Content related to computer security.

learn more… | top users | synonyms

2
votes
1answer
13 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
5
votes
0answers
10 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
3
votes
1answer
16 views

How to securely manage etckeeper from gitolite?

I want to maintain my debian servers by pushing etc into gitolite. The problem is that gitolite shouldn't be run as root and neither as a user that can get shell access into the system from the ...
6
votes
3answers
357 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
3
votes
1answer
23 views

unnecessary accounts in linux

It is recommended in hardening that unnecessary accounts be removed. Do these accounts include process and daemon accounts? What security problems exist with unnecessary user accounts? Can attackers ...
0
votes
1answer
19 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
1
vote
1answer
29 views

Cryptsetup: pre-fill the partition with random data

It says it is an optional step, but it is recommended to do this, it improves encryption to pre-fill the partition with random data. What brings security filled with random data? Is it more difficult ...
3
votes
1answer
23 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
68
votes
3answers
14k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
0
votes
0answers
10 views

runuser best practice? [closed]

I'm using SELinux on RedHat. This environment uses "runuser" instead of "su". I know that I can limit “su” access by using specific PAM configuration. However, since "runuser" does exactly the same ...
6
votes
1answer
511 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
0
votes
0answers
32 views

Some files under `/` are owned by UID `501`, is this dangerous?

I just noticed that that the directory /usr was owned by UID 501 on my system. Such a user does not exist on my system, as verified by looking at /etc/passwd. Have I suffered a security breach, or is ...
0
votes
0answers
15 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
0
votes
1answer
28 views

How kernel allows a process to receive network data that do not belong to it? [closed]

Each process is assigned with port number when using network resource. A process can only send and receive network data from its assigned port number. How kernel allows security programs like IDS, ...
0
votes
1answer
63 views

Does an in-kernel firewall sit between the network access layer and Internet layer?

This question is a follow-up to my previous question. Logic for me to says that an in-kernel firewall sits between the network access layer and the Internet layer, because it needs to have access to ...
0
votes
2answers
52 views

What are ways to encrypt a password inside an environment variable

I have this file I use to set my username and password before exporting the value. #!/bin/bash echo -n "User:"; read user echo -n "Password:"; read -s password export ...
3
votes
1answer
68 views

How security programs like firewall, IPS and IDS have access to network data?

It is said that kernel responsible for the transport, internet and network access layers for a network data. Then, the network data is passed on the appropriate process based on port number. How ...
1
vote
1answer
35 views

Is it possible to remove the delay on wrong password? [duplicate]

So I type my password incorrectly from time to time. Sometimes for sudo sometimes for logging in to my (Ubuntu) machine. In either case, there is a two or three second delay before it gives me a ...
0
votes
1answer
16 views

gvfs-mount auto password

I would like to make shortcuts for gvfs mounts (I prefer to mount from the shell). For this, it is quite necessary/convenient not to have to enter the password for the ftp:// and sftp:// connections . ...
0
votes
2answers
35 views

which unix or linux command is used to change root password of remote machine(Just an IP address) without using SSH Login [closed]

which unix or linux command is used to change root password of remote machine(Just an IP address)? Suppose I just have an IP address of the target machine which is on my network, But I do not know ...
9
votes
4answers
1k views

Sudoers for one day per week?

I have been volunteered by my boss to be the sysadmin for our production redhat server. He asked me to tighten the security to avoid mishaps like rm -f * that occured not long ago. Right now, we ...
3
votes
2answers
48 views

Process in user mode switch to kernel mode. Then the process will have root privileges?

According to http://www.linfo.org/kernel_mode.html in paragraph 7: When a user process runs a portion of the kernel code via a system call, the process temporarily becomes a kernel process and is ...
1
vote
2answers
36 views

if an exploit is affecting MS office does it affect also LibreOffice? [closed]

This question is really annoying me a lot and I want a reasonable, certain, logical... response for it
0
votes
2answers
55 views

Game server hosting and security

I'm working on a small controlpanel for a hobby project of mine, which is supposed to set up game servers. But I have some concerns regarding security that I would like some input on. My first idea ...
1
vote
1answer
71 views

Is this what it looks like in the terminal on the client side when you are blocked out via fail2ban?

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." ...
1
vote
0answers
35 views

How can I hide a command line from (e.g.) top & htop? [duplicate]

I know that both support specifying the username, which can be forced using an alias in root-owned ~/.bashrc, but one can temporarily disable the alias by prepending the command with \, so what are ...
1
vote
1answer
44 views

Security for a web server for multiple people?

I have an apache web server set up where multiple people have their websites hosted, mostly php based websites. The problem is, when these people upload their website files, it has read permissions ...
1
vote
1answer
18 views

Are there GPG-signed OpenBSD ISOs with which I can verify an installation disc?

Are there GPG-signed OpenBSD ISOs that I can download and later verify the downloaded file? Or at least a GPG-signed shasum?
4
votes
3answers
114 views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
3
votes
1answer
41 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
0
votes
2answers
27 views

Check that fail2ban is running?

I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is ...
0
votes
2answers
31 views

What is the default action for incoming packets that don't match explicit iptables rules?

CentOS 5.x I'd like to understand what is specifically happening to incoming packets that don't explicitly match rules in my iptables chains. Is the default action to reject them? Or drop them? ...
0
votes
2answers
38 views

Trying to use TLS SMTP against Exim, getting Security Error back; what's wrong?

OS: FreeBSD9 64 Bit MTA: EXIM4 with TLS with Self Signed Certificate. I am using telnet myserver.com 25 EHLO dummy@dummy.com STARTTLS It says TLS go ahead And then I issue MSG FROM: ...
2
votes
0answers
68 views

How can I install linux on a system with UEFI and Security boot system?

My motherboard is a Gigabyte 990XA-UD3 (CPU 1), it's a UEFI -Dual boot, and when I try installing Linux Mint 16 Cinnamon or Ubuntu 13.10 it always bring this error (initramfs) Unable to find a medium ...
1
vote
0answers
45 views

What keys are generated during Debian 7.4 (Wheezy) installation?

We are concerned lest /dev/random (or /dev/urandom) be hit too early in the installation process for adequate entropy to be developed. In a basic Debian 7.4 installation (SSH Server and basic ...
2
votes
2answers
41 views

In OS X Darwin, why can I interfere with text input across user sessions using cat?

OS X Darwin: Disrupting Terminal Sessions Across User Identities How, in Brief: with cat < /dev/ttys_, in Terminal. My Question This OS X 10.9.2 Darwin behaviour seems odd to me, and I would ...
1
vote
1answer
31 views

Is there a selinux, httpd, or PHP configuration that prevents reading mounted drives?

I'm moving a virtualized centos web server over that has an all-to-small hard drive to a new machine and I hooked up a bigger drive for hosting videos and downloads and stuff. W When I try to run a ...
8
votes
3answers
99 views

Trap: can't su as root, can't change group to wheel, ssh as root prohibited

Is this a trap? I made these steps in FreeBSD 10: 1) ssh as root prohibited 2) logged as user 3) su as root 4) as root chsh changed name of user "user" to "luser" 5) exit from ...
1
vote
0answers
31 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
1
vote
1answer
85 views

File monitoring to pre-empt hacker

We have a hacker occasionally attempting to hack a site, and so far unsuccessful, but I would like a way to determine if the site has been compromised (i.e., files edited). The type of attacks are LFI ...
13
votes
6answers
2k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
-2
votes
1answer
51 views

How to compile c, c++ and python code as “Released/Final” version? [closed]

I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not? I have heard there are some ways over Windows to do it, but I ...
5
votes
2answers
168 views

Writing a “telnet server” type program that uses SSH instead of telnet

So people have written server programs using telnet in which the user simply does telnet server.com and this connects them to the server program, which then provides them with a textual program they ...
3
votes
1answer
44 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
3
votes
2answers
43 views

using SUID bit to drop privileges

So this is a description of the system I'm working on : a "manager" process spawns all the other applications. The manager application runs as root user. so now, any process that it spawns also ...
0
votes
1answer
80 views

Is it possible to make a standard user that can gain NO access to root?

I'm a very new beginner learning how to use Linux. I have very little experience so far in different distros. I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I ...
2
votes
2answers
172 views

Do I need to encapsulate awk variables in quotes in order to sanitize them?

As per an answer on stackoverflow, it's my understanding that encapsulating bash variables in double-quotes is a fairly safe way of sanitizing user input. What about awk variables? For example, if ...
2
votes
1answer
53 views

How it is decided which certificate of a Certificate Authority will be used in a system certificate chain [closed]

I am looking for PKI (Public Key Infrastructure) knowledge and particularly at OS's built-in certificate chain list. Of course on Windows the company decides which certificate will be built-in, but ...
0
votes
1answer
34 views

Maximum password length

Is there a maximum password length on unix systems? If so, what is that limit and is it distribution dependent?
2
votes
1answer
50 views

Using LDAP for authentication, how can I safely disable/deactivate an account without deleting it?

We use LDAP for authentication for thousands of users. The primary tactic we have been employing to make a user unable to login, without removing their account, is to change the LDAP attribute ...