For many of us, money can get tight every now and then. We have felt the pinch, and many are feeling it now. If you are in that situation where you now have a lot of debt, and are wondering what you can do about it, there is a possible solution for you with a second mortgage.
If you already own a home, have some equity built up in it, have a decent credit rating, then you probably already qualify. Here are some things you need to know about getting a second mortgage for debt consolidation.
First Things First
Before you think about getting a second mortgage, there is the possibility of a more economical way to consolidate some debt. That step would be to refinance your first mortgage. It only makes sense, though, if you can refinance at a lower rate of interest than what you currently have on your existing mortgage and present debts, such as your credit cards, that this would be a good way to go. This should be looked at as your first choice because a second mortgage will have higher rates of interest than a first mortgage.
How It Can Help
If refinancing is not available to you, then consider getting a second mortgage. This type of loan is usually against the equity of the home – often called a home equity line of credit. A second mortgage can save you a considerable amount of money by giving you lower interest rates than credit cards, and by making your payments smaller each month.
Look At Loan Costs
When you are ready to choose which loan is for you, you need to look at more than just the interest rates. One of these would be the length of time for the loan. While it is a good thing to have lower payments, you also need to make sure that the total amount to be paid puts you in a better situation. A longer time period may end up meaning that you are actually paying more over the long run. In addition, you need to consider all other fees (points and closing costs) before you commit yourself for the long haul.
Consider The Type of Loan
Then, you should think about the type of second mortgage you want. A fixed rate mortgage allows you to have a steady payment for the duration of the loan. On the other hand, a variable rate mortgage has flexible payments that are dependent on the economy.
This means you could have a real savings some years, and higher payments in the bad times. Generally, if the economy looks like it will be good for a while, then this would be the best way to go. Be sure, though, that you refinance it before the rates get totally out of hand and you lose your home.
Whenever you deal with loans and second mortgages, be sure to compare it with other lenders. You can do this very easily online and get an online quote very quickly. While a second mortgage can be used for any purpose, you should apply the money you need to pay off all existing debt (debt consolidation is good, but debt removal is better) before you do any thing else with it.
Monday, December 21, 2009
Mutual Funds- A Secure Investment
Mutual funds are a collection of stocks and/or bonds invested in different securities, which include fixed market securities and money market instrumentals. It facilitates investors to put their money under an efficient investment management. There are three types of mutual funds namely, income funds, growth funds, and balanced funds.
The basic principle underlying mutual funds is to pool in money with other people to convert it into funds. Mutual funds generally buy shares in stocks wherein an experienced fund manager performs the task of selecting, purchasing and selling off the stocks himself. Certificates are then issued to the shareholders as a testimony of proof of their partnership and participation in the emoluments of funds.
There are particularly three ways in which you can make money from a mutual fund. They are:
1. Benefits can be earned from the commission on stocks, and interests on bonds. All the income received all round the year is paid by the funds in the form of a distribution.
2. The fund will have an outstanding benefit provided the funds sell high priced securities. Most of the profits are given back to the investors in a distribution.
3. The value of the fund’s share automatically increases with an increase in the value of unsold high priced fund holdings. Accordingly, you can always sell shares of your mutual fund for profits.
Many people find investing in mutual funds an attractive option to that of dealing directly with the stock market because it is comparatively safe. In fact, these days, mutual funds have become the first preference of many investors. Mutual funds provide a balanced and better approach compared to conventional stock market alternatives. It has an added advantage of investing in several distinct sectors and firms, so, if one company suffers losses, the others may be rising. Investing in mutual funds, therefore, minimizes the loss-bearing risk of monetary assets.
In a nutshell, here are the salient points of the advantages of mutual funds:
1. Cost-effectiveness of investing in mutual funds: The main advantage of investing in mutual funds is the efficient management of your finances. Investors buy funds because they lack the competence and time to manage their own portfolio. It is a cost effective method, especially for a small investor because it is expensive to get a manager to manage individual investments.
2. Diversification: Compared to individual stocks or bonds, mutual funds diversify the risk of bearing loss. The basic intention being to invest in a diverse number of assets in order to overcome the negatives of loss making stocks or bonds by the profits reaped by others.
3. Economy of Scale: The transaction expenses are relatively low as a mutual fund is bought and sold in large amounts of credits.
4. Liquidity: Mutual funds provide the opportunity of converting shares into cash at any point of time.
5. Simplicity: It is easy to buy a mutual fund. Most companies have their own automatic purchase plans, and the minimum investment rates are very small.
Therefore, investing in mutual funds is certainly a secure investment as the chance of loss is spread out, and the opportunity for gains are numerous. At the same time, it is both cost-effective and an investment that gives great future returns.
The days of depending on government largesse in meeting old age financial requirements are growing dimmer by the day. Hence, investing in mutual funds can be a wise choice, especially for those who plan for an early retirement and hope to enjoy a secure senior citizenship.
The basic principle underlying mutual funds is to pool in money with other people to convert it into funds. Mutual funds generally buy shares in stocks wherein an experienced fund manager performs the task of selecting, purchasing and selling off the stocks himself. Certificates are then issued to the shareholders as a testimony of proof of their partnership and participation in the emoluments of funds.
There are particularly three ways in which you can make money from a mutual fund. They are:
1. Benefits can be earned from the commission on stocks, and interests on bonds. All the income received all round the year is paid by the funds in the form of a distribution.
2. The fund will have an outstanding benefit provided the funds sell high priced securities. Most of the profits are given back to the investors in a distribution.
3. The value of the fund’s share automatically increases with an increase in the value of unsold high priced fund holdings. Accordingly, you can always sell shares of your mutual fund for profits.
Many people find investing in mutual funds an attractive option to that of dealing directly with the stock market because it is comparatively safe. In fact, these days, mutual funds have become the first preference of many investors. Mutual funds provide a balanced and better approach compared to conventional stock market alternatives. It has an added advantage of investing in several distinct sectors and firms, so, if one company suffers losses, the others may be rising. Investing in mutual funds, therefore, minimizes the loss-bearing risk of monetary assets.
In a nutshell, here are the salient points of the advantages of mutual funds:
1. Cost-effectiveness of investing in mutual funds: The main advantage of investing in mutual funds is the efficient management of your finances. Investors buy funds because they lack the competence and time to manage their own portfolio. It is a cost effective method, especially for a small investor because it is expensive to get a manager to manage individual investments.
2. Diversification: Compared to individual stocks or bonds, mutual funds diversify the risk of bearing loss. The basic intention being to invest in a diverse number of assets in order to overcome the negatives of loss making stocks or bonds by the profits reaped by others.
3. Economy of Scale: The transaction expenses are relatively low as a mutual fund is bought and sold in large amounts of credits.
4. Liquidity: Mutual funds provide the opportunity of converting shares into cash at any point of time.
5. Simplicity: It is easy to buy a mutual fund. Most companies have their own automatic purchase plans, and the minimum investment rates are very small.
Therefore, investing in mutual funds is certainly a secure investment as the chance of loss is spread out, and the opportunity for gains are numerous. At the same time, it is both cost-effective and an investment that gives great future returns.
The days of depending on government largesse in meeting old age financial requirements are growing dimmer by the day. Hence, investing in mutual funds can be a wise choice, especially for those who plan for an early retirement and hope to enjoy a secure senior citizenship.
Choosing The Right DC Power Supply For Your Application
The DC Power Supply is a rather fundamental electronic device, however there are hundreds of DC Power Supply products on the market from dozen of manufacturers. Narrowing down the best product for your application and budget can be a daunting task.
This article addresses DC Power Supply differentiators, functions and the applications they are best suited for. The article’s focus is DC Power Supplies used by engineers, manufacturers, quality professionals and electronic hobbyists for the purposes of R&D, manufacturing and testing.
Power Supplies can range in price from $50 to $20,000 and the cost is often directly proportional to the amount of power the device outputs. The primary function of a power supply is to regulate output voltage and current. It takes an input power and regulates the output power as to enforce a constant voltage and current.
In the case of DC Power Supplies, the input power is converted from alternating current (AC) to direct current (DC). There are two basic types of regulated DC Power Supplies: Linear and Switching.
Linear power supplies can never output a higher voltage than the input source. In theory, a linear power supply that is driven by typical 110V wall outlet could only output 110V, assuming the device were 100% efficient. Realistically, no power supply is 100% efficient because power conversion always results in energy loss, usually in the form of heat dissipation. Therefore, linear power supplies usually output voltage that is significantly less than the input.
Switching power supplies can step-up, step-down or invert the input voltage. Switching power supplies are usually larger, noisier and more expensive than their linear counterparts, however, switching power supplies are typically more efficient.
Choosing the right DC power supply for your application requires definition of some basic design specifications: voltage range, current range, number of outputs, power cleanliness (known as “ripple”) and programmability. In general, the higher the output voltage and the lower the ripple, the more expensive the DC Power Supply. Multiple outputs and programmability features will also add to the cost.
The least expensive DC Power Supplies are ideal for electronics hobbyists and basic electro-mechanical applications where only raw power is required. It is likely that the devices being powered in these applications already have power-conditioning features that eliminate the need for precision input power. Low power, single output, DC power supplies range in price from $50 to $200.
Mid-range power supplies are best suited for non-critical, laboratory projects involving more advanced electro-mechanical applications or basic board-level testing. Mid-range power supplies might have multiple outputs, higher power ratings, lower ripple and precision, digital metering (+/- .001V, +/- .01A). Mid-range DC power supplies can be linear or switching and could range in price from $200 to $1,000.
High-end applications requiring high output voltage, advanced programmability (GPIB PC Interfaces), numerous outputs and very low ripple should budget in excess of $1,000 for their DC power supply. Many laboratory, R&D and testing applications could easily spend $5,000 to $10,000 per power supply.
This article has introduced some basic features and applications of DC Power Supplies. Before making your final purchase, be sure to consult the manufacturer and thoroughly understand all the specifications of a particular product. Choosing the best and most economical DC Power Supply for your application does not have to be a complex and time-consuming task. By identifying your design parameters, you will quickly narrow down product selection to niche class of products from only a few manufacturers.
This article addresses DC Power Supply differentiators, functions and the applications they are best suited for. The article’s focus is DC Power Supplies used by engineers, manufacturers, quality professionals and electronic hobbyists for the purposes of R&D, manufacturing and testing.
Power Supplies can range in price from $50 to $20,000 and the cost is often directly proportional to the amount of power the device outputs. The primary function of a power supply is to regulate output voltage and current. It takes an input power and regulates the output power as to enforce a constant voltage and current.
In the case of DC Power Supplies, the input power is converted from alternating current (AC) to direct current (DC). There are two basic types of regulated DC Power Supplies: Linear and Switching.
Linear power supplies can never output a higher voltage than the input source. In theory, a linear power supply that is driven by typical 110V wall outlet could only output 110V, assuming the device were 100% efficient. Realistically, no power supply is 100% efficient because power conversion always results in energy loss, usually in the form of heat dissipation. Therefore, linear power supplies usually output voltage that is significantly less than the input.
Switching power supplies can step-up, step-down or invert the input voltage. Switching power supplies are usually larger, noisier and more expensive than their linear counterparts, however, switching power supplies are typically more efficient.
Choosing the right DC power supply for your application requires definition of some basic design specifications: voltage range, current range, number of outputs, power cleanliness (known as “ripple”) and programmability. In general, the higher the output voltage and the lower the ripple, the more expensive the DC Power Supply. Multiple outputs and programmability features will also add to the cost.
The least expensive DC Power Supplies are ideal for electronics hobbyists and basic electro-mechanical applications where only raw power is required. It is likely that the devices being powered in these applications already have power-conditioning features that eliminate the need for precision input power. Low power, single output, DC power supplies range in price from $50 to $200.
Mid-range power supplies are best suited for non-critical, laboratory projects involving more advanced electro-mechanical applications or basic board-level testing. Mid-range power supplies might have multiple outputs, higher power ratings, lower ripple and precision, digital metering (+/- .001V, +/- .01A). Mid-range DC power supplies can be linear or switching and could range in price from $200 to $1,000.
High-end applications requiring high output voltage, advanced programmability (GPIB PC Interfaces), numerous outputs and very low ripple should budget in excess of $1,000 for their DC power supply. Many laboratory, R&D and testing applications could easily spend $5,000 to $10,000 per power supply.
This article has introduced some basic features and applications of DC Power Supplies. Before making your final purchase, be sure to consult the manufacturer and thoroughly understand all the specifications of a particular product. Choosing the best and most economical DC Power Supply for your application does not have to be a complex and time-consuming task. By identifying your design parameters, you will quickly narrow down product selection to niche class of products from only a few manufacturers.
Cultured Freshwater Pearl Necklace
Are you in search of a late Christmas present or early Valentines Day present. Then these beautiful 14k Yellow Gold White Freshwater Cultured Pearl AA Grade 6.5x7mm Necklace, 18"
are just what you are looking for.These cultured freshwater pearl necklace is of the finest quality. Here is a picture for you to see:
As you can see, these Cultured freshwater pearls are great and would look wonderful around your spouses, girlfriends or significant others neck.
A classic pearl strand is a jewelry wardrobe essential--versatile, beautiful, and always in fashion. This 18-inch strand showcases 6.5-7mm semi-round white freshwater cultured pearls, nicely matched for size, shape, and color, and individually knotted on coordinating silk cord. The pearls have a beautiful medium luster with light blemishing. Whether it's worn casually or formally, this necklace puts a sophisticated finish on any outfit it graces. It fastens with an elegant filigree clasp, in solid 14 karat yellow gold.
Don't wait another minute, before these go out of stock. Get yours right now by clicking on this link: 14k Yellow Gold White Freshwater Cultured Pearl AA Grade 6.5x7mm Necklace, 18"
Solve The Cash Emergency With Payday Loan Lenders
Cash emergencies can happen. Even if you are very diligent in your life and even if you are careful with your expenses, you can still find yourself in such a situation. It is possible that some immediate repairs may be needed in your house or that someone in the family got sick. These situations will call for expenses that may go beyond your budget. As such, it is very crucial that you know what your options are during cash emergencies.
It is best to get to know the payday loan lenders that you can call out to. Today, getting a personal payday loan is a common resort for people. This allows them to get a cash advance so that they are able to get by even if their pay days are still a few days far.
There are certain advantages if you choose to get a payday loan. Lenders in general provide requirements that are within the capacity of the borrowers. It is also very convenient to access them because most of them can be found online. All you need is a computer and a net access. Take a few searches and you can find lots of payday loan lenders.
Online payday loans are also helpful to people with bad credit history. Most payday loan lenders do not look at the history of the applicant. As long the requirements are fully complied with, then the loan can be easily approved. There is no need to worry that you may get turned down eventually.
How to Choose Among Payday Loan Lenders
Given the many lending companies that have flocked the market, you can make good use of some tips that will help you get the most favorable option.
First thing to do is to get to know the deals offered by the lender. You must look for low interest rate and minimal charges offered. These will be most favorable because you get the loan with less money to pay out. You can also make good use of extended period of payment, especially if you think that cash will not come easily soon.
Then, you also have to review the terms and conditions. Sometimes, low interest rates can attract you. However, it is possible that they have very stringent condition that you still end up paying high in the end. Just study well the terms so that you will not fall on technicalities that will consume your money.
You should also get a reputable payday loan lender. There are many lending companies today. So many that you can easily get lost in their various offers. It is best to seek the ones that are reliable and reputable. Avoid those lenders that may only deceive you.
The more reliable ones will display right away the essential information to their clients. They will reveal to you the interest rates and conditions without too much fuss. Be sure you get the services of reputable online payday loan lenders to ensure your security in the deal.
Another reason why you should be careful in choosing the lenders is that you will be giving out essential information. You cannot afford losing your security because you have given away your information. Seek those lenders who will keep their word in keeping confidential things.
Conclusion
Solve your cash emergency situation. Find the right payday loan lender and get the best out of your situation.
It is best to get to know the payday loan lenders that you can call out to. Today, getting a personal payday loan is a common resort for people. This allows them to get a cash advance so that they are able to get by even if their pay days are still a few days far.
There are certain advantages if you choose to get a payday loan. Lenders in general provide requirements that are within the capacity of the borrowers. It is also very convenient to access them because most of them can be found online. All you need is a computer and a net access. Take a few searches and you can find lots of payday loan lenders.
Online payday loans are also helpful to people with bad credit history. Most payday loan lenders do not look at the history of the applicant. As long the requirements are fully complied with, then the loan can be easily approved. There is no need to worry that you may get turned down eventually.
How to Choose Among Payday Loan Lenders
Given the many lending companies that have flocked the market, you can make good use of some tips that will help you get the most favorable option.
First thing to do is to get to know the deals offered by the lender. You must look for low interest rate and minimal charges offered. These will be most favorable because you get the loan with less money to pay out. You can also make good use of extended period of payment, especially if you think that cash will not come easily soon.
Then, you also have to review the terms and conditions. Sometimes, low interest rates can attract you. However, it is possible that they have very stringent condition that you still end up paying high in the end. Just study well the terms so that you will not fall on technicalities that will consume your money.
You should also get a reputable payday loan lender. There are many lending companies today. So many that you can easily get lost in their various offers. It is best to seek the ones that are reliable and reputable. Avoid those lenders that may only deceive you.
The more reliable ones will display right away the essential information to their clients. They will reveal to you the interest rates and conditions without too much fuss. Be sure you get the services of reputable online payday loan lenders to ensure your security in the deal.
Another reason why you should be careful in choosing the lenders is that you will be giving out essential information. You cannot afford losing your security because you have given away your information. Seek those lenders who will keep their word in keeping confidential things.
Conclusion
Solve your cash emergency situation. Find the right payday loan lender and get the best out of your situation.
Solutions To Small Business Banking
Many businesses find that just knowing the bottom line of their credit limits is not going to suffice in managing their business. There are solutions to Small Business banking that can give business executives more than the bottom line. Through their online banking accounts, they can transfer funds wherever they need to in the world and keep a running record of all expenses.
Accountants for small businesses love the solutions to small business banking being offered today at many bank branches. The accountant's work is almost completed for them by the time the end of the month arrives. The paper trail provided by the solutions to small business banking is organized in files and the accountant is saved the task of sorting through various piles of paperwork for each department.
The solutions to Small Business banking allow the Accounts Receivable and Accounts Payable sections to do all of their invoices through the online invoicing services. The payments that are due by clients can easily be paid through the online payment options and all fees associated with those payments can be attributed to the correct client. Some of the methods of payment might be through other payment centers, but the amounts are delivered to the correct account in one easy payment process.
Other solutions to Small Business banking will affect every employee. There are some bank branches that use the online payroll services to transfer salaries to the correct bank accounts, and these accounts can be anywhere in the world. Many payments can be made on behalf of the employee too such as child support payments that must arrive by a certain date. The employee uses these solutions to Small Business banking to satisfy Court requirements and to have a legal record of the payment made to a child that can be sent to any legal entity in a matter of seconds.
The organization benefits of the solutions to Small Business banking services will be truly appreciated every year at tax time. There are online tax services available that provide tax solutions to Small Business banking and allow banks to keep accurate record of all expenses and costs associate with the tax year such as filing fees. The tax services provide employees with their W-2 forms and allow employers to maintain accurate files on their employee deductions throughout the year.
Other solutions to Small Business banking will allow small business owners to track purchases. The business check card services also allow businesses to allocate funding four times a year and keep those balances on the cards. This keeps the small business owner from over-spending and helps them to maintain accountability for all inventories that can later be used on tax forms to calculate depreciation costs.
Accountants for small businesses love the solutions to small business banking being offered today at many bank branches. The accountant's work is almost completed for them by the time the end of the month arrives. The paper trail provided by the solutions to small business banking is organized in files and the accountant is saved the task of sorting through various piles of paperwork for each department.
The solutions to Small Business banking allow the Accounts Receivable and Accounts Payable sections to do all of their invoices through the online invoicing services. The payments that are due by clients can easily be paid through the online payment options and all fees associated with those payments can be attributed to the correct client. Some of the methods of payment might be through other payment centers, but the amounts are delivered to the correct account in one easy payment process.
Other solutions to Small Business banking will affect every employee. There are some bank branches that use the online payroll services to transfer salaries to the correct bank accounts, and these accounts can be anywhere in the world. Many payments can be made on behalf of the employee too such as child support payments that must arrive by a certain date. The employee uses these solutions to Small Business banking to satisfy Court requirements and to have a legal record of the payment made to a child that can be sent to any legal entity in a matter of seconds.
The organization benefits of the solutions to Small Business banking services will be truly appreciated every year at tax time. There are online tax services available that provide tax solutions to Small Business banking and allow banks to keep accurate record of all expenses and costs associate with the tax year such as filing fees. The tax services provide employees with their W-2 forms and allow employers to maintain accurate files on their employee deductions throughout the year.
Other solutions to Small Business banking will allow small business owners to track purchases. The business check card services also allow businesses to allocate funding four times a year and keep those balances on the cards. This keeps the small business owner from over-spending and helps them to maintain accountability for all inventories that can later be used on tax forms to calculate depreciation costs.
Check List for Linux Security
Check List for Linux Security
Linux is an amazing operating system considering how it was originally created. It was a modest program written for one person as a hobby – Linus Torvald of Finland. It has grown into a full-fledge 32-bit operating system.
It is solid, stable and provides support for an incredible number of applications. It has very powerful capabilities and runs very fast and rarely crashes.
Unfortunately Linux machines are broken almost every day. This happens not because it is an insecure operating system. It contains all the necessary tools to make it very secure. But the truth is. It hasn’t become significantly more secure with the increase in popularity.
On the other hand, our understanding of the hackers methods and the wide variety of tools and techniques available contributed to help system administrators to secure their Linux computers.
Our goal in this article is to list the most critical situations, and how to prevent an invasion with simple measures.
1- Weak passwords – By far the first and most used method used by hackers to try penetrating a Linux system is cracking a password, preferently of the user root. Usually they will target a common user first, and then, using his/her access to the operating system, try to get a privileged access cracking the root password. Good password policy, and good passwords are absolutely critical to the security on any computer. Some common mistakes when selecting a password:
A- use “password” as password.
B- use the name of the computer.
C- a well-know name from science, sports or politics.
D- reference to movies.
E- anything that is part of the user web site.
F– references associated with the account.
The latest version of Linux offer shadowed passwords. If a cracker can see an encrypted password, crack it would a simple task. So, instead of storing the password in the passwd file, they are now stored in the shadow file which is readable only for root. Before a hacker can crack a password he needs to figure out an account name.
So, simple accounts names must be avoided as well. Another security measure is to apply a “no login” to the account in the passwd file. This must be done to all the accounts that don’t need to log in to the system. Examples are: apache, mysql, ftp and other.
