Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
3 views

Is it safe to run GPG tools in x11?

Given the relative (anyone with my present user permissions can swipe scancodes) ease of keylogging in an x11 environment, should I run GPG tools only in the TTY?
2
votes
0answers
19 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
2answers
54 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
2
votes
0answers
28 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
1
vote
0answers
20 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
4
votes
1answer
53 views

Is it possible to add a password to moving or copying specific files on Linux?

I have a directory setup very nicely(i.e organized with READMEs and easy navigation etc.). I would like people to be able to access the files in this directory maybe even copy them to their own ...
2
votes
1answer
30 views

Wipe a Solaris Disk

Looking for something similar to Eraser for Solaris 9-10-11 Anything?
2
votes
1answer
35 views

How to use network interface as non-root user on Android? [closed]

I want to communicate between my Android device and my Linux box over IP through the USB network interface mode. I have connected my Android device to my Linux box with and put the Android device ...
0
votes
0answers
14 views

Error while building Libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] ...
1
vote
0answers
38 views

What are some basic indicators that your unit (Unix/Linux system) is hacked? What are specific, basic, preventive measures that need to be made? [closed]

This question is separated for three separate systems (Unix/Linux, Windows, Mac/Apple). A link will be posted to redirect here for other systems if this question/post is deemed valid or ...
1
vote
0answers
11 views

Libgcrypt warning: MD5 used - FIPS mode inactivated

Last week I enabled the openSSH FIPS 140-2 module on Server "A", and that system works flawlessly (including tsql queries to a SQL Server instance). I recently enabled the openSSH FIPS 140-2 module ...
2
votes
1answer
45 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
2
votes
0answers
19 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
2
votes
1answer
52 views

Restrict user script execution

I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players. A player write a bot in Python Upon validation, the code is sent to the server A ...
1
vote
1answer
42 views

How can I lock my screen automatically if internet connection is lost?

I will sometimes remote into my work computer from home using TeamViewer. Obviously I have to unlock the screensaver to use the GUI. When I'm done, I'll lock the screen either from the desktop or via ...
3
votes
1answer
35 views

Same salt/hash value in /etc/shadow

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password). How could the system end up like this? Does this mean the password was not ...
1
vote
2answers
29 views

User verification

Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that ...
-2
votes
1answer
58 views

Bash Code Injection Vulnerability On Linux

Found a new bug in Linux System, a bash code injection vulnerability. The solution to this is the update the bash package. yum update bash My Question is "do I need to reboot the system"? ...
2
votes
0answers
25 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
2
votes
2answers
34 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
2
votes
2answers
51 views

How to defend against a Live USB computer hack

A Linux installation can be simply hacked by using a live USB/CD, gaining root access on the live distro, chrooting to the target filesystem and running passwd root. One can use grub too. There may be ...
-1
votes
2answers
31 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
52 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...
2
votes
0answers
20 views

how to prevent procmail listening to the world [closed]

This is part of a larger effort to try and ensure my server is not infected and spamming the internet with spam emails I had a friend take a look at the server and he said "Your procmail is open to ...
8
votes
1answer
163 views

Blocking SSH Brute Force attacks on IPv6

I recently had to work with some servers that have an IPv6 connection and I was surprised to find out that fail2ban does not have IPv6 support, neither does denyhosts. Searching on google I found that ...
1
vote
0answers
26 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I have stucked up on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting ...
2
votes
1answer
55 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
5
votes
2answers
81 views

Why does password prompt lag slightly after typing the username in tty?

I have a this kind of behavior & I don't know how to fix it or even how to search a fix for it since I don't know how would I even call it. Here's what's happening: The first time I boot, when I ...
3
votes
1answer
39 views

security model of Linux password entry

Whenever a Windows application wants to do something requiring administrator privileges, my screen goes black and a prompt comes up, asking if I want to grant administrator privileges. I understand ...
2
votes
1answer
39 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...
-2
votes
2answers
55 views

How to prevent selected users from using “newgrp” with a password [closed]

I'd like to know how can I avoid add some users to a group? I need to avoid some users join to a group --I want to lock a group from some users, not all. Details lgroupmod -L dba ==> This ...
0
votes
1answer
232 views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
1
vote
2answers
41 views

eCryptFS and FIPS 140-2

I've searched high and low for information on whether eCryptFS encryption is FIPS 140-2 compliant. I've found information on other filesystem or block encryption and their FIPS compliance I presume ...
2
votes
1answer
52 views

Things to check after a untrusted USB device was mounted

Suppose you plugged an untrusted usb-stick into your linux machine (as user) and browsed and copied some files, perhaps using a graphical interface. After the usb-stick is removed (and not available ...
0
votes
1answer
50 views

How can I configure my server to avoid information leakage from the SERVER header of its HTTP response

I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out ...
1
vote
6answers
484 views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
0
votes
1answer
30 views

Strange commands on FTP logs

I'm battling with wordpress security problems and sometimes even I have tried everything my server sends spam by some hacker. I have checked my FTP log and I found this code ...
1
vote
1answer
42 views

How the kernel can prevent a malicious program to operate?

If I write an x86 assembly program that tries to fetch and analyse all the addressable memory space. How the kernel can prevent this operation to be done? I am more familiar with small CPU ...
0
votes
0answers
18 views

How to access boot: invite?

I'd like to simply try a root pawd reset, by entering linux single whan systems display boot: when booting. But my Mint system goes directly to user home prompt. Tks
1
vote
2answers
41 views

Prevent certain lines of a script to run as root

Suppose I am writing a shell script that requires root privileges to run, for example- #!/bin/sh ip -s -s neigh flush all ufw enable How can I prevent certain lines of code to be run as root, i.e. ...
1
vote
1answer
33 views

How to trap an event when a file with a specific content (given by e.g. checksum) was created on the local file system?

I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by ...
0
votes
0answers
27 views

Encrypt some folder and hide key in Linux

I work on a Debian system (Mint actually). I'd like to encrypt some folders and files, for instance: the one with OpenVPN configuration and keys, and be able to decrypt it on the fly. My problem: ...
3
votes
1answer
102 views

OS X FileVault 2 duress password

I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after ...
2
votes
2answers
37 views

How can I set up a secure LAMP stack on CentOS?

I have been using linux for years, but I need some clarification on what are probably pretty basic principles to how the OS works, but I definitely need clarification due to security concerns. I am ...
2
votes
1answer
117 views

How to Mark Traffic using IPtables?

I'm trying to mark traffic, How shall I write following code in terms of IPtables? /ip firewall mangle> add chain=prerouting src-address=10.1.1.1/32 action=mark-connection \ ...
5
votes
1answer
519 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
2
votes
1answer
42 views

What is the difference between the FreeBSD flags, immutable and unlink?

What are the differences or similarities among the FreeBSD flags, simmutable/uimmutable and sunlink/uunlink? Reading man chflags, I see these flags: schg, schange, simmutable set the system ...
1
vote
0answers
64 views

nmap doesn't detect opened port [closed]

I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and I can get connected as well with the telnet ...
2
votes
1answer
120 views

Using mailx without storing a password

I'm trying to setup mailx to use my Gmail account. I've found a configuration that can send mail successfully but it requires me to store my email password in a configuration file in my home ...
1
vote
2answers
89 views

iptables configuration - ssh connection only from a remote network

I'm trying to configure Iptables of a server in order to permit SSH incoming connections only from a certain network. by the way this is the rule chain : # Drop anything we aren't explicitly ...