Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
0answers
17 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
1
vote
2answers
21 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
0
votes
0answers
11 views

how do I update client certificates in openvpn?

I am using OpenVPN to secure access to apps running on a CentOS 7 server. Each authorized client has a key which is used to connect to the server using OpenVPN. The problem is that the keys are just ...
2
votes
2answers
36 views

How to defend against a Live USB computer hack

A Linux installation can be simply hacked by using a live USB/CD, gaining root access on the live distro, chrooting to the target filesystem and running passwd root. One can use grub too. There may be ...
-1
votes
2answers
29 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
39 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...
2
votes
0answers
20 views

how to prevent procmail listening to the world [closed]

This is part of a larger effort to try and ensure my server is not infected and spamming the internet with spam emails I had a friend take a look at the server and he said "Your procmail is open to ...
7
votes
1answer
121 views

Blocking SSH Brute Force attacks on IPv6

I recently had to work with some servers that have an IPv6 connection and I was surprised to find out that fail2ban does not have IPv6 support, neither does denyhosts. Searching on google I found that ...
1
vote
0answers
17 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I have stucked up on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting ...
2
votes
1answer
40 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
5
votes
2answers
67 views

Why does password prompt lag slightly after typing the username in tty?

I have a this kind of behavior & I don't know how to fix it or even how to search a fix for it since I don't know how would I even call it. Here's what's happening: The first time I boot, when I ...
3
votes
1answer
33 views

security model of Linux password entry

Whenever a Windows application wants to do something requiring administrator privileges, my screen goes black and a prompt comes up, asking if I want to grant administrator privileges. I understand ...
2
votes
1answer
28 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...
-2
votes
2answers
49 views

How to prevent selected users from using “newgrp” with a password [on hold]

I'd like to know how can I avoid add some users to a group? I need to avoid some users join to a group --I want to lock a group from some users, not all. Details lgroupmod -L dba ==> This ...
0
votes
1answer
79 views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
1
vote
2answers
36 views

eCryptFS and FIPS 140-2

I've searched high and low for information on whether eCryptFS encryption is FIPS 140-2 compliant. I've found information on other filesystem or block encryption and their FIPS compliance I presume ...
2
votes
1answer
50 views

Things to check after a untrusted USB device was mounted

Suppose you plugged an untrusted usb-stick into your linux machine (as user) and browsed and copied some files, perhaps using a graphical interface. After the usb-stick is removed (and not available ...
0
votes
1answer
35 views

How can I configure my server to avoid information leakage from the SERVER header of its HTTP response

I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out ...
1
vote
6answers
243 views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
0
votes
1answer
25 views

Strange commands on FTP logs

I'm battling with wordpress security problems and sometimes even I have tried everything my server sends spam by some hacker. I have checked my FTP log and I found this code ...
1
vote
1answer
42 views

How the kernel can prevent a malicious program to operate?

If I write an x86 assembly program that tries to fetch and analyse all the addressable memory space. How the kernel can prevent this operation to be done? I am more familiar with small CPU ...
0
votes
0answers
18 views

How to access boot: invite?

I'd like to simply try a root pawd reset, by entering linux single whan systems display boot: when booting. But my Mint system goes directly to user home prompt. Tks
1
vote
2answers
38 views

Prevent certain lines of a script to run as root

Suppose I am writing a shell script that requires root privileges to run, for example- #!/bin/sh ip -s -s neigh flush all ufw enable How can I prevent certain lines of code to be run as root, i.e. ...
1
vote
1answer
31 views

How to trap an event when a file with a specific content (given by e.g. checksum) was created on the local file system?

I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by ...
0
votes
0answers
22 views

Encrypt some folder and hide key in Linux

I work on a Debian system (Mint actually). I'd like to encrypt some folders and files, for instance: the one with OpenVPN configuration and keys, and be able to decrypt it on the fly. My problem: ...
3
votes
1answer
98 views

OS X FileVault 2 duress password

I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after ...
2
votes
2answers
33 views

How can I set up a secure LAMP stack on CentOS?

I have been using linux for years, but I need some clarification on what are probably pretty basic principles to how the OS works, but I definitely need clarification due to security concerns. I am ...
2
votes
1answer
72 views

How to Mark Traffic using IPtables?

I'm trying to mark traffic, How shall I write following code in terms of IPtables? /ip firewall mangle> add chain=prerouting src-address=10.1.1.1/32 action=mark-connection \ ...
5
votes
1answer
296 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
2
votes
1answer
36 views

What is the difference between the FreeBSD flags, immutable and unlink?

What are the differences or similarities among the FreeBSD flags, simmutable/uimmutable and sunlink/uunlink? Reading man chflags, I see these flags: schg, schange, simmutable set the system ...
1
vote
0answers
59 views

nmap doesn't detect opened port [closed]

I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and I can get connected as well with the telnet ...
2
votes
1answer
82 views

Using mailx without storing a password

I'm trying to setup mailx to use my Gmail account. I've found a configuration that can send mail successfully but it requires me to store my email password in a configuration file in my home ...
1
vote
2answers
77 views

iptables configuration - ssh connection only from a remote network

I'm trying to configure Iptables of a server in order to permit SSH incoming connections only from a certain network. by the way this is the rule chain : # Drop anything we aren't explicitly ...
1
vote
2answers
37 views

OpenVPN : protect your clients key/cert/conf from being stolen?

I have configured an OpenVPN install. Mode: multiclients 1server. Clients are raspberries. I note how easy it is to steal a rasp, and look in HDD to get key+cert+conf. Copy it on your laptop, and ...
8
votes
3answers
1k views

Is it a good practice to run a daemon under a non-root user account?

I've developed an application that uses NTP to change the network time, to sync two of my computers. It runs as root, since only the latter is allowed to change the time and date on Linux(I guess). ...
0
votes
0answers
17 views

Where to put the ASCII WPA2 Wifi Key in MacOS X?

I tried to make some research about wifi security in our company: So i tried to het WPA2 Wifi key using wifite tool in Kali linux distribution. After the few attempts i get WPS PIN and WPA2 KEY: ...
0
votes
1answer
45 views

What are the best practices for permissions and and methods for generally avoiding using sudo? [closed]

The main point is that I only want one user to have sudo access - really only for use in set up and emergencies. I don't even trust myself with sudo access all the time. Are there best practices ...
1
vote
0answers
47 views

What is the best operating system for beeing anonymous [closed]

Im looking for an anonymous distribution of linux, anyone can help me? Thanks
2
votes
1answer
78 views

How to safely transmit a password over SSH for a remote command to use

On the local server, I have a program that stores the password in the predefined environment variable (SPECIAL_PASSWORD). On the remote server I have a program that reads and uses a password from a ...
1
vote
0answers
27 views

Is there any considerations I should take when running untrusted apps as non-root user?

I have to use an application I don't trust (unstable) and I will run it as a non-privileged user so if something bad happens the damage would be limited to the home folder of that user. I removed ...
0
votes
4answers
92 views

How to track/log commands executed on a shell?

Can commands be written to a logfile before they were executed in any shells? I know there is a patch for ssh to log all commands from ssh sessions, but i want to log even commands executed from a ...
5
votes
1answer
66 views

How to enable random PIDs on Linux?

I'm currently comparing random PID implementation on OpenBSD, FreeBSD and Linux from security perspective. As long as OpenBSD and FreeBSD are concerned, my work is done. However, while the answer ...
0
votes
0answers
42 views

Use sudo as login

I've picked up the habit of using sudo and disallowing root logins. In cases, sudo is integrated with GUI configuration tools that require it. Are there any serious efforts to replace login and ...
5
votes
1answer
111 views

Is it safe for my ssh user to be given passwordless sudo for `apt-get update` and `apt-get upgrade`?

I have an SSH standard user account on my personal server, and it has sudo access (via its password). I ssh in using a public key, so I don't have to type in the account password to log in. Is it ...
2
votes
2answers
96 views

How can I allow SSH and SMTP only using IPTables?

I've got a raspberry pi set up to send me periodic emails. As it's connected to the internet 24/7, I need IPTables set up properly. I want to allow incoming SSH and allow emails to send out on port ...
1
vote
1answer
28 views

Script samba password but securely

I want to script the addition on a samba user and the password. I have seen solutions similar to the one here Piping password to smbpasswd echo -ne "$PASS\n$PASS\n" | smbpasswd -a -s $LOGIN but ...
1
vote
2answers
37 views

How can I create an SSH login that delegates to telnet securely

I'm playing around with the idea of creating a MUD, but one of the down sides is that they use "telnet" which is insecure. I'd like to retain the ability for "anonymous" users to access a specific ...
4
votes
1answer
39 views

Monitoring ARP Poisoning

How to monitor ARP poisoning? These few days my internal website that can be accessed locally has weird image replacing every images on the site for few seconds (it got back to normal after ...
4
votes
1answer
127 views

Unexplained files found in home folder

For background information, I'm running openSUSE 13.2 and KDE 5. Today I found a number of unexplained files and folders in my home folder which state they've been edited 3 days ago. I do not ...
1
vote
0answers
44 views

Allowing sudo kill for remote user for recovery purpose. Security implications?

I'm planning to create user allowed to SSH in and with right to sudo kill in case something disables local terminal/keyboard/display etc. Would probably add ps and/or htop to the list, as well. I ...