RSBAC – Kernel based process hiding
A webserver usually is the primary target to intrude into any network. If you provide web hosting services for your customers you have to provide them with a lot of features to make them happy. The...
View ArticleProFTPd xferlog via MySQL
Logging your FTP transfers to xferlog with ProFTPd is a nice thing. This can easily be done by a one-liner in /etc/proftpd/proftpd.conf: [crayon-52a522ee48ef4275728911/] This generates a nice transfer...
View ArticleProcess hiding Kernel patch for 2.6.24.x
Currently all Linux kernel security patch projects seem to be sleeping. There is no useful kernel patch that provides us with a decent patch set allowing us to strengthen the Linux kernel. Some years...
View ArticleSimple PHP mail wrapper
If you run a webserver with several hundreds of virtual hosts running PHP, you definitely need to monitor or log the access to PHP’s mail() function. I describe in a short tutorial how to painlessly...
View ArticleSimple process hiding kernel patch
I have updated the process hiding kernel patch described in my previous post. The following patch was created for a vanilla kernel 2.6.27.10 from kernel.org. You should be able to patch also future...
View ArticleExtensive sendmail wrapper with sender throttling
In this tutorial I’d like to describe how to create an extensive sendmail wrapper for a web server to monitor all sent emails and throttle daily sent email volume by the senders original UID (user id)....
View ArticleProcess hiding: hidepid capabilities of procfs
Five years ago I wrote about kernel based process hiding in Linux (see articles Simple process hiding kernel patch, Process hiding Kernel patch for 2.6.24.x, RSBAC – Kernel based process hiding). It...
View Article