Tag: security

Let’s Use rkhunter To Look For Rootkits

In this article, we’ll go hunting for rootkits with a tool known as ‘rkhunter‘. It’s relatively easy to use rkhunter and this article will show you how. Don’t worry, it’s not all that complicated. You can do it.

Recommended reading: What You Need to Know About Linux Rootkits

So, what is a rootkit? Well, for the purposes of this exercise, a rootkit is malware that hides itself while allowing privileged access to the system. In other words, it’s the kit that allows an unauthorized person to use the system with root privileges. The word ‘malware‘ refers to software that would do you or your system harm.

A rootkit is one of many types of malware, like viruses and trojans, and Linux isn’t entirely immune to such. If you give an application privileges, it can and will use those privileges. That’s true for software you want and software you don’t want.

Malware exists for Linux! Know what you’re installing before you install it, and get your software from legitimate sources! Linux has some security advantages, and your actions can easily nullify those advantages. If you give something the permissions necessary to make it executable, it can be executed – even if it’s malware.

The rkhunter application is a software tool that will help you check your system for rootkits and some other exploits. It doesn’t help you remove them, it only helps you identify them. 

If you’re curious, rkhunter describes itself as:

rkhunter is a shell script which carries out various checks on the local system to try and detect known rootkits and malware. It also performs checks to see if commands have been modified, if the system startup files have been modified, and various checks on the network interfaces, including checks for listening applications.

Let’s put it to use!

Hunt Rootkits With ‘rkhunter’:

In order to use rkhunter, you have to install it. It’s possibly in your default repos and your package manager is ready to install it. If not, you can grab a copy from their repository and build it. Those using Debian or the likes, can just install it with:

You can adjust that for your distro to see if it’s available. If it’s a mainstream distro, it’s probably available. Once installed, you start the scan with:

This command (there are others, jcheck man rkhunter) will be interactive. You need to sit there to press ENTER once in a while. It’s quick and monitoring it means you’ll see any warnings.

Once it has finished running it will tell you about any warnings. A warning doesn’t necessarily mean an infection!

After checking the warnings, see the log for more information. Read the log every time – that’s where most of the output is stored. Read the log with:

Now it’s up to you. You need to process that information. You may see output such as this:

That doesn’t mean I have 8 rootkits, it means I need to check the logs further to see what it’s calling a potential rootkit. In this case, one of the signs of a rootkit is a process that takes up a lot of RAM. Well, my browser is taking up a bunch of RAM and that’s one of the things it is warning me about.

When I say it’s up to you, it’s really up to you. You have to read the report and the logs to understand what is going on. DO NOT PANIC! The warnings can look scary – but they’re often just warnings. Read the logs thoroughly and understand what you’re reading before you do anything drastic!

Closure:

And there you have it! Another article in the books and this one about security. If you think you have a rootkit, feel free to leave a comment, but rkhunter tends to be a little trigger-happy with the warnings.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

How To: Enable The Root Account in Ubuntu

This will be a quick and easy article, where I explain how to enable the root account in Ubuntu. It’s easy to enable the root account, but you may not want to. The choice is up to you.

This article really starts here, with a pet peeve. See, Ubuntu doesn’t ship with root enabled by default and it does that for security reasons. If there’s no root account, the root account can’t be compromised. Instead, it relies on sudo for elevating permissions. If you ask at some sites, they’ll give you a lecture instead of telling you how to enable root.

Me? I disagree with that. If you want to know how to enable root, I’ll tell you how to enable root. It’ll likely come with a blurb that tells you why you may want to avoid doing so – but I’ll give you the answer to your question.

About the only time I won’t give you a direct answer is when it’s obvious that you’re asking me to do your homework. I may also not tell people how to do their job. After all, I don’t want incompetence entering the workforce and I don’t want incompetent people staying staying in the field.

I view Linux as not just an OS but also as a bit of a philosophy, a philosophy of constant learning, continued improvement, and a never-ending quest for greater understanding. If someone wants to know how to enable root, I’m damned well going to tell them how to enable root.

Yes, it may lessen their security, and I’ll make sure to tell them that as well. I’ll be sure to tell them why Ubuntu made the choice and what it means if they undo it. It’s their system. If they want to enable root, I will help them do that.

Enable Root in Ubuntu:

Having said all of that above, it’s actually really trivial to enable root in Ubuntu. The first thing you’re going to do is open the terminal. Like always, you can use your keyboard, just press CTRL + ALT + T and your default terminal will open up.

Next, you’ll want to enter the following command:

Now, first it’ll ask for your current user’s password. Enter that. When you enter that, it’ll ask you to set a password for ‘root’. You’ll need to enter that password twice. Once you’re done with that, you’re done with it. That’s literally all it takes.

If you want to test this, you can login as root in TTY. Press CTRL + ALT + F3 and login as root, using the password you just assigned. To get back to your desktop, just press CTRL + ALT + F1 and it should bring you right back. If not, or if you’re not using Ubuntu, you can press and hold the left ALT button and then press the ➝ until you’re back at your desktop.

NOTE: This won’t enable GUI login as root. I’ll explain how to do that in a future article. This only enables the root account and nothing more.

If you do enable root, be aware that that means the root account can be compromised and used. Root has all the permissions. All of ’em… So, if the root account is compromised whoever has done so has complete control of the system. You should be aware of this before you make this change. Only make this change if you know what you’re doing and if you’re prepared for the consequences.

Closure:

And there you have it. You have another article in the books, this one explaining how to enable the root account. Think twice before doing so, but it’s your device and you get to make that decision. Just be aware of the consequences of doing so and you should be all set.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

How To: Change The Port SSH Uses

There are a number of things you can do to help secure SSH, and changing the port that SSH uses is one of those things that many people change. That can help, but I feel it’s important to also mention that security by obscurity isn’t really good security.

By the way, I’ve already written a couple of articles about SSH. Feel free to check ’em out, as they may get you up to speed if you’re not already there. The first link should be the link you click if you need to learn how to get started.

If you don’t know what ports are, there’s a great Wikipedia page here. We’re talking about software ports and not hardware ports. They’re well-described as this:

At the software level, within an operating system, a port is a logical construct that identifies a specific process or a type of network service.

By default, SSH uses port 22, and everybody knows it. Well, everybody that’s interested in networking knows this. And, because of this, malicious actors will scan for online computers and then check port 22 to see if SSH is running. If they find the port open, they’ll possibly try to guess the password and keep trying until they get through. 

NOTE: There are a number of ways to secure SSH, including disabling password logins entirely and using things like fail2ban to limit login attempts. I’d expect articles on those subjects in the future, but they have not yet been written by me. I’m sure other sites will have information, so use a search engine if you’re wanting to learn about those things today. (I am never gonna remember to come back and remove this.)

So, one step you can take is to make SSH listen on a different port. You can do that in isolation or along with other security methods. It’s not the greatest security fix, because people can (and do) just scan entire port ranges. While moving the port to something other than the default will help, it’s (by itself) just security by obscurity.

Knowing all that, let’s take a look at how we can change from the default port to one of your choosing. It’s actually pretty easy.

Change Your SSH Port:

To get started, we’re gonna need to open a terminal. You can do this with your keyboard, simply press CTRL + ALT + T and your default terminal should open up. By the way, you can change your default terminal.

Once that’s open, we’re going to want to edit a file using nano. You’ll do that with this command:

That will open ‘sshd_config’ (the SSH configuration file) with the nano text editor. Once that’s open, you’re going to scroll down while looking for “#Port 22”. It will look a little something like this:

changing the port SSH uses
For many of you, the next step will be obvious!

What you need to do is remove the # and then change the 22 to whatever port you want to use. So, if you wanted to change the port to 4441, you’d change the line to read:

Note the removal of the #, as the # tells the computer to ignore that line. A line starting with # (in this case) means that line is ‘commented out’, meant to be ignored.

Anyhow, once you’ve changed it to the new port you need to save it. Seeing as you’re using nano, that’s pretty easy. Just use your keyboard and press CTRL + X, then Y, and then ENTER.

Just because you’ve changed it doesn’t mean it has taken effect. You have to restart the service. To do that, you need this command:

That should restart the service, where it will now listen on the new port. From now on, you’ll connect with something like this:

Basically you’re just adding the ‘-p 4441’, except whatever port you picked, to the command. If you’re using aliases or something like Putty, be sure to change those settings as well.

NOTE: This isn’t the final step for many people. Some of you will have to change your firewall’s settings to allow TCP on the changed port. In some cases you may also have to enable it with semanage utility. In those cases, consult your documentation. If you can’t get it figured out, leave a comment and we’ll see if we can get it figured out together.

Closure:

And there you have it, another article in the books. This time, you’ve learned how to change the port that SSH uses. Hopefully that’ll come in handy for some of you. In isolation, it’s not the greatest security method – but it’s better than nothing. There’s still an article every other day!

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

How To: Create a New User Without a /home Directory

There are legit reasons to create a new user without a /home directory. Maybe you want a new user to have limited access to just a few things, or a dedicated user that runs a single application. This article will show you how.

See, I was reading a forum post on Linux.org about a member that had set up a bunch of Linux computers for some learning children. One of the things that came up was that the kids were already trying to guess the password so that they could install games. 

That got me thinking about some security implications. What if they guessed the password and wanted to hide it? What if they used that password to create a new user, but one without a /home directory so that it wouldn’t be easily spotted by just using a file manager? It wouldn’t be impossible to find, but it’d not stand out immediately with a quick inspection. Besides, the new account’s password would remain the same even if the admin changed the password to the root account.

Well, if they get that advanced and guess that password, I kinda hope they read this article! Why? Because the world needs a little chaos and creativity! So, my fellow Linux.org forum user, this article is for you! Well, no… It’s for when the kids use a search engine to learn how to make a user account a little less obvious! 

Create a New User Without /home:

This one will be short and easy, perfect for budding Linux users! There are two easy ways to create a user without automatically making a /home folder. 

Both ways are done in the terminal, so you need to open it. To open the default terminal, use your keyboard and press CTRL + ALT + T.

Now, the first method is:

The second method is:

Those commands will both make a new user without a /home directory of their own. (Be sure to check ‘man useradd’ for more awesome things you can do.)

There are a couple more steps you can take, if you want. First, there’s no password assigned to the user you just created. So, let’s assign a password to them.

Follow the prompts to type in the password twice and you’re done with that step.

Next, the newly created user isn’t a member of sudoers – meaning it has no administrative rights. That’s easily fixed with the following command:

That command will make the new user a member of the sudoers group. Meaning they have administrative rights over the system. They can install software, remove software, delete files, create files, or even update the entire system.

The admin can still discover the new user by listing the users or poking around in the logs. However, the user won’t stand out immediately. There won’t be any new user folder in /home, so one may not have any reason to look. Additionally, changing the root password won’t matter. You’ll have to do something about the user they created.

And that, kids, is how you get started hiding stuff after you’ve discovered the root password! Use that account for your nefarious activities! You’re welcome!

Closure:

Nah, there are legit reasons why you’d want a user without a home folder. You may want that user to only access a limited set of applications or whatever. A keen admin would likely notice this fairly rapidly, so it’s not a great long-term strategy for hiding your game installing.

Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.

How To: Generate Sufficiently Complex Passwords In The Terminal

In this article, I will tell you how I use pwgen to generate random passwords. It is a simple command, but comes in surprisingly handy. This being Linux, there are surely other ways to accomplish this task, but this is the method that I use.

I’ve been working on a router for the past few weeks. I’ve been working on getting this site up and running. I’ve also been working on a new computer that’s just meant for testing.

I don’t do a whole lot of password sharing and remembering. That means when I need to login to an account I’ll often just hit the button to recover my password and then use a new password entirely. This means I’ve had to generate quite a few passwords. The tool I use to do this is known as pwgen.

GENERATE COMPLEX PASSWORDS

The tool ‘pwgen’ may well be installed by default. If not, it’s very likely to be in your default repositories. I checked everything from Fedora to Mandriva, and it looks like you shouldn’t have any issues installing it. If you’re using a Debian/Ubuntu/derivative and have access to apt, then you can just install with:

Once installed, you can just run the ‘pwgen’ command from the terminal and you’ll get a bunch of random passwords. They may, or may not, be sufficiently complex and able to satisfy the various password requirements. It tosses out a lot of passwords, so it’s not like you won’t have choices.

Me? I use it a bit differently. In fact, you might even say that I use it ‘wrong’. After all, the man page describes the pwgen application as:

pwgen – generate pronounceable passwords

I don’t actually want pronounceable passwords. I want suitably complex passwords! Fortunately, pwgen can be bashed into shape and can provide all the complex passwords you desire. Here’s the command I use:

So, what’s going on with that? What do those switches do?

     s – random and hard
     n – adds numbers
     y – adds symbols
     c – at least one capital letter
     B – removes ambiguity
     1 – one password per line

The 12 is how many characters each password will have and the 6 is how many passwords it will spit out for you. So, for example, you’ll get an output like this:

In my case, this is already aliased to ‘newpass’ and that means I don’t need to type the entire command when I want a new password. Alas, I’ve not yet covered aliases. It’s on my list of articles to cover, but it’s not done yet.

Anyhow, thanks for reading. As you can see, this is the very first article at our new home. I’ll slowly move the other articles over here, editing them to match the new format and maybe making some of them a bit more thorough. This site should be faster, have the features that were used at the previous site, and a bit easier to maintain. There’s even a published privacy policy.

Don’t forget to sign up for the newsletter. It’ll only send out emails when an article has been published and won’t include any spam. I won’t give your email address out, nor will I sell or trade it. 

Linux Tips
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.