Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
18 views

How to know different types of events and there ID's in linux [on hold]

How can I know what are all different types of events linux generates. I can get this from logs but reading logs and noting down ID's are very much time expensive and all the events will not triggers. ...
0
votes
2answers
30 views

If I install malicious software what may it do? [on hold]

If I software in a deb file and I do sudo dpkg -i file.deb will it execute code from the package and possibly wreck my system? If I log in as testuser and execute the software (simply thebinary on ...
2
votes
1answer
17 views

Lock system after awake suspend (incl. forced-shutdowns system after countdown)?

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and ...
1
vote
0answers
7 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
2
votes
1answer
16 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability?

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
1
vote
1answer
28 views

Latest libxml2 port to RHEL4

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention ...
-2
votes
1answer
94 views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
112 views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
0
votes
2answers
50 views

ClamAV found virus, if I should delete this virus? [closed]

ClamAV has found two viruses on my server. Is this a virus? Should I delete it? /tmp/back: Perl.Shellbot-8 FOUND /var/tmp/back: Perl.Shellbot-8 FOUND
0
votes
3answers
42 views

last command only shows few days worth of logins

I often use thelast command to check my systems for unauthorized logins, this command: last -Fd gives me the logins where I have remote logins showing with ip. From man last: -F Print full ...
1
vote
3answers
65 views

Securely passing user input to command

I have a daemon daemon running in Server A. There, there's an argument based script to control the daemon daemon_adm.py (Server A). Through this script I can insert "messages" to daemon coming from ...
2
votes
2answers
40 views

What is best and secure way to save application settings?

Let's say I have an application which has plugins, daemons, etc. Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is ...
1
vote
0answers
24 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
6
votes
3answers
629 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
0
votes
0answers
23 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
0
votes
0answers
39 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
-2
votes
0answers
39 views

Shellshock ? new vulnerability in bash [duplicate]

I just got an email from my hosting company. It said "Shellshock," takes advantage of a vulnerability in bash, making it possible for attackers to send and execute remote commands? Has anyone had ...
0
votes
0answers
16 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
3
votes
1answer
24 views

How can I lock down a user account to the point that it can read/write/execute as little as possible?

I would like to lock down an Arch Linux user account to the maximum extent possible. The only functionality required for the account is to accept a non-terminal SSH session which allows the client to ...
8
votes
2answers
147 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
4
votes
1answer
23 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
1
vote
2answers
192 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
7
votes
2answers
7k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
2
votes
0answers
28 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
0
votes
0answers
31 views

Permission denied tmp dir on STIG RHEL

I am writing a program for a DISA STIG version of Red Hat Linux 6.5. I wrote a shell script to do self extracting on the program and when it self extracts put temporary files in the tmp directory that ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
7
votes
4answers
17k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
1
vote
0answers
21 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
90
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
0
votes
1answer
28 views

What are the potential negatives of turning on process accounting (psacct package)?

I am looking into turning on process accounting on some EL6 servers. What are the potential pitfalls of turning this on? If you mitigate storage requirements with log rotation, any reason you would ...
0
votes
2answers
40 views

Accessing Linux server via VPN or Certificate based ssh?

My company has a fairly common security setup where you need to log in via VPN, when outside the company network in order to get access to the servers. The biome is mostly Windows machines. I'm ...
0
votes
0answers
25 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
3
votes
1answer
41 views

read only symlink or something similar? [duplicate]

I created myself a NAT for home use (Ubuntu+Samba+Greyhole+Apache+MySQL+other web server related stuff). 90% of files I store there are pictures that i really don't wanna loose (that's why Greyhole). ...
1
vote
1answer
53 views

Is the data transiting through a pipe confidential?

I read the following question (Shell Script mktemp, what's the best method to create temporary named pipe?) but I'm wondering whether it is preferable to use a temporary named pipe to transfer ...
0
votes
3answers
163 views

How to add a password to a specific command

I've been searching google on how to add additional security to a specific command without using sudo. Is it possible to add on a security feature without actually using sudo? For example: Whenever ...
1
vote
0answers
31 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
3
votes
1answer
58 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
19 views

What are these %(…)s strings in fail2ban's jail.conf file, and how do they work?

In setting up fail2ban there are what appear to be variables at the top of the jail.conf that look like this: mytime=300 . . . [ssh] bantime=%(mytime)s Or in this more complicated form like this: ...
1
vote
0answers
12 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
2
votes
1answer
155 views

Do I have thousands of attempts to breach my system in this log from logwatch?

I'm setting my systems up to send me reports by email. I'm posting one log report (see below). This log shows that there are thousands of attempted break-ins. Questions: I have denyhosts and ...
1
vote
2answers
62 views

How Does Whonix Keep The User Anonymous?

How does Whonix Linux keep a user secure? I am aware of how it works in terms of the Gateway which uses Tor, but how does the Whonix workstation ensure nothing is logged, or stored, on the OS and no ...
0
votes
1answer
29 views

Not to ask for grub password

I set a superuser and password for grub in Ubuntu and whenever I turn my machine on it asks for username and password... I want when I hit e on my keyboard just asks me for username and password... ...
9
votes
1answer
215 views

Why does the location of Enviroment Variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run ...
2
votes
1answer
36 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
0
votes
1answer
99 views

I stopped MiniSSDPD, will something bad happen?

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" ...
28
votes
4answers
1k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
1answer
32 views

how many password generators are there in debian and how to know which are good

I know of two password generators in Debian. The first one which I have used is apg and it seems to generate some good passwords. $ apg -m 15 -M SNCL RefGav:quedTut7 {Shtetmigdybig1 ...
0
votes
0answers
38 views

ubuntu linux - security between applications

When I run a Ubuntu Linux on my machine, and if using only 1 user account, most of the applications executed are using the same uid. I want to know what risks do applications face in this ...