Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
8 views

Multiple iptables denied in report from hourly logcheck on Debian

I get thousands of lines of iptables denied every hour from logcheck, for a week now. What are the steps to troubleshoot this, what are the main causes of this? This is inside an LAN and the ...
0
votes
1answer
33 views

CRON session entries in logs

I'm having this in my RaspberryPi /var/log file Feb 26 21:17:01 raspberrypi CRON[15182]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 26 21:17:01 raspberrypi CRON[15182]: ...
0
votes
1answer
14 views
+150

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
1
vote
1answer
23 views

Different password for login and sudo - security concerns

I'm planning to follow the steps described in this answer to have a different password to log in and sudo. The reason is that I want a high security password to access my account or unblock the ...
1
vote
1answer
41 views

Throttle accounts after failed SSH login attempts

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
0
votes
0answers
11 views

security when partitioning disks? Also, questions about keys [closed]

I'm curious what the tradeoff between disk security to potential attackers is and partitioning schemes. Is there a specific way that is more secure to partition your disk than another. I imagine ...
2
votes
1answer
26 views

How to set up users, ownership and permissions across local and remote servers?

I've been learning the Linux OS over the last year or so and I am still very confused on how permissions vary from different configurations. I am trying to set up my local development environment and ...
0
votes
2answers
18 views

Protected archive (7z, RAR, Zip) open at a specific time

Are there any compression tools that are unopenable or password-protected until a specific time, at when the security is then lifted? Literally an enforced: "Do not open until --/--/----"
1
vote
3answers
105 views

how to set up permissions of “download” dir to prevent execution of exploit program

There is a host with a local service that receives data from a remote location (via e.g. http) and saves it locally under /var/log/data/ in some mydir. $ ls -al /var/log/data drwxr-sr-x+ 4 root ...
2
votes
1answer
63 views

Is it possible to access any file or dir within a non-accessible directory? [duplicate]

Say I set my home /home/john directory as not readable for any other user. But I've forgotten to do so with some files within that directory, say ./.bashrc or ./Downloads/Presentation.ppt. Now, if ...
27
votes
7answers
5k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
0
votes
1answer
25 views

How to update all Debian packages from source code?

For building packages from source code, there is apt-get source --compile pkg-name. But for it to work, one has to run apt-get build-dep pkg-name beforehand, which downloads binary packages. Is it ...
4
votes
1answer
32 views

How can I test whether Chromium is running inside sandbox

I am using Chromium browser on Debian Wheezy. I read that Chromium is using sandbox to isolate its processes from the rest of the system and thus to increase security. How can I verify that Chromium ...
3
votes
1answer
47 views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
0
votes
0answers
12 views

Returning from a sleep the desktop displays shortly (before entering password), privacy issue

OS: Linux mint 17.1 Cinnamon 64-bit Cinnamon version 2.4.6 Intel Celeron: 900 @ 2.20Ghzx1 Memory 2 Gb Graphics Card: Intel Mobile 4 series integrated When I return to my computer after it has been ...
-1
votes
2answers
58 views

How to prevent the messages about REMOTE HOST IDENTIFICATION HAS CHANGED

Is it possible to prevent the following message about: ( REMOTE HOST IDENTIFICATION HAS CHANGED ) When using only this connection syntax ssh xxx.xxx.xxx.xxx example of warning message: ssh ...
1
vote
1answer
33 views

How to force rpm and yum to fail if a GPG signature is missing or cannot otherwise be verified?

How can I force rpm and yum to fail if a GPG signature is missing from a package or otherwise cannot be verified due to a missing key? For the example below, assume the RPM has been signed but the key ...
1
vote
1answer
68 views

Reason why ssh RSA key would change?

Today I went to connect t my Centos 7 box via ssh and my sftp client and both indicated that the server RSA key finger print had changed. I've checked all my logs for suspicious activity but don't ...
-3
votes
0answers
57 views

SSH Rootkit (EBURY) affected Server, What is the solution?

{i am a active member of many sites of stackexchange, Please do not mark this as a duplicate, i have verified & also this is very specific problem. I am posting it here, Bcoz this is only website, ...
2
votes
2answers
853 views

Ghost Vulnerability On Linux

It came to our notice that glibc needs to be upgraded from 2.2 to the latest version as per the release 5/6/7. My Question is that do I need to reboot the system, because we are having more then ...
1
vote
2answers
68 views

how to record all who that login to my linux machines and records them

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine yum install audit kit installation from: ...
1
vote
1answer
52 views

GUFW or Firestarter in Fedora

Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
1
vote
1answer
91 views

Can I update eglibc to a non-vulnerable version using Debian Squeeze 6 on x86_64 architecture?

I'm currently attempting to update eglibc on Debian Squeeze 6 on x86_64 architecture from version 2.11.3-4, which is vulnerable to the GHOST exploit, to version 2.11.3-4+deb6u4, which isn't vulnerable ...
1
vote
0answers
13 views

Finding out the script causing MySQL failed connections

I see lot of lines in mysql.log Connect Access denied for user 'M'@'localhost' (using password: NO) I am sure I don't have such a user on my system. I need to figure out what script is ...
4
votes
3answers
725 views

Any disk encryption that locks itself for some time after a number of failed attempts?

Is there any way to have your disk/partition/file encrypted (in Linux or as a hardware encryption; no Windows here) in such way that it locks itself for say 10 minutes after say 3 failed unlock ...
12
votes
1answer
5k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
0
votes
1answer
424 views

GHOST: glibc gethostbyname buffer overflow

https://rhn.redhat.com/errata/RHSA-2015-0092.html I can see md5sums of the packages, but cannot download them and my package manager says I'm up-to-date. [root@notebook log]# grep glibc-2 yum.log | ...
10
votes
3answers
330 views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
3
votes
2answers
34 views

How is the visibility of a file-system mount limited?

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
1
vote
1answer
54 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
0
votes
0answers
9 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
3
votes
0answers
42 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
6
votes
2answers
109 views

Run Ubuntu Security Updates every Saturday only

A clients wants to enable automatic security updates on their 12.04 box, but it has to be once per week, on saturday only. (Why I don't know) When I do dpkg-reconfigure -plow unattended-upgrades it's ...
2
votes
1answer
36 views

NIS and /etc/passwd

Shadow passwords are to be avoided in a NIS server, as suggested in this guide at paragraph 7.6. So: in a NIS server (a Unix or Unix-like system), should all the users be migrated to /etc/passwd from ...
22
votes
1answer
1k views

Can another program on X capture my root password while I type it in a virtual terminal?

Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account ...
0
votes
1answer
13 views

How to restrict restrict remopte administration software to one domain name?

I currently have a server hosting a number of website on a debian server. I understand that all my domain names share the same IP so any of them will grant me access through SSH, but i was wondering ...
0
votes
1answer
43 views

How to run unattended-upgrades not daily but every few hours

By default unattended-upgrades runs with cron.daily, that is at most on a daily basis. This can be a lot of time for attackers. I'd like to run it every 4 hours, how can I do this?
1
vote
1answer
34 views

Finding out if my system is being used as a bot by looking at ifconfig?

Recently, I have often been suspicious that my router (a linux box) might have been used as a bot for spam blowout or something of that quality because I may have misconfigured my iptables rules by ...
2
votes
1answer
220 views

RHEL 7 (CentOS 7) security / ssh / sshd_config advise requested

I am not a sysadmin and try to create a more or less secure web server (LAMP based CentOS 7). I read several tutorials about setup an initial CentOS 7 droplet and got everything running fine. ...
1
vote
1answer
51 views

What considerations would I need when configuring iptables?

Synopsis I am looking at learning more about Server Administration. I have been running my own web server for a few years although many things were set-up by my friend and now I wish to learn more ...
0
votes
1answer
50 views

Sudo User: Not able to see the home directory of other users

I created sudo user hrsupport with following commands: hrsupport ALL=ALL, NOPASSWD: /bin/chown, /bin/chmod, /bin/chgrp, /scripts/pkgacct, /scripts/restorepkg How can I achieve this The hrsupport ...
0
votes
3answers
48 views

/etc/passwd permissions and GECOS field

The default permissions on Ubuntu (or even some BSD) distributions for the /etc/passwd file are 644. It is pointed out in questions like this that /etc/passwd is a sort of user database and it is ...
6
votes
2answers
69 views

Linux graphical password dialog trick security

When we run a command by sudo, the password is asked [sudo] password for user If the sudo is not typed the password should not be asked. If asked, I would assume it as a fraud by the application. ...
1
vote
0answers
22 views

How do I securely automate inputting passwords?

I would like to automate an SSH connection so that I wouldn't have to enter password and I am not allowed to use authorized_keys. I was thinking about making an expect script but I don't know where I ...
0
votes
0answers
38 views

Network Manager losing saved vpn passwords in Mint 17

my vpn is setup in the network manager, and the passwords are saved in there. however, those passwords are disappearing, they will be there for several days, and then be gone. what could be causing ...
3
votes
1answer
30 views

Protecting process's envvars from exposure

From I've read about current best practices for developing web applications (such as the Twelve Factor guide), the recommended approach for storing configuration data is within environment variables. ...
2
votes
4answers
70 views

How can I lock myself out of a linux box with iptables?

In the Securing Debian Howto I read (about iptables): The tools can easily be misused, causing enormous amounts of grief by completely crippling network access to a system. It is not terribly ...
1
vote
1answer
29 views

What if I add a user to a supplementary group?

I am using debian 7.0 and I added "debian-transmission" to the group "pi" with: usermod -a -G pi debian-transmission I made this change because transmission was not able to write the pi mounted ...
2
votes
1answer
108 views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
0
votes
1answer
40 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...