Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
2answers
19 views

What does this host means ' ::1 '

To secure my mysql server, I checked the list of users : mysql> SELECT User,Host,Password FROM mysql.user; +------------------+-----------+-------------------------------------------+ | User ...
0
votes
0answers
18 views

Reading Suricata log files with Barnyard or Wireshark

I have Suricata 2.0.3 running on CentOS 6.5. It generates files that I cannot read. I have read that two options for reading the log files (in unified format) are barnyard and WireShark. I ...
1
vote
1answer
22 views

Cluster Lock Manager without TCP/IP

I have 2 linux sharing same SAN disk LUN. There are many cluster files systems to manage lock/unlock. But all of them are using a seperate TCP/IP comminication. But I need a cluster lock manager ...
1
vote
1answer
21 views

How can I go about tracking down DNS queries?

I was looking at the dnsmasq logs on a router I run and noticed that there are requests to a particular url on a regular basis. This was happening while the only client connected to the network was my ...
1
vote
1answer
24 views

user-level guide to maintaining Debian package update security? [closed]

Recently I listened to an interview with Kim Zetter (audio download here) on cybercrime/warfare, particularly Stuxnet and Flame. While listening to the discussion of how Flame exploited Windows ...
1
vote
1answer
22 views

rkhunter reports /sbin/ip has changed

I am using rkhunter 1.4.2 on CentOS 6.5. A message, in /var/log/rkhunter.log is Warning: The file properties have changed: [09:40:35] File: /sbin/ip [09:40:35] Current size: 247396 ...
1
vote
1answer
25 views

IP Camera with embedded Linux

I have purchased an IP Camera from Ebay (http://www.ebay.com/itm/151349669865). When I read the description of the camera, it said it has an embedded linux in it. I though that I will be able to ...
4
votes
2answers
185 views

Why rejection of password is much slower than acceptance of it? [duplicate]

In both my Linux and OSX machines when I type in the password to login, a correct password is accepted immediately. However, if I type a wrong password, checking process takes much longer. How is ...
5
votes
2answers
47 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
2
votes
1answer
21 views

Parentals Controls? [closed]

How do we implement parental controls? We have a customer with multiple retail locations and one computer at each. They switched to Ubuntu to lock down the computers, but many of the employees are ...
0
votes
0answers
23 views

How do I force a command to be run on local login?

I was wondering how do I force a command on login of a linux system? (debian 7). This is for a 2FA authentication command. I am asking for a local login.. not ssh.
2
votes
1answer
20 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
3
votes
1answer
45 views

Scan ~/Downloads on new file creation

I want all new files added to ~/Downloads (and sub-folders) to be scanned with clamscan. When using Firefox on other OSes/Machines I've noticed that downloaded files sometimes get automatically ...
5
votes
1answer
42 views

Sterilize PDF files

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious ...
1
vote
2answers
33 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
0
votes
1answer
120 views

Is my linux mint box vulnerable to Shell-Shock attacks? How might I remedy that? [closed]

Is it safe to use Linux Mint now, with ShellShock existing? If not, what can I do to use Mint safely?
-4
votes
1answer
31 views

Which Linux should I chose for penetration testing and networking [closed]

I am fairly new to networking and penetration testing, however, I'm really interested in the field and would like to know which distribution of Linux would be best to work with for security ...
4
votes
1answer
28 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
2
votes
1answer
37 views

Remove ex-admin user account and grant privileges / permissions / ownership to another

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a ...
2
votes
2answers
90 views

How to disallow file modification time change for non root users

I don't want anybody to create a file then change the creation date to backward date(For example using touch or system call). In my Ubuntu hosting account I'm getting many hacked php code getting ...
0
votes
0answers
18 views

Is there a solution for scanning webserver files for malicious code?

I have seen several times people move code into web servers now that had malicious code embedded into their HTML, php and other documents. These then get served up from the new server until they are ...
0
votes
2answers
35 views

If I install malicious software what may it do? [closed]

If I software in a deb file and I do sudo dpkg -i file.deb will it execute code from the package and possibly wreck my system? If I log in as testuser and execute the software (simply thebinary on ...
3
votes
2answers
38 views

Lock system after awake suspend (incl. forced-shutdowns system after countdown)?

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and ...
1
vote
0answers
32 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
2
votes
1answer
25 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability?

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
1
vote
1answer
38 views

Latest libxml2 port to RHEL4

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention ...
-1
votes
1answer
114 views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
132 views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
0
votes
2answers
54 views

ClamAV found virus, if I should delete this virus? [closed]

ClamAV has found two viruses on my server. Is this a virus? Should I delete it? /tmp/back: Perl.Shellbot-8 FOUND /var/tmp/back: Perl.Shellbot-8 FOUND
0
votes
3answers
50 views

last command only shows few days worth of logins

I often use thelast command to check my systems for unauthorized logins, this command: last -Fd gives me the logins where I have remote logins showing with ip. From man last: -F Print full ...
1
vote
3answers
90 views

Securely passing user input to command

I have a daemon daemon running in Server A. There, there's an argument based script to control the daemon daemon_adm.py (Server A). Through this script I can insert "messages" to daemon coming from ...
2
votes
2answers
42 views

What is best and secure way to save application settings?

Let's say I have an application which has plugins, daemons, etc. Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is ...
1
vote
0answers
43 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
6
votes
3answers
633 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
0
votes
0answers
44 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
0
votes
0answers
68 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
0
votes
0answers
18 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
3
votes
1answer
28 views

How can I lock down a user account to the point that it can read/write/execute as little as possible?

I would like to lock down an Arch Linux user account to the maximum extent possible. The only functionality required for the account is to accept a non-terminal SSH session which allows the client to ...
8
votes
2answers
159 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
4
votes
1answer
24 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
1
vote
2answers
194 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
8
votes
2answers
7k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
2
votes
0answers
29 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
0
votes
0answers
48 views

Permission denied tmp dir on STIG RHEL

I am writing a program for a DISA STIG version of Red Hat Linux 6.5. I wrote a shell script to do self extracting on the program and when it self extracts put temporary files in the tmp directory that ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
7
votes
4answers
19k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
1
vote
0answers
22 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
90
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...