Limit which terminals root may log in from. If the root account is allowed to log in only in certain terminals that are considered secure, it will be almost impossible for a hacker to penetrate the system. This can be done listing the allowed terminals on /etc/security. The login program will consider insecure any terminal that is not listed on this file, which is readable, only by root.
2- Open Network Ports
Any Linux default installation will provide the Operating System with tons of software and services. Several of them are not necessary or even wanted by the administrator. Removing these software and services will close the path to several attacks and improve security.
The /sbin/chkconfig program can be used to stop services from automatically starting at run levels 3, 4 and 5. Log in as root and type /sbin/chkconfig --list to view all the services set to start automatically. Select the ones you don’t need and type /sbin/chkconfig 345 name_of_service off. You must do that to all services you don’t want to keep running. Also, the xinetd server can be used to disable other services as well.
3- Old Software Versions
Everyday vulnerabilities are found in programs, and most of them are fixed constantly. It is important, and sometimes critical, to keep up with the changes. There are mailing lists for every Linux distribution where one can have security related information’s, and the latest vulnerabilities found.
Some place to watch for security holes are:
· http://www.redhat.com/mailman/listinfo/redhat-announce-list
· http://www.debian.org/MailingLists/
· http://www.mandrakesecure.net/en/mlist.php
· http://www.suse.com/us/private/support/security/index.html
· http://www.freebsd.org/security/index.html
· http://www.linuxtoday.com/
· http://www.lwn.net/
It is crucial to insure that the security released patches are applied to the programs as soon as they area available. The hacker community will be aware of the discovered holes and will try to explore them before the fixes are applied.
4- Insecure and Badly Configured Programs
There are some programs that have a history of security problems. To name a few IMAP, POP, FTP, port map and NFS, are the most known. The good thing is that most of these programs can be replaced by a secure version like spop, sftp or scp.
It is important that, before deploying any service, the administrator investigate its security history. Sometimes simple configuration measures can prevent serious headaches in the future.
Some advices regarding a web server configuration are well worth to mention:
- Never run the web server as a privileged user;
- Do not keep clients’ confidential data on the web server – Credit card numbers, phone numbers, mailing addresses, must be recorded on a different machine.
- Make sure the privileged data that a user supplies on a form does not show up as a default for the next person to use the form;
- Establish acceptable values for data that is supplied by web clients.
- Check vulnerabilities on CGI programs.
5- Stale and Unnecessary Accounts
When a user no longer uses his /her account, make sure it is removed from the system. This stale account won’t have this password changed periodically leaving a hole. Publicly readable or writable files owned by that account must be removed. When you remove an unnecessary service make sure you remove or disable the correspondent account.
Security Resources in the web
Bugtraq – Includes detailed discussions of Unix security holes
http://www.securityfocus.com/
Firewalls – Discuss the design, construction, operation, and maintenance of firewall systems.
http://www.isc.org/services/public/lists/firewalls.html
RISKS Discuss risks to society from computers
http://www.risks.org/
Insecure.org
http://www.insecure.org/
Linux is an amazing operating system considering how it was originally created. It was a modest program written for one person as a hobby – Linus Torvald of Finland. It has grown into a full-fledge 32-bit operating system.
It is solid, stable and provides support for an incredible number of applications. It has very powerful capabilities and runs very fast and rarely crashes.
Unfortunately Linux machines are broken almost every day. This happens not because it is an insecure operating system. It contains all the necessary tools to make it very secure. But the truth is. It hasn’t become significantly more secure with the increase in popularity.
On the other hand, our understanding of the hackers methods and the wide variety of tools and techniques available contributed to help system administrators to secure their Linux computers.
Our goal in this article is to list the most critical situations, and how to prevent an invasion with simple measures.
1- Weak passwords – By far the first and most used method used by hackers to try penetrating a Linux system is cracking a password, preferently of the user root. Usually they will target a common user first, and then, using his/her access to the operating system, try to get a privileged access cracking the root password. Good password policy, and good passwords are absolutely critical to the security on any computer. Some common mistakes when selecting a password:
A- use “password” as password.
B- use the name of the computer.
C- a well-know name from science, sports or politics.
D- reference to movies.
E- anything that is part of the user web site.
F– references associated with the account.
The latest version of Linux offer shadowed passwords. If a cracker can see an encrypted password, crack it would a simple task. So, instead of storing the password in the passwd file, they are now stored in the shadow file which is readable only for root. Before a hacker can crack a password he needs to figure out an account name.
So, simple accounts names must be avoided as well. Another security measure is to apply a “no login” to the account in the passwd file. This must be done to all the accounts that don’t need to log in to the system. Examples are: apache, mysql, ftp and other.
Limit which terminals root may log in from. If the root account is allowed to log in only in certain terminals that are considered secure, it will be almost impossible for a hacker to penetrate the system. This can be done listing the allowed terminals on /etc/security. The login program will consider insecure any terminal that is not listed on this file, which is readable, only by root.
2- Open Network Ports
Any Linux default installation will provide the Operating System with tons of software and services. Several of them are not necessary or even wanted by the administrator. Removing these software and services will close the path to several attacks and improve security.
The /sbin/chkconfig program can be used to stop services from automatically starting at run levels 3, 4 and 5. Log in as root and type /sbin/chkconfig --list to view all the services set to start automatically. Select the ones you don’t need and type /sbin/chkconfig 345 name_of_service off. You must do that to all services you don’t want to keep running. Also, the xinetd server can be used to disable other services as well.
3- Old Software Versions
Everyday vulnerabilities are found in programs, and most of them are fixed constantly. It is important, and sometimes critical, to keep up with the changes. There are mailing lists for every Linux distribution where one can have security related information’s, and the latest vulnerabilities found.
Some place to watch for security holes are:
· http://www.redhat.com/mailman/listinfo/redhat-announce-list
· http://www.debian.org/MailingLists/
· http://www.mandrakesecure.net/en/mlist.php
· http://www.suse.com/us/private/support/security/index.html
· http://www.freebsd.org/security/index.html
· http://www.linuxtoday.com/
· http://www.lwn.net/
It is crucial to insure that the security released patches are applied to the programs as soon as they area available. The hacker community will be aware of the discovered holes and will try to explore them before the fixes are applied.
4- Insecure and Badly Configured Programs
There are some programs that have a history of security problems. To name a few IMAP, POP, FTP, port map and NFS, are the most known. The good thing is that most of these programs can be replaced by a secure version like spop, sftp or scp.
It is important that, before deploying any service, the administrator investigate its security history. Sometimes simple configuration measures can prevent serious headaches in the future.
Some advices regarding a web server configuration are well worth to mention:
- Never run the web server as a privileged user;
- Do not keep clients’ confidential data on the web server – Credit card numbers, phone numbers, mailing addresses, must be recorded on a different machine.
- Make sure the privileged data that a user supplies on a form does not show up as a default for the next person to use the form;
- Establish acceptable values for data that is supplied by web clients.
- Check vulnerabilities on CGI programs.
5- Stale and Unnecessary Accounts
When a user no longer uses his /her account, make sure it is removed from the system. This stale account won’t have this password changed periodically leaving a hole. Publicly readable or writable files owned by that account must be removed. When you remove an unnecessary service make sure you remove or disable the correspondent account.
Security Resources in the web
Bugtraq – Includes detailed discussions of Unix security holes
http://www.securityfocus.com/
Firewalls – Discuss the design, construction, operation, and maintenance of firewall systems.
http://www.isc.org/services/public/lists/firewalls.html
RISKS Discuss risks to society from computers
http://www.risks.org/
Insecure.org
http://www.insecure.org/
Subscribe to:
Posts (Atom)