Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
8 views

Multiple iptables denied in report from hourly logcheck on Debian

I get thousands of lines of iptables denied every hour from logcheck, for a week now. What are the steps to troubleshoot this, what are the main causes of this? This is inside an LAN and the ...
5
votes
1answer
406 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
0
votes
1answer
33 views

CRON session entries in logs

I'm having this in my RaspberryPi /var/log file Feb 26 21:17:01 raspberrypi CRON[15182]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 26 21:17:01 raspberrypi CRON[15182]: ...
0
votes
1answer
12 views
+150

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
1
vote
3answers
76 views

Is it bad to select remember me option in the browsers of a compromised machine?

I was reading an article on how to sniff network packets. (of course for knowledge purposes only). I came across these particular lines. For instance, say I was sniffing traffic on the network, ...
2
votes
1answer
136 views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at ...
0
votes
2answers
18 views

Protected archive (7z, RAR, Zip) open at a specific time

Are there any compression tools that are unopenable or password-protected until a specific time, at when the security is then lifted? Literally an enforced: "Do not open until --/--/----"
1
vote
1answer
41 views

Throttle accounts after failed SSH login attempts

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
1
vote
1answer
23 views

Different password for login and sudo - security concerns

I'm planning to follow the steps described in this answer to have a different password to log in and sudo. The reason is that I want a high security password to access my account or unblock the ...
0
votes
0answers
11 views

security when partitioning disks? Also, questions about keys [closed]

I'm curious what the tradeoff between disk security to potential attackers is and partitioning schemes. Is there a specific way that is more secure to partition your disk than another. I imagine ...
2
votes
1answer
26 views

How to set up users, ownership and permissions across local and remote servers?

I've been learning the Linux OS over the last year or so and I am still very confused on how permissions vary from different configurations. I am trying to set up my local development environment and ...
1
vote
3answers
104 views

how to set up permissions of “download” dir to prevent execution of exploit program

There is a host with a local service that receives data from a remote location (via e.g. http) and saves it locally under /var/log/data/ in some mydir. $ ls -al /var/log/data drwxr-sr-x+ 4 root ...
2
votes
1answer
63 views

Is it possible to access any file or dir within a non-accessible directory? [duplicate]

Say I set my home /home/john directory as not readable for any other user. But I've forgotten to do so with some files within that directory, say ./.bashrc or ./Downloads/Presentation.ppt. Now, if ...
27
votes
7answers
5k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
3
votes
1answer
47 views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
0
votes
0answers
12 views

Returning from a sleep the desktop displays shortly (before entering password), privacy issue

OS: Linux mint 17.1 Cinnamon 64-bit Cinnamon version 2.4.6 Intel Celeron: 900 @ 2.20Ghzx1 Memory 2 Gb Graphics Card: Intel Mobile 4 series integrated When I return to my computer after it has been ...
0
votes
1answer
25 views

How to update all Debian packages from source code?

For building packages from source code, there is apt-get source --compile pkg-name. But for it to work, one has to run apt-get build-dep pkg-name beforehand, which downloads binary packages. Is it ...
2
votes
2answers
421 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
4
votes
1answer
32 views

How can I test whether Chromium is running inside sandbox

I am using Chromium browser on Debian Wheezy. I read that Chromium is using sandbox to isolate its processes from the rest of the system and thus to increase security. How can I verify that Chromium ...
1
vote
1answer
773 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
1answer
512 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
0
votes
1answer
40 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...
6
votes
4answers
3k views

Are there any GUI's for Linux that doesn't use X11?

Are there any GUI's for Linux that doesn't use X11? Since X has very poor security :O e.g.: Ubuntu, Fedora - what else are there? Goal: having a Desktop Environment without X. - what are the ...
0
votes
1answer
50 views

Sudo User: Not able to see the home directory of other users

I created sudo user hrsupport with following commands: hrsupport ALL=ALL, NOPASSWD: /bin/chown, /bin/chmod, /bin/chgrp, /scripts/pkgacct, /scripts/restorepkg How can I achieve this The hrsupport ...
-1
votes
2answers
58 views

How to prevent the messages about REMOTE HOST IDENTIFICATION HAS CHANGED

Is it possible to prevent the following message about: ( REMOTE HOST IDENTIFICATION HAS CHANGED ) When using only this connection syntax ssh xxx.xxx.xxx.xxx example of warning message: ssh ...
1
vote
1answer
32 views

How to force rpm and yum to fail if a GPG signature is missing or cannot otherwise be verified?

How can I force rpm and yum to fail if a GPG signature is missing from a package or otherwise cannot be verified due to a missing key? For the example below, assume the RPM has been signed but the key ...
12
votes
1answer
5k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
1
vote
1answer
68 views

Reason why ssh RSA key would change?

Today I went to connect t my Centos 7 box via ssh and my sftp client and both indicated that the server RSA key finger print had changed. I've checked all my logs for suspicious activity but don't ...
1
vote
4answers
9k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
2
votes
2answers
850 views

Ghost Vulnerability On Linux

It came to our notice that glibc needs to be upgraded from 2.2 to the latest version as per the release 5/6/7. My Question is that do I need to reboot the system, because we are having more then ...
-3
votes
0answers
57 views

SSH Rootkit (EBURY) affected Server, What is the solution?

{i am a active member of many sites of stackexchange, Please do not mark this as a duplicate, i have verified & also this is very specific problem. I am posting it here, Bcoz this is only website, ...
1
vote
1answer
52 views

GUFW or Firestarter in Fedora

Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
1
vote
2answers
68 views

how to record all who that login to my linux machines and records them

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine yum install audit kit installation from: ...
4
votes
3answers
2k views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
70
votes
6answers
41k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
1
vote
1answer
91 views

Can I update eglibc to a non-vulnerable version using Debian Squeeze 6 on x86_64 architecture?

I'm currently attempting to update eglibc on Debian Squeeze 6 on x86_64 architecture from version 2.11.3-4, which is vulnerable to the GHOST exploit, to version 2.11.3-4+deb6u4, which isn't vulnerable ...
10
votes
3answers
330 views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
4
votes
3answers
723 views

Any disk encryption that locks itself for some time after a number of failed attempts?

Is there any way to have your disk/partition/file encrypted (in Linux or as a hardware encryption; no Windows here) in such way that it locks itself for say 10 minutes after say 3 failed unlock ...
1
vote
0answers
13 views

Finding out the script causing MySQL failed connections

I see lot of lines in mysql.log Connect Access denied for user 'M'@'localhost' (using password: NO) I am sure I don't have such a user on my system. I need to figure out what script is ...
0
votes
1answer
423 views

GHOST: glibc gethostbyname buffer overflow

https://rhn.redhat.com/errata/RHSA-2015-0092.html I can see md5sums of the packages, but cannot download them and my package manager says I'm up-to-date. [root@notebook log]# grep glibc-2 yum.log | ...
3
votes
2answers
34 views

How is the visibility of a file-system mount limited?

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
1
vote
1answer
54 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
104
votes
9answers
9k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
3
votes
0answers
42 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
6
votes
2answers
69 views

Linux graphical password dialog trick security

When we run a command by sudo, the password is asked [sudo] password for user If the sudo is not typed the password should not be asked. If asked, I would assume it as a fraud by the application. ...
0
votes
0answers
9 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
43
votes
1answer
1k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
6
votes
2answers
109 views

Run Ubuntu Security Updates every Saturday only

A clients wants to enable automatic security updates on their 12.04 box, but it has to be once per week, on saturday only. (Why I don't know) When I do dpkg-reconfigure -plow unattended-upgrades it's ...
4
votes
2answers
2k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
2
votes
1answer
36 views

NIS and /etc/passwd

Shadow passwords are to be avoided in a NIS server, as suggested in this guide at paragraph 7.6. So: in a NIS server (a Unix or Unix-like system), should all the users be migrated to /etc/passwd from ...