Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

4
votes
1answer
73 views

Exploit in bash script parameter possible?

I want to pass an e-mail address from a web form to a bash script. I'm using the following regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}/ Is this sufficient? Or could one embed an exploit?...
2
votes
3answers
132 views

How can I set up a secure LAMP stack on CentOS?

I have been using linux for years, but I need some clarification on what are probably pretty basic principles to how the OS works, but I definitely need clarification due to security concerns. I am ...
1
vote
2answers
381 views

How to run unattended-upgrades not daily but every few hours

By default unattended-upgrades runs with cron.daily, that is at most on a daily basis. This can be a lot of time for attackers. I'd like to run it every 4 hours, how can I do this?
6
votes
7answers
345 views

How to secure a sudo - powered script

Solution for executing root commands as unprivileged user - sudo 'ing script - easily opens possibility of security breach and unexpected behavior and results (this is also true for any other solution ...
7
votes
3answers
662 views

How can I safely ensure a variable contains only a valid filename?

Given the script below, how can I ensure that the argument only contains a valid filename within /home/charlesingalls/ and not a path (../home/carolineingalls/) or wildcard, etc? I only want the ...
1
vote
0answers
21 views

Is granting write-only permission on log files to certain users a good practice?

Will it be safe to enable logging into a write-only log file on a production server? I imagine, that this would protect the log file from unwanted eyes. Are there any drawbacks of using this technique?...
3
votes
1answer
82 views

How to deal with insecurity of `eval` evaluating external input in a script?

Binaryzebra said this script is evaluating external input, a highly insecure practice. What are some ways to deal with or even replace eval evaluating external inputs in a script? Thanks.
0
votes
0answers
28 views

SUID bit does not work even though I put the binary on a non-nosuid mount [duplicate]

I am trying to test out how suid would work. I have this for my binary: #include <stdlib.h> #include <stdio.h> int main(int argc, char *argv[]){ system("/bin/sh -c whoami"); ...
30
votes
5answers
1k views

Execution of possibly harmful program on Linux

I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it. I was thinking ...
2
votes
1answer
26 views

What are the most restrictive external firewall / DNS listening port settings I can have for my DNS server (internal clients only)

This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services). This is about the externally-facing side ...
2
votes
1answer
36 views

linux periodic system check script or utility [duplicate]

Is there any commonly used shell script or utility to periodically check Linux file systems for changes, such as permission or ownership changes of configuration files. I am thinking of something ...
3
votes
1answer
34 views

Can I be sure that the name of a Linux Audit record's field is unique?

I am creating a parser/converter from the Linux Audit format. As I was studying the format, looking at examples and reading the documentation I stumbled upon a problem. Can I be sure that the field ...
3
votes
1answer
87 views

Undocumented format of Linux Audit log records

I am writing a parser for Linux Audit and I stumbled upon some weird cases which doesn't seem to comply with the standard. My reference is the Red Hat's documentation. A proper audit record should ...
-4
votes
0answers
16 views

Can vault be installed and used on UNIX [closed]

I know that Vault is supported on Windows, Linux, Open BSD, MAC OS, Net BSD, Free BSD. But there is no software package available for UNIX. Is Vault supported on UNIX. If it is not supported then can ...
1
vote
2answers
48 views

Scan for file changes in some directories once every 6 hours

I've had some security issues lately and as I can't be totally sure that my code is secure, I have been thinking about scanning some folders and get notified when a file is changed or a new file ...
0
votes
0answers
26 views

how to restrict users to the assigned folder with SFTP

I know there is different version of this question. What I have is a Red Hat 7.1 Linux box in the cloud. What I need is: create a group exchangefiles restrict group to SFTP I have more than one ...
0
votes
1answer
21 views

ecryptfs-setup-private failing on Centos 6

$ ecryptfs-setup-private --force Enter your login passphrase: Enter your mount passphrase [leave blank to generate one]: ************************************************************************ YOU ...
3
votes
1answer
529 views

Bot requesting odd resource in apache logs

While studying for the RHSCA exam I set up my first home server and quickly found that bots had already started requesting commonly vulnerable files. It was alarming at first, then just purely amusing ...
3
votes
1answer
3k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
1
vote
1answer
20 views

Where can I find the most recent dictionary of standard Linux Audit event fields?

