Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
0answers
29 views

pam su authentication with RSA token [on hold]

We are implementing RSA token authentication in our company and management decide su - should ask for RSA token passcode for individual (listed users) user. So no-one is going to get root password: ...
3
votes
0answers
42 views

Exploit in bash script parameter possible?

I want to pass an e-mail address from a web form to a bash script. I'm using the following regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}/ Is this sufficient? Or could one embed an ...
0
votes
0answers
6 views

openvassd hanging

I have a problem with openvassd hanging while starting: connect(6, {sa_family=AF_LOCAL, sun_path="/tmp/redis.sock"}, 110) = 0 fcntl64(6, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) ...
-4
votes
0answers
32 views

Do you really need antivirus software for Linux desktops? [on hold]

Recently i got free antivirus for Linux from Comodo. But right now i don't install my desktop & laptop. Really antivirus software required for Linux desktops / Laptop.
0
votes
0answers
9 views

Greenbone/OpenVAS not starting tasks after reboot

I have Greenbone and OpenVAS installed on a Fedora machine. Configuration was OK and everything was working fine. After a reboot every attempt to start a task results in the browser waiting forever ...
2
votes
2answers
23 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
0
votes
1answer
31 views

Are NetBSD provide digital signatures for official ISO images and binary packages?

I just install NetBSD in from ISO image inside VirtualBox. Official source ISO media contains only MD5/SHA512 sums. Similarly pkg_add binary packag repository contains only SHA512 sums. Both FTP ...
3
votes
1answer
31 views

groupadd -p Not Recommended?

I have a question about groupadd, specifically with password (-p). It says it is not recommended, "This option is not recommended because the password (or encrypted password) will be visible by users ...
1
vote
2answers
44 views

Safe execution of cat command without executing arbitrary code

I do this little file based on a combination of hexadecimal, that can broke cat and the terminal showing the file with cat, reset does not worked anymore, it is maybe putting cat in a kind of loop? ...
0
votes
2answers
28 views

Solaris 11 trusted extensions, do I really need them? [closed]

In many Oracle's papers that discuss Solaris security, Solaris trusted extensions are recommended as an additional level of security that improves isolation of Solaris zones. Oracle advertises ...
1
vote
1answer
19 views

linux periodic system check script or utility [duplicate]

Is there any commonly used shell script or utility to periodically check Linux file systems for changes, such as permission or ownership changes of configuration files. I am thinking of something ...
1
vote
1answer
27 views

Is there an additional option to display hidden command on the terminal?

Copy and pasting from a website to the terminal is very harmful , there are an example here You past the following line :ls /some/thing/much/too/long/to/type/ , by pressing Enter the following ...
3
votes
1answer
28 views

How to limit connections to OpenSSH server to using private keys necessarily with passphrase?

Is there any way to configure OpenSSH (/etc/ssh/sshd_config) server to allow private keys necessarily with passphrase?
1
vote
1answer
12 views

Standard Package updates of selinux-policy-*

I am wondering if after installing an update of a selinux-policy-* package you are using, do you need to reset all the labels in the system (i.e. fixfiles onboot) in order to keep the policy ...
4
votes
1answer
72 views

Executing commands in an elevated bash process by writing to the standard input of its parent script process

I have a simple bash script bash.sh that starts another bash instance using pkexec. #!/bin/bash bash -c 'pkexec bash' When executed this shows a prompt for the user to enter their password. The ...
0
votes
2answers
28 views

Why should not I update to most recent kernel immediately after release [closed]

Question intended for system administrators. Consider system running a old but working kernel and all the required functionality is available. (Ubuntu 12.04 LTS specifically with kernel 3.2) Then a ...
2
votes
2answers
78 views

Malicious processes open connections to China

I recently started migrating some of my company's servers to Google's compute engine. Among other things I set up a 2-node elasticsearch cluster. Today I run top command on one of the nodes and I ...
1
vote
2answers
32 views

History -c, where all the erased histories have been saved and in which directories though?

Usually, when i used (root@example ~ # history )and it displayed a lot of commands which had been entered before. So, my question is : when i enter "history -c" is to delete all the history at the ...
1
vote
0answers
23 views

How to prevent the latest ImageMagick vulnerability? [migrated]

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
-1
votes
1answer
35 views

AIX : /etc/security/limits file Parameters [closed]

Can anybody please explain about following parameters found /etc/security/limits file default: fsize = 2097151 core = 2097151 cpu = -1 data = 262144 rss = 65536 stack = 65536 ...
0
votes
1answer
38 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
1
vote
1answer
41 views

How to install Software in redhat 7.2 using downloaded rpm?

Take MariaDB for an example. Package management tools like yum is good solution to install software and handle the dependencies issue for you. But in a primitive situation, without internet access, ...
3
votes
1answer
19 views

Where can users' personal data be?

I want to secure my data on a multi-user system, so ful-system encryption is not an option. I encrypted /home/me with ecryptfs, the swap with cryptsetup. But I read that the applications can ...
3
votes
1answer
19 views

White-list certain binaries and scripts inside a noexec/nosuid mount?

