hear is that the distro has now gone from beta to release candidate, and that a honest-to-goodness 1.0 stable version is virtually just around the corner. Trouble is: we’re not sure yet just how far away we are from that corner. Shouldn’t be too far, however. The beta version was only released in February, so these developers aren’t wasting time.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Samsung’s Spying TVs, Ubuntu Phone Sells Out & More…

FOSS Week in Review

Larry Cafiero is busy working for SCALE (pun intended), so you’re stuck with me for another week. Sorry.

Ubuntu Phone sale is gone in a flash

The sale of the first ever Ubuntu phone through a European flash sale was evidently a success. Of course, we wouldn’t know as the phone isn’t available yet to those of us who live on this side of the pond, so it hasn’t been getting much press over here. However, EU sites are all atwitter with headlines like “Ubuntu Sells Out!”

Ubuntu phoneThat was referring to the first flash sale, held Wednesday morning EU time, in which all devices being made available were sold out in “just a few hours,” according to Softpedia. In fact, it sold so quickly that a decision was made to hold another flash sale that same afternoon. The original flash sale was supposed to last for nine hours. The number of devices sold hasn’t been released.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Google Fiber, Net Neutrality & More…

FOSS Week in Review

Larry Cafiero’s suffering through a power failure, so you’re stuck with me today.

The holiday fest is finally over for most — it should be for everyone by Monday morning — and it’s time for some normalcy to return to the world. Of course, these days what passes for normal is pretty damn weird, if you ask me, which you didn’t. News from the tech sector is pretty quiet, but should begin to pick-up as soon as managements’ hangovers clear and the suits get back to creating mayhem…

But here’s the best of the best (or the worst of the worst, depending on how you see it) from this weeks news.

Google Fiber & the FCC

Our favorite (or not so) search company on Tuesday filed a four-page public comment with the FCC, giving the august agency (or not so) yet another reason to reclassify ISPs under Title II of the Telecommunications Act. The reason would be access to telephone poles and other stuff.

It seems that Google hasn’t always been able to gain access to infrastructure such as utility poles, ducts, conduits and rights of way in its attempt to bring speed-of-light Internet access to the U.S. one city at a time. The company claims that reclassifying service providers as common carriers would open the door and give it access.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux