Tagged Questions
2
votes
1answer
30 views
Benchmarking Apache using ab
I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers.
Initially, I did the testing for 1000 ...
2
votes
2answers
62 views
files in /proc/$PID (e.g. ssh-agent, Chrome) are not owned by user but by root
I am just answering another question here :-) and thus had a look – wanted to have a look at /proc/$PID/fd of ssh-agent in order to find out which socket it uses. But I can't. I am quite surprised to ...
-1
votes
3answers
84 views
Is there a way to 'authorize' a command typed in by a user?
is there a way we can authorize a command typed by a user before it takes effect?
For example, when a user types cp file1 file2, the command will not be executed and a root / root-equivalent user ...
2
votes
1answer
66 views
Is it possible to specify groups in /etc/security/capability.conf?
I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
2
votes
2answers
85 views
How to encrypt my system such that suspend to RAM works and is also encrypted
How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
2
votes
1answer
33 views
Sign a module after kernel compilation
I've built a kernel in tmpfs, then I rebooted.
Now I see a message when I compile the 3rd party module,
NO SIGN [M] XXXX.ko
How can I get it signed? The key pair generated during rpmbuild is lost ...
7
votes
4answers
175 views
Which data should be excluded from log files , error messages etc. if posted online?
What data should one erase from log files, error messages etc., if posting them as a screenshot so as not to expose sensitive information? As I have little knowledge about this topic, I can vividly ...
10
votes
1answer
149 views
Can entropy consumption at program start be prevented?
I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program ...
0
votes
2answers
206 views
How do I make PHP securely load files from the server root home folder on CentOS?
So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
2
votes
3answers
138 views
Check outgoing network traffic
In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to?
I am not paranoid about security, ...
4
votes
3answers
137 views
Can someone execute a malware by just inserting a flash disk?
I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
1
vote
3answers
86 views
Taking away a User's Read/Write/Execute Permission
So I have a user that is able to go in /etc and read files like httpd.conf.
I would like to deny that user access to any critical locations such as /etc, /var and so on.
What would be the best way ...
2
votes
2answers
228 views
Disable stack protection on Ubuntu for buffer overflow without C compiler flags
I'd like to try some shell codes and I want to disable linux protections.
I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
4
votes
1answer
89 views
Why Nmap fragmented scan on Linux is only working from virtual environment?
OLD QUESTION AND TITLE (Look further down for the updated question):
Why Nmap fragmented scan is only working on Backtrack?
I spent quite a few hours today trying to capture and study some ...
1
vote
1answer
51 views
Change order of Private Keys passed via SSH login
ssh -i ~/.ssh/username username@xx.xx.xx.xxx -v
Server is set to accept only 3 log on tries. The ssh system is trying 3 identity files before attempting the correct identity file.
debug2: key: ...
1
vote
2answers
117 views
setuid programs don't seem to run setuid in TinyCore Linux
I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file ...
1
vote
3answers
121 views
SUID permissions - Which is correct?
Trying to secure a Linux server and have little experience with SUID. After executing
find / -perm +4000
many programs were discovered. I have seen conflicting advice here and hereon what should ...
5
votes
9answers
246 views
How to prevent a process from writing files
I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
1
vote
2answers
297 views
iptables blocking from internet side on eth1?
How to use iptables to deal with two Ethernet ports?
eth0 port for LAN use (192.168.1.50 Private IP).
eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP).
ifconfig ...
11
votes
2answers
290 views
How can I be sure that a directory or file is actually deleted?
I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later.
How can I ensure that a directory I had deleted will actually be removed from the disk? Are ...
-3
votes
2answers
95 views
What software(s) should I install on new system(with Linux as a OS) to prevent it from getting hacked? [closed]
I am switching to new system with a OS using Linux.I will be using another system which has windows ultimate which is hacked.I am being cyber bullied.
I have given a reference to this as a question on ...
1
vote
1answer
163 views
Is TRESOR included in the latest kernel?
Did TRESOR get included in the
mainline Linux kernel? Where would I look to find out? Is there any documentation describing its use? Reading about cold boot attacks on Wikipedia makes me think TRESOR ...
3
votes
1answer
174 views
How to replace setuid with file-system capabilities
Inspired by this question here is the follow-up:
As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root.
Now it seems that there has ...
1
vote
0answers
71 views
Running Tomcat MySQL and Apache under a group
I am trying to set up a web server at home using Ubuntu, but prefer my bash scripts to be platform agnostic hence why I am asking here. I also dislike apt-get everything. I am trying to create a ...
5
votes
2answers
212 views
How to disable login for an user?
My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be ...
4
votes
1answer
177 views
What are EXT4 Security Labels?
During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by:
Security labels support alternative access control ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
2
votes
3answers
306 views
Chroot Risks w/ /dev and /proc
I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into ...
2
votes
1answer
126 views
Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?
By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
5
votes
1answer
881 views
Is there a way to deactivate Buffer overflow protection on my machine?
I want to do some experiments with buffer overflows on my various virtual machines, including (but not limited to) Debian 6, Ubuntu 12.04, Fedora 16, but every time I try to execute the buffer ...
3
votes
1answer
345 views
How to configure permissions to allow apache to securely have access to a file in a shared environment?
This is a follow up question from my previous, but I felt it might be more Linux based.
http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file
...
3
votes
2answers
208 views
Is it possible for a CentOS system on EC2 to not have a bootloader?
I'm attempting to look for grub:
[root /]# find / -iname "*grub*"
/sbin/grubby
/usr/share/man/man8/grubby.8.gz
/usr/share/vim/vim70/syntax/grub.vim
/usr/share/vim/vim70/ftplugin/grub.vim
...
3
votes
2answers
168 views
Can AIDE scan a directory inside a directory the user doesn't have read permissions for?
I would like to use AIDE to help me verify the integrity of my home directory on a shared Linux system. I am not an administrator of this system. I have built and installed AIDE in my home directory ...
1
vote
2answers
76 views
Linux VPS Configuration
I just recently got my hands on a linux (Fedora) VPS and I would like to ask if there are special configurations that I have to be wary of. Do I still configure it like I would configure a normal ...
6
votes
2answers
4k views
Effect of entries in /etc/securetty
By default on RHEL 5.5 I have
[deuberger@saleen trunk]$ sudo cat /etc/securetty
console
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
vc/7
vc/8
vc/9
vc/10
vc/11
tty1
tty2
tty3
tty4
tty5
tty6
tty7
tty8
tty9
tty10
...
1
vote
2answers
264 views
Is there a good way to encrypt and store a mailbox while still being able to quickly access and search it?
I am wondering if it is possible to :
Store a mailbox in a way that the system administrator (ie: root) cannot see it
User(s) with the valid credentials would be able to see it AND be able to search ...
2
votes
4answers
5k views
SSH login with clear text password as a parameter?
I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I wont have access to ...
3
votes
2answers
200 views
Linux security vulnerabilities?
A while back I started an embedded project using the 3.2.10 kernel. Now the project should go into production and the stable kernel is 3.2.16. I would prefer not to upgrade anything to avoid ...
1
vote
1answer
192 views
How to know who accessed a file or if a file has 'access' monitor in linux
I'm a noob and have some questions about viewing who accessed a file.
I found there are ways to see if a file was accessed (not modified/changed) through audit subsystem and inotify.
However, from ...
3
votes
1answer
151 views
How are loaded SSH keys referenced by name?
I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel)
It seems strange to me that it uses a name to reference the keypair - ...
3
votes
1answer
114 views
What is the best way to restraint/secure a workstation?
I want to prevent users to copy on usb devices and some others actions.
I was thinking of using polkit. Do you think it is a good solution or does someone know some alternatives ?
EDIT:
I also need ...
2
votes
1answer
1k views
Linux: LUKS and multiple hard drives
I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM).
I think the basic ...
6
votes
2answers
336 views
Why did SDF switch from NetBSD to Linux?
I personally don't have much experience, but I was reading about SDF, and at one point the article mentions that SDF migrated to Linux in 1997, but due to the large number of malicious attacks it ...
3
votes
1answer
295 views
SELinux outbound access to other sites with restrictions
We have CentOS 6 configured with SELinux to host a number of websites.
Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
3
votes
2answers
13k views
What user should apache and PHP be running as? What permissions should /var/www files have?
I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
5
votes
5answers
2k views
Shell Script mktemp, what's the best method to create temporary named pipe?
I'm aware its best to create temporary files with mktemp, but what about named pipes?
I have an idea, I'm sure it would work,
but I would really like an expert opinion.
I prefer things to be as ...
10
votes
3answers
2k views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 ...
4
votes
8answers
5k views
Is it possible to test user name and password?
I've written a python CGI script that invoke bash commands, and it needs to test for a successful login on the host.
Is it possible to create a bash script that will test a given username and ...
2
votes
1answer
88 views
What commands should be run when retiring a remotely hosted server?
I have a dedicated server from a friendly host located a substantial distance away from me, so the only access to the machine is SSH. It's a month to month deal, so I don't own the hardware. I'm ...
11
votes
3answers
340 views
Prompt user on Linux security denial
Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