Just like the question. Is it possible to white-list certain executables from a noexec mounted FS? for instance, mine looks like this: /dev/vg/lv on /tmp type ext4 (rw,noexec,nosuid)
3
votes
1answer
28 views

How can I specify a system wide proxy without giving my password in plaintext?

I must use a proxy for all internet traffic, I currently have it specified like this in /etc/environment : http_proxy=http://jsj:plaintext_password_yikes@proxy.whereiwork.com:8080 ...
3
votes
3answers
57 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
2
votes
2answers
47 views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ...
67
votes
2answers
8k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
1
vote
1answer
26 views

dconf fails when running X application from alternate user

In an effort to protect my personal files in my home directory, I am trying to run certain applications as an alternate user, but under the same graphical environment. I have enabled X permissions by ...
3
votes
2answers
382 views

Does the stable version of Debian contain a vulnerable version of wpa_supplicant?

I'm on Debian jessie the stable release. I noticed that version of wpa_supplicant is vulnerable to DoS attacks according to CVE-2015-8041: Multiple integer overflows in the NDEF record parser in ...
2
votes
1answer
21 views

Can module loading be globally disabled on modern Linux kernels?

Once upon a time (before kernel 2.6.25), one could use /proc/sys/kernel/cap-bound to drop CAP_SYS_MODULE system-wide, and be assured that the set of code that was presently loaded into kernel space ...
1
vote
0answers
19 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
2answers
28 views

RAID1 vs rsync - security?

I'm setting up a NAS-Server using an Odroid XU4 and two 2TB HDDs. Which setup would be more secure (lower risk of losing data / easier recovery): setup a RAID1 with mdadm have two separate devices, ...
0
votes
0answers
44 views

Can we run apache on a non-root account?

Apache is started by the root user, then switches to the user defined by the User directive; is there any chance where we can change this default behavior? Apache should start using a non-root account ...
27
votes
3answers
2k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
5
votes
6answers
719 views

What is the threat of a user trying to sudo without permission?

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing ...
4
votes
1answer
49 views

Encrypt files (private key, etc.) in an embedded system

I am working on an embedded device running on Linux. This device communicates with a server and sends data to it using a certificate and a private key. When we distribute the device, I am afraid that ...
0
votes
2answers
40 views

Should I create should my own user with less privileges on a server (Digit. Ocean)?

I'm trying to deploy a website at Digital Ocean. I have the user root as the default. However, since it's root I believe I should create my own, normal user, shouldn't I? Nonetheless, in the ...
0
votes
0answers
46 views

How to add security (802-1x.eap) with nmcli

I've done nmcli con add type ethernet con-name SOMENAME ifname enp5 now how do I add security to it using nmcli(as if you had hit the on button in the gui.) so that I can than go and edit the ...
2
votes
1answer
35 views

Securing X window displays

I want to install X on a system I'm in charge of. I plan on running it with local connections only, e.g. with startx -- -nolisten tcp (which I understand is the default these days). Some relatively ...
-5
votes
2answers
54 views

How can I encrypt a file with dm-crypt? [closed]

I've never encrypted files in my Linux distribution. Now I need to do that. I'm on Arch. I went to the documentation, it says that support of TrueCrypt is discontinued and after examining other ...
0
votes
1answer
64 views

limit user to only a single command: “su -”

I have setup a web server that hosts a Play! Framework application, the server is an Amazon Linux EC2. If you are not familiar with Amazon Linux, by default there is a root user and an ec2-user with ...
1
vote
2answers
26 views

Is it bad practice to call scripts from a users home dir from root tasks (eg. dhcp hooks)? [closed]

I have some small script that run at startup and on other events (for example, one that updates a dynamic dns hostname based on the machines IP changing). I would like to keep everything in my home ...
0
votes
2answers
30 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
0
votes
0answers
32 views

Only allow port 80 access to VPN users

I have setup a OpenVPN server thanks to Docker (and this tuto: https://www.digitalocean.com/community/tutorials/how-to-run-openvpn-in-a-docker-container-on-ubuntu-14-04). What I want now is to allow ...
1
vote
2answers
47 views

Is it safe to set a cron job for apt-get upgrade? [closed]

Is it a good idea to create a cron job for apt-get update; apt-get upgrade for my webserver? So not apt-get dist-upgrade.
10
votes
2answers
271 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
-1
votes
1answer
25 views

Distribution request (!) - Linux Mint [closed]

I need a slim, fast and very secure distribution. I need security for my work (encryption, anonymity, secure internet connection etc.). I love the Linux Mint design (Cinnamon) with the very nice green ...
16
votes
2answers
2k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
-2
votes
5answers
120 views

Why does superuser exist in Unix/Linux?

I know that some system tasks are permitted only to privileged users/processes, but still a super user (usually the root in Unix/Linux) or administrator can present so much problems in regards to ...