Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
14 views

List all files with only arbitrary file path read, but no directory listing nor sudo

I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo. To fully exploit this, I would like to know which files exist in each directory ...
0
votes
0answers
2 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...
1
vote
1answer
21 views

Reason for security repositories in Debian?

In /etc/apt/sources.list(lists APT data sources) file there are two repositories listed for security updates: deb http://security.debian.org/ wheezy/updates main contrib non-free deb-src ...
1
vote
1answer
27 views

Will I receive critical security updates if I lock CentOS yum to a specific repo version?

We run Citrix XenServer as our virtualisation platform. Presently we're right up to date with our XenServer service packs and hotfixes i.e. we're running XenServer 6.2SP1 with the SP1015 update ...
0
votes
1answer
19 views

Custom Kernel to Disable SATA and USB Devices

I am setting up diskless clients that will run on an internal network. I have disabled SATA and USB ports using a BIOS locked with a password, but this is easy to get around by using the jumper to ...
2
votes
1answer
19 views

what does Xserver access control mean

What meaning does Xserver access control have, when the Xserver is started with tcp disabled: /usr/bin/X11/X -nolisten tcp AFAIU, Xserver can be used to allow remote network connection. But, if it ...
1
vote
1answer
37 views

Use sudo from another programm

I was wondering it is safe or an acceptable practice to use sudo to run an application from another one. For example, Let's say I have an application that uses a configuration file to do its work and, ...
1
vote
2answers
47 views

Is system call the only way that a user program can intentionally affect the state of a Linux kernel?

I think there are several ways that a user program can intentionally affect the state of a Linux kernel. By invoking a system call; By invoking mmap() and writing the memory that has been mapped to ...
1
vote
0answers
7 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
0
votes
2answers
26 views

How to instablock IP based on root SSH login

I have had this setup before by a friend of mine but it got lost in a reinstall. Basically what happened was, whenever someone would directly SSH to my server as root their IP would get blocked, you ...
6
votes
1answer
152 views

Some basic questions about Linux kernel's security [closed]

I don't know much about Linux kernel, and I have some questions. What is the main purpose of separating kernel memory from user-space memory? To make sure that a user application cannot do anything ...
1
vote
0answers
14 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
0
votes
1answer
25 views

Disallow change of init kernel parameter

is there any way to disallow changing init parameter on boot time? I want to prevent situation when someone reboot my server, edit grub entry and get access without password. Maybe some kernel ...
0
votes
0answers
22 views

Investigate compromise on Fedora 20

I am running Fedora 20, and I just discovered that a client's server was logged in to back on October 9th from my ip address, and an erroneous ftp account was created on each of his cpanel ...
9
votes
1answer
248 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
-1
votes
1answer
18 views

acedemic projects related to linux virtualization and security [closed]

I am B.tech student iam totally confused with the topic virtualization. but i selected linux virtualization security as a project in my college. please guide me. i tried in google but i found so many ...
1
vote
2answers
35 views

Lightweight SSH-only distro (< 128 MiB RAM) [closed]

I am looking to set up an SSH entry point into my network via a lightweight Linux or BSD setup. The purpose of the distro will be to allow SSH access into the rest of the internal network—that's it. ...
0
votes
1answer
132 views

OpenVAS 7 not working after apt-get update - Failed to receive data: A TLS packet with unexpected length was received

The problem started when my Kali installation updated OpenVAS to v7: My admin username for the web service stopped working so I could no longer log in. I have tried everything I can think of to fix ...
1
vote
1answer
34 views

Assp won't start

I tried to install ASSP (Anti-Spam SMTP Proxy Server),but when I try to start it I get the following: $ perl assp.pl Perl version 5.012003 (5.12.3) is at least recommended to run ASSP 2.4.3 (14313) ...
37
votes
1answer
799 views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
1
vote
0answers
22 views

How can I set a group policy to all access on all folders except one?

