0
votes
1answer
17 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
2
votes
1answer
28 views

Pin Lock Screen

Is there a way to replace password lock screen in Linux (Mint Debian Edition) with a pin lock screen? Like the one found in Windows 8 for example. It's annoying/inconvenient to have to input 16 ...
1
vote
1answer
49 views

How can I tell why I have permissions to read a file? [closed]

Here's what I just noticed on my CentOS SSH account: stat output $ stat /dev/kvm File: `/dev/kvm' Size: 0 Blocks: 0 IO Block: 4096 character special file Device: ...
4
votes
1answer
102 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
1
vote
2answers
89 views

Why are custom programs always installed in /opt, /srv, /usr/local, etc. and not in ~/ (home) folder?

The LTS repo is pretty good, but for some reason I prefer the "build from source" method for some programs. One reason is that I get the preferred version (PHP on LTS is on 5.3, whereas I can compile ...
3
votes
1answer
62 views

Monitoring filesystem activity

Say, I have a program, and I want to monitor its filesystem activity (what files/directories are created/modified/deleted etc.) This program may be capable of spawning further processes, and thus, I ...
1
vote
1answer
43 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting ...
1
vote
2answers
87 views

Secure wipe (scrub) filesystem of VPS from VPS itself

I have a VPS I'm planning to delete. This particular cloud provider makes no guarantee that the data on the drive will be wiped before giving the disk to the next person. What's a best effort attempt ...
0
votes
2answers
159 views

Unable to telnet public ip on port 80

We are facing a communication problem between the public and our private network. We have a Linux based web server behind a firewall and an internet router. As part of some integration, our web portal ...
2
votes
2answers
53 views

Is it secure to connect remotly to Mysql using shell?

I have created a shell script to connect to a DB and do some queries: #/!bin/bash ... ... mysql -h remote -u root --password='pw' MatchingDB some SQL queries My question is : Is this connection ...
4
votes
1answer
359 views

kernel: disabling /dev/kmem and /dev/mem

I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
1
vote
2answers
381 views

What are ways to encrypt a password inside an environment variable

I have this file I use to set my username and password before exporting the value. #!/bin/bash echo -n "User:"; read user echo -n "Password:"; read -s password export ...
0
votes
2answers
108 views

which unix or linux command is used to change root password of remote machine(Just an IP address) without using SSH Login [closed]

which unix or linux command is used to change root password of remote machine(Just an IP address)? Suppose I just have an IP address of the target machine which is on my network, But I do not know ...
1
vote
2answers
86 views

Game server hosting and security

I'm working on a small controlpanel for a hobby project of mine, which is supposed to set up game servers. But I have some concerns regarding security that I would like some input on. My first idea ...
4
votes
3answers
281 views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
3
votes
1answer
264 views

How can I install Linux on a UEFI system with Secure boot?

My motherboard is a Gigabyte 990XA-UD3 (CPU 1), it's a UEFI -Dual boot, and when I try installing Linux Mint 16 Cinnamon or Ubuntu 13.10 it always bring this error (initramfs) Unable to find a medium ...
1
vote
0answers
62 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
1
vote
1answer
100 views

File monitoring to pre-empt hacker

We have a hacker occasionally attempting to hack a site, and so far unsuccessful, but I would like a way to determine if the site has been compromised (i.e., files edited). The type of attacks are LFI ...
0
votes
1answer
160 views

Is it possible to make a standard user that can gain NO access to root?

I'm a very new beginner learning how to use Linux. I have very little experience so far in different distros. I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I ...
1
vote
1answer
59 views

How can I protect my computer when the only way to access the internet is though a compromised internet connection?

I access the network through a connection which is most likely compromised by a MITM attack. I can't do much about it. What steps should I take to lessen the influence of this attack. I'm especially ...
0
votes
2answers
88 views

Which runlevel is best for a Linux (Debian) server (DBMS/SCM)?

