Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
16 views

What bad things could happen if we use sudoedit?

I came across the question What bad things could happen if we don't use sudoedit?. But very often, allowing someone to edit a file owned by someone else (root!) can lead to privilege escalation ...
0
votes
1answer
27 views

What are the differences between sudo and the use of groups? [on hold]

I know these are tools used for improving security. But what I would like to know is what they are and how they work?
1
vote
0answers
13 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
0
votes
0answers
32 views

logging wrong passwords in /var/log/auth.log

/var/log/auth.log logs (among other things) failed login attempts to my debian linux. I was wandering if it is possible to ask it to log the password that was used in the failed attempt. This is ...
6
votes
3answers
86 views
+50

What bad things could happen if we don't use sudoedit?

We know it's safer* to use sudoedit, but what bad things can happen if we have the following in sudoers? Cmnd_Alias FOO = /bin/ed, /usr/bin/ed, /usr/bin/vi foouser LOCALHOST = NOPASSWD: NOEXEC: FOO ...
-2
votes
2answers
39 views

Can I restrict the root to a single browser?

I want to be able restrict myself to firefox. I do not want to be able to use any other browser. So if I install chrome or any other browser, I don't want them to work on my Linux machine. Here is ...
0
votes
1answer
29 views

What changes my boot partition and how to prevent it?

As an another countermeasure against security threats I wrote a little script that computes MBR and boot checksum and then compare it to the old one. As long as the computer is running this is OK, but ...
2
votes
1answer
23 views

Understand HMAC authentication in case of site-to-site OpenVPN tunnel

I have a very simple OpenVPN setup where OpenVPN server is started with openvpn --ifconfig 10.10.10.1 10.10.10.2 --dev tun and client is started with openvpn --ifconfig 10.10.10.2 10.10.10.1 --dev tun ...
2
votes
0answers
69 views

Security of sudo not asking for a password after the first time

After using sudo and entering a password to do so, sudo remembers that we have entered a password and we do not have to enter a password the next time we use it. I am concerned about the possibility ...
0
votes
1answer
65 views

How can I study Linux, in and out? [closed]

My team and I will soon begin studying and practicing for the nation-wide Cyber Patriot program. As I'm famed for being our "Linux guy", I would really like to improve my knowledge on the subject. ...
0
votes
1answer
44 views

UNIX Account management

Would like to know if there's some opensource solution aimed to manage and administer system authentication and RSA keys for staff, contractors and clients across the organization. My systems to ...
1
vote
1answer
30 views

Where to verify and review various packages before installing them

I am new to Unix/Linux and corrently setting up a Debian Wheezy server for my domain name. Here and there I find useful tutorial on how to do this-and-that, but I am not sure where I can find a ...
2
votes
1answer
48 views

How to scan a directory with a space in its name with maldet

I'm trying to scan some directories with Linux Malware Detect (command-line command maldet): maldet -a /SOMETHING\ 1/ But I get: maldet(13857): {scan} invalid path /SOMETHING 1/ I've tried ...
2
votes
1answer
105 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev ...
3
votes
3answers
103 views

Remove passphrase from private key and set specific file mode

If I set a passphrase on my private key like so: openssl rsa -des -in insecure.key -out secure.key and I remove the passphrase like so: openssl rsa -in secure.key -out insecure.key then my ...
0
votes
1answer
26 views

Sanitise bash arguments

I have a script which takes user input and does a lot of things. One thing which I am worried about is it takes a file name and removes that file. e.g. rm -rf $arg1. A user could technically input / ...
1
vote
1answer
54 views

wheel groups and permissions

I'm new to a lot of things Linux, so this might be basic stuff. We're thinking about setting up a wheel group and removing permissions from root. Not even sure that's possible. We are having a ...
0
votes
1answer
116 views

How to import the official Tor GPG keys?

I am trying to install the latest Tor Browser Bundle on Arch Linux: $ makepkg --syncdeps --install [...] ==> Verifying source file signatures with gpg... tor-browser-linux64-4.0.8_en-US.tar.xz ...
1
vote
1answer
24 views

LDAP Force Password Change Through HTTPS

We have a "master" server running Suse Enterprise with LDAP that controls user's access to our systems. We want to implement a 90 day expiration policy, but the issue is that most of our servers are ...
1
vote
2answers
27 views

How do I install programs in /usr/local if they shouldn't be compiled by root?

Somewhere in the back of my brain is the memory of reading a cautionary internet voice warning against compiling (i.e. running make) as the root user. Perhaps it's something like this story ...
0
votes
0answers
23 views

Bro-IDS CSV conversion

I have Bro-IDS currently operating under Centos 7. I need to convert the output to CSV format. The documentation that I have seen on this is not clear to me. Has anyone done this successfully? I have ...
0
votes
0answers
18 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
0answers
8 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...
1
vote
1answer
70 views

Dubious entry in logwatch

Today I found the following in the daily logwatch of my debian server: --------------------- Connections (secure-log) Begin ------------------------ **Unmatched Entries** sg: user 'root' (login ...
2
votes
0answers
8 views

Tails OS:Network Filtering Syntax to Allow I2PBrowser to listen at localhost:6666, Then Allow TorBrowser User to Connect to it

I've had a bit of experience in Linux, but I'm still learning and brand new. I've been able to proxy Tor right into I2P on a normal Debian Wheezy installation successfully. My process involves ...
0
votes
2answers
63 views

SSH authenticity couldn't be established

Last night I SSH'ed to different systems.... one system/SSH reported that the "authenticity of HOSTNAME couldn't be established......." and it asks if I want to continue or something, I didn't and ...
10
votes
1answer
87 views

D-Bus authentication and authorization

I'm trying to set up remote access to D-Bus, and I don't understand how authentication and authorization are (not) working. I have a D-Bus server listening on an abstract socket. $ echo ...
0
votes
1answer
34 views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
0
votes
1answer
79 views

Is my server being used as a proxy or malicious requests?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and am unfamiliar with the security and server side of my project. This is my first time ...
2
votes
1answer
24 views

NOEXEC and RESTRICT in sudoers

I understand the script below has a serious problem, and NOEXEC and RESTRICT are not enough as a solution to this. user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf However, I still have some ...
0
votes
0answers
57 views

Is my webcam driver being used to hack my computer?

I'm seeing this in the journal: Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (II) Using input driver 'evdev' for 'TOSHIBA Web Camera' Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (**) TOSHIBA Web Camera: ...
5
votes
2answers
420 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
2
votes
2answers
48 views

Encrypted FileSystem in VirtualBox

I'm looking for any information regarding how secure an encrypted Linux file system is when contained in a VirtualBox virtual drive on a Windows host? Specifically I'm looking for answers to the ...
1
vote
1answer
40 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...
2
votes
2answers
67 views

Per user tmpfs directories

Using the shared /tmp directory is known to have lead to many security vulnerabilities when predictable filenames have been used. And randomly generated names aren't really nice looking. I am ...
0
votes
0answers
13 views

Is user/filesystem access separation of services enough to have well secured data of services?

I'm about to publish some of my projects. So, I'm gonna to re-install my VPS and do it properly. I'll have running on it Apache server(websites are made using Ruby and Python), databases. I'll also ...
1
vote
1answer
39 views

How do I run a program without network access? [duplicate]

I am making a program that scrapes information from some web services. I want to test how my program reacts when it can't reach the web service, like if the web service is down or if the local ...
0
votes
1answer
39 views

unknown command “vftovp” in linux command history [ Is my linux box compromised? ]

I have Slackware linux system configured with ssh remote access. While observing the command history, I discovered that there is one unknown command executed from my linux box "vftovp". I certainly ...
0
votes
0answers
22 views

why do we have same chains in different tables of “iptables firewall” in linux?

why do we have same chains in different tables of "iptables firewall"? Like for example: we have "output" chain in filter table, nat table & mangle table.
3
votes
0answers
61 views

Is there a technical reason why ssh-agent lacks a sudo-like inactivity/idle timeout feature?

There are some brief discussions about the existing ssh-agent -t feature at [1], and there was a post as far back as 2001 on debian-devel [2] wishing for an inactivity timeout feature. There's a ...
1
vote
0answers
22 views

Are External API's secure? [closed]

I'm new to java. So please someone explain me if we can use external API's in my work? Are they secure to use?
1
vote
4answers
48 views

Can administrating task of 'root' be divided to the several of “more powerful” users?

Unlike root (which is able to do everything) is it possible to have multiple administrators assigned to manage only part of a system? For example, one system could have 3 administrators: ...
0
votes
1answer
26 views

Compare Linux configuration with default

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version? My current system is Debian, ...
5
votes
1answer
37 views

Find out which kernel source files were used when kernel was compiled

I am compiling the Linux kernel for my specific hardware and I only select the drivers/options which I really need. This is in contrast to a typical distribution kernel, where they compile almost ...
-4
votes
1answer
45 views

How to know su password

You already know my question. I don't have su authority. So I want to know su password. I really(x100) don't know how to find it. I tried change direction(/etc/pam.d/su) and tried to delete auth ...
0
votes
2answers
67 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
13
votes
4answers
1k views

How to retrieve IP addresses of possible ssh attackers?

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records. However, there are two possible record types - for valid / invalid user. It complicates my ...
1
vote
1answer
26 views

Is it possible to scan a website for repeated images?

Is it possible to determine how many times a website is using an image (specifically one that is hosted on the domain), and on what pages? Is there a command line tool, for example, that scans every ...
2
votes
1answer
36 views

Where do my keypresses go ?

Scenario (Ubuntu 14.04.2) : I wake Ubuntu from suspend. I know (from past experience) that it only takes 2 or 3 seconds for the lock screen to become available. My monitor, however, takes longer - ...
1
vote
1answer
57 views

Firefox in Docker, failed in isolation

While experimenting with docker, I realized I can run a browser in a container for improved security. I managed to start with a clean Docker Fedora, in which I installed the openssh-daemon package. ...