I am currently making a test environment where users will be going through a network administration course with different levels they must complete. Due to the nature of the course, we want to give ...
2
votes
2answers
28 views

Securely making an SSH connection from a public computer

Today, I had to remotely connect to my debian computer at home to fix an issue with a VPN server. I was using my iPhone with an SSH client to fix the issue, but I had a hard time due to the small ...
2
votes
1answer
47 views

enable echo service and linux security loophole issues

in order to enable the echo service we need to add the echo lines as the following example : more /etc/inetd.conf echo stream tcp nowait root internal echo dgram udp wait root ...
12
votes
2answers
202 views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...
0
votes
3answers
46 views

What does this host means ' ::1 '

To secure my mysql server, I checked the list of users : mysql> SELECT User,Host,Password FROM mysql.user; +------------------+-----------+-------------------------------------------+ | User ...
0
votes
0answers
35 views

Reading Suricata log files with Barnyard or Wireshark

I have Suricata 2.0.3 running on CentOS 6.5. It generates files that I cannot read. I have read that two options for reading the log files (in unified format) are barnyard and WireShark. I ...
1
vote
1answer
32 views

Cluster Lock Manager without TCP/IP

I have 2 linux sharing same SAN disk LUN. There are many cluster files systems to manage lock/unlock. But all of them are using a seperate TCP/IP comminication. But I need a cluster lock manager ...
1
vote
1answer
27 views

How can I go about tracking down DNS queries?

I was looking at the dnsmasq logs on a router I run and noticed that there are requests to a particular url on a regular basis. This was happening while the only client connected to the network was my ...
1
vote
1answer
29 views

user-level guide to maintaining Debian package update security? [closed]

Recently I listened to an interview with Kim Zetter (audio download here) on cybercrime/warfare, particularly Stuxnet and Flame. While listening to the discussion of how Flame exploited Windows ...
1
vote
1answer
28 views

rkhunter reports /sbin/ip has changed

I am using rkhunter 1.4.2 on CentOS 6.5. A message, in /var/log/rkhunter.log is Warning: The file properties have changed: [09:40:35] File: /sbin/ip [09:40:35] Current size: 247396 ...
1
vote
1answer
45 views

IP Camera with embedded Linux

I have purchased an IP Camera from Ebay (http://www.ebay.com/itm/151349669865). When I read the description of the camera, it said it has an embedded linux in it. I though that I will be able to ...
4
votes
2answers
193 views

Why rejection of password is much slower than acceptance of it? [duplicate]

In both my Linux and OSX machines when I type in the password to login, a correct password is accepted immediately. However, if I type a wrong password, checking process takes much longer. How is ...
5
votes
2answers
56 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
2
votes
1answer
21 views

Parentals Controls? [closed]

How do we implement parental controls? We have a customer with multiple retail locations and one computer at each. They switched to Ubuntu to lock down the computers, but many of the employees are ...
0
votes
0answers
27 views

How do I force a command to be run on local login?

I was wondering how do I force a command on login of a linux system? (debian 7). This is for a 2FA authentication command. I am asking for a local login.. not ssh.
2
votes
1answer
24 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
3
votes
1answer
58 views

Scan ~/Downloads on new file creation

I want all new files added to ~/Downloads (and sub-folders) to be scanned with clamscan. When using Firefox on other OSes/Machines I've noticed that downloaded files sometimes get automatically ...
5
votes
1answer
48 views

Sterilize PDF files

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious ...
1
vote
2answers
40 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
0
votes
1answer
178 views

Is my linux mint box vulnerable to Shell-Shock attacks? How might I remedy that? [closed]

Is it safe to use Linux Mint now, with ShellShock existing? If not, what can I do to use Mint safely?
-4
votes
1answer
33 views

Which Linux should I chose for penetration testing and networking [closed]

I am fairly new to networking and penetration testing, however, I'm really interested in the field and would like to know which distribution of Linux would be best to work with for security ...
4
votes
1answer
30 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
2
votes
1answer
40 views

Remove ex-admin user account and grant privileges / permissions / ownership to another

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a ...
2
votes
2answers
105 views

How to disallow file modification time change for non root users

I don't want anybody to create a file then change the creation date to backward date(For example using touch or system call). In my Ubuntu hosting account I'm getting many hacked php code getting ...
0
votes
0answers
21 views

Is there a solution for scanning webserver files for malicious code?

I have seen several times people move code into web servers now that had malicious code embedded into their HTML, php and other documents. These then get served up from the new server until they are ...
0
votes
2answers
36 views

If I install malicious software what may it do? [closed]

If I software in a deb file and I do sudo dpkg -i file.deb will it execute code from the package and possibly wreck my system? If I log in as testuser and execute the software (simply thebinary on ...
3
votes
2answers
47 views

Lock system after awake suspend (incl. forced-shutdowns system after countdown)?

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and ...
1
vote
0answers
48 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
2
votes
1answer
35 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability?

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
1
vote
1answer
41 views

Latest libxml2 port to RHEL4

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention ...