Linux security

[#1]

Quote from: petertuson

I also ran an intrusion detection system which flagged up all the bits of linux that enables interoperability with windows so I turned them off.

Can you provide a bit more info about the intrusion detection system or what problems might be caused by interoperability with Windows.
If it's very detailed a link to a site with this info would be helpful.
Thanks
dick:green Quote fixed

[#2]

Quote from: Waldo

waldo@schabziger ~ $ sudo bash

Using sudo to run bash, what kind of world is this..    Any self respecting Linux install will have the su command! 
The only time I ever login as root is when a kernel update has killed the NVidia drivers and they need rebuilding  or doing serious system management.

[#3]

You shouldn't be building or compiling anything as root! In fact, for added security and safety, you could create a separate user account for building things.

[#4]

for most things I'd agree,  but rebuilding (and most specifically installing) kernel level modules from trusted sources should be safe enough,  and if not,  there's probably more to worry about than doing so as root!

[#5]

When I need to do any system management/housekeeping, I have no qualms about "booting to root". But I will only ever do so off-line.
I am allergic to Command Line use (or just to old to learn it!) , and so value the simple "boot to root" option in PCLinuxOS.
Am I not right in thinking that it is perfectly safe off-line?

[#6]

It depends on what your concerned about...
Running as root off line would limit the ability for any malicious script/program to contact external servers but will make no difference to the damage they can cause to your system.
The main concern running X as root is usually the damage that badly coded apps or inexperienced users can cause.
Also,  it wouldn't make any practical difference whether you run a full X session as root or an individual X app with  root privileges,  they can both cause equal amounts of damage.
And don't forget,  while a malicious script or program run as a normal user can't trash your system,  it can trash your user data,  which is usually more important.

[#7]

Quote from: Heloman

https://www.grc.com/discussions.htm

Is there any particular reason why so many threads take place on grc.test?

[#8]

Quote from: kmilburn

Using sudo to run bash, what kind of world is this..

A largely hypothetical one (but it does work).

Quote

Any self respecting Linux install will have the su command!

Any self respecting Linux user would   $ man su  

[#9]

What about the possibility of forwarding an infected email to an unsuspecting punter from a Linux system? Can Clam be set up to scan outgoing emails only or can anyone recommend a small foot print Linux AV to do just the job? I also did a full scan with grc which I haven't done for years since testing out free firewalls on a windows system. I passed all tests except port 80. This machine does not run as a web server and has a built in firewall in the router so what is the best way to also stealth this port, do I need to change router settings or OS settings?
Something else I am curious about, still security related what do linux users do about ip filters when using Torrent apps and IP filters. I notice block list is now only for donators but you can get a tar text file. Is there some way of converting this text into something that can be used with QBtorrent? I notice that Transmission doesn't seem to have the ability to ip filter any more or I can't seem to find the edit preferences button  I've been using Torrents more these days after installing Virtualbox to try a few flavours.
Ironically blocklist filters are being seeded but this is definitely not the route to go down  oohh the irony. Some may say poetic justice!

[#10]

I use "encryption" on my bit torrents - not sure how effective this.
If you wanted to infect Linux, the best way would be to create a modified distro and hope that the user didn't bother to do a md5 check on the .iso file.
The best way to avoid email infection is to not follow stupid emailed instructions.

[#11]

If you don't have anything listening on port 80 I don't see why it should be open.
Not sure if clam can filter outgoing messages., I use Google for my email and it scans all messages.
transmission can use blocklists I use http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz to download it. Using transgui I control it from a different pc, Or from web gui, click on the spanner and then Peers and set it up there.

[#12]

Hmm will have a look at port 80 and see why it's not stealthed! I managed to sort out my ip filter btw. I just downloaded the p2p tar from blocklist and extracted it which was in a .txt format. Renamed it .p2p and qbtorrent added the rules to the filter. Not sure how to cjeck if the filter is working though.

[#13]

In transmission it says "Blocklist has 226,677 rules" yours should say something similar

[#14]

Thanks for that bud, I can't find anywhere in qbittorent to check other than when I run the text file it says 232172 rules were parsed and added so I guess it's working. Every time I have tried with other file formats it's always said "no rules were applied" That's something that annoys me at the minute with Linux although I am an avid fan. Why is help so hard to get hold of and the software developers pretty much leave the users to figure things out? When I find a common problem that most new users to the software undoubtedly come across I seem to have to go right round the houses and fourth page of google to get an answer! More FAQ please linux software devs 

[#15]

The sad fact is that dev's don't like writing manuals, they like writing code 
The result is that the manuals are usually written by someone else, or fleshed out by someone else.