I currently try to harden the system and the security of a Debian server running a database and a source code management. I just want networking and me (one user) to be able to login. Which runlevel ...
1
vote
0answers
152 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
0
votes
3answers
269 views

noexec on /tmp and /var/tmp directory

Our client servers are running old version of jboss (Jboss 4.0) which has lots of known vulnerabilities. Result is that the server is hacked and we are seeing some unknown executables running from ...
5
votes
2answers
759 views

Setting ulimit correctly for PHP on Linux

I have /etc/security/limits.conf set to the following: nobody soft nofile 409600 nobody hard nofile 1024000 phpuser soft nofile 409600 phpuser hard nofile 1024000 httpd soft nofile 409600 httpd hard ...
1
vote
1answer
142 views

Hidding an encrypted folder in a shared system without root access (unshare -m)

I'm a graduate student trying to use a cluster at my university. These machines are shared, so I want to protect the source code I use (I signed a NDA, so I'm scared about publishing the code by ...
4
votes
2answers
153 views

Finding the logs in a hacked server. [closed]

My server has been hacked and the hacker managed to ssh as root (I know, horrible mistake on my part). What files should I be looking for to discover the origin of the attack? (At least their IP). ...
3
votes
2answers
84 views

Is there any mitigation against touch date/time forgery?

I have been using touch -t to change time of a file when I started using Linux, is there any mitigation against touch date/time forgery? Like, echoing original created date and time, even after using ...
-1
votes
2answers
92 views

Is there any other way to restrict USB storage?

I have been using /etc/modprobe.d/blacklist.conf to restrict USB storage but all employees are given root permissions, so they are removing restriction very easily. What I'm looking for is is there ...
2
votes
1answer
102 views

How 'passwd' gains ROOT user permissions?

How does Linux knows that it has to give euid 0 (uid of root) to only certain process like passwd, setuid, etc. If a process can gain root user's permissions, will it not lead to security breach in ...
2
votes
1answer
186 views

GlassFish/Tomcat security issue between domain users in linux server (alternate docroot issue)

Let's suppose we give to different users(clients) different domains (one domain for one user) in our glassfish application server for their work. This glassfish works in centos 6 server. Every user ...
4
votes
1answer
67 views

TCP wrapper “except” option

I configured the /etc/hosts.allow at the machine 192.168.122.50 with the following option. sshd : ALL EXCEPT 192.168.122.1 and tried ssh root@192.168.122.50 from the machine 192.168.122.1 and I was ...
16
votes
4answers
3k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
2
votes
1answer
337 views

Is many consoles in securetty file a risk?

I got a problem So I expect you can give me an answer. I have to evaluate the security of a RedHat server. The idea is review the /etc/securetty file to ensure that only the console tty is listed. But ...
8
votes
2answers
1k views

Test whether Linux binary is compiled as position independent code

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization ...
4
votes
3answers
437 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
4
votes
1answer
98 views

Tomoyo Linux: Have a private folder, that can't be read by default

Is it possible to specify folders, eg: /home/$user/private that can not be listed, read or written to by any application in the default profile 0, but only with programs where I specify this as ...
2
votes
2answers
196 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
0
votes
1answer
91 views

Has the launcher security issue in KDE and Gnome been fixed?

One of the first things I heard about Linux is that it doesn't get any kind of malware. Now, I see it can get malware through WINE and e-mail (although I don't even open attachments or follow links ...
4
votes
1answer
1k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
5
votes
4answers
171 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
3
votes
1answer
180 views

mount --no-canonicalize?

Neither man nor info page provide more information on this than: mount --no-canonicalize Don't canonicalize paths. The mount command canonicalizes all paths (from command line or fstab) ...
3
votes
2answers
140 views

Linux Kernel limit access to root with a button?

Is it possible to limit the access to a root account from within the kernel? I mean that if I press a button then the system detects the button being pressed and then allows access to the root ...
4
votes
1answer
104 views

Are there any security risks when mounting as root?

Are there any security related risks when mounting with root privileges compared to mounting with regular users? I have a script which does some ecryptfs mounting with non-root privileges (by design), ...
1
vote
0answers
109 views

Assigning an identity to an IPsec policy in Linux

Page 36 of RFC2367 (PF_KEYv2 Key Management API) states that when the kernel needs an IPsec security association for an outbound packet, but does not have one, it will ask the key management daemon ...
3
votes
1answer
294 views

Is there any DLP solution for linux?

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
0
votes
1answer
46 views

Prevent access to files on linux file server

I have a linux system running Debian Wheezy stable on it and am using it as a file repository (not a true file server because I am using BitTorrent sync to move files as I move around the world). Some ...
5
votes
7answers
335 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
4
votes
2answers
202 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
2
votes
0answers
99 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
3
votes
3answers
870 views

Encrypting loopback images without using a loopback device

I'm trying to design a firmware update system for an embedded Linux system. My plan is to send an image that can be mounted on the target system, so I don't need to unpack the entire file. I also want ...