I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined. I've found such a file[1] but the ...
15
votes
4answers
20k views

How can I track who SSH'es into my linux machine?

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-...
75
votes
8answers
82k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
1
vote
1answer
21 views

Do popular linux distributions verify binary packages?

If not all package builds are reproducible, what guarantees that users do not run two different binaries of the same version and architecture?
88
votes
3answers
3k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
0
votes
1answer
42 views

Will a custom encoding C# class function properly with the Mono .NET 4.0 libraries installed on Ubuntu 16.04?

I would like to change the default encoder for ASP.NET 4 running with Ubuntu Linux 16.04 operating system on a Lenovo Thinkstation desktop and apache server 2.0 and mod-mono-server4.exe. My question ...
4
votes
1answer
1k views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at net....
1
vote
1answer
955 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
0
votes
1answer
26 views

Learn the base of security and defend myself from external attack [closed]

i would like to learn and work on internet security, because thia is a world that is in continuos change and id like to improve myself on it..anyone can help me linking site or PDF where i can study ...
19
votes
7answers
95k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
1
vote
0answers
29 views

Encrypt directory on Linux

I need to create an encrypted directory (to be then filled with files and subdirectories) in a Linux ext4 filesystem, accessible to just one user. It should be: visible (just the root) from the non-...
0
votes
1answer
29 views

Unix winbind groupmap

i got Linux server (SLES 12) joined in Windows AD with winbind and samba services. I got unix group "mqm" and windows AD group "67uts-mq-admins". I want to map windows AD to unix group with "net ...
0
votes
2answers
2k views
0
votes
1answer
61 views

Remote docker over ssh tunnel

I have been testing docker. Due to strict firewall policy that blocks all ports except the ones necessary, I bind my docker clients to local ports and use ssh tunnels to access them remotely for the ...
4
votes
2answers
94 views

Linux root access recovery by booting on the console

This is my first question so bear with me please. So I have a concept in mind that I can't quite grasp. Very recently I recovered a root password for a Debian server by booting into single user mode. ...
0
votes
1answer
34 views

I am facing huge attack of layer 7 on port 3306 can anyone help me?

I am facing huge attack of layer 7 on port 3306 can anyone help me? my iptables rules are good too 184 9568 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ...
1
vote
0answers
71 views

Greenbone/OpenVAS not starting tasks after reboot

I have Greenbone and OpenVAS installed on a Fedora machine. Configuration was OK and everything was working fine. After a reboot every attempt to start a task results in the browser waiting forever ...
1
vote
2answers
157 views

Script samba password but securely

I want to script the addition on a samba user and the password. I have seen solutions similar to the one here Piping password to smbpasswd echo -ne "$PASS\n$PASS\n" | smbpasswd -a -s $LOGIN but ...
5
votes
1answer
1k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
1
vote
1answer
50 views

Executables in /usr/bin not showing for permissioned users [closed]

I installed xvfb-run using yum under root, and I can see the executable in /usr/bin with the permissions -rwxr-xr-x. When I login under a different usr which falls into the 'other' permissions, the ...
0
votes
1answer
2k views

What is the security impact of not using tls-remote with OpenVPN

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like ...
1
vote
2answers
481 views

SSH key for HTTP

Is it possible to set something up like SSH Keys for http traffic, so that a browser must have the matching key in order to access?
0
votes
1answer
52 views

Should virtual host files contain two <directory> directives? [closed]

We've heard that a good security practice is to reset everything in the virtual host to allow nothing, then have another directive to allow specific access - something like this: <VirtualHost *:80&...
0
votes
1answer
20 views

How to restrict restrict remote administration software to one domain name?

I currently have a server hosting a number of websites on a debian server. I understand that all my domain names share the same IP so any of them will grant me access through SSH, but I was wondering ...
1
vote
1answer
480 views

Breaking out of a docker container

Are there any security risks with allowing users to run docker and mount files he has access to? We have shared network mount where all users home directories reside and we basically don't want ...
0
votes
1answer
141 views

Calling php function from /var/www/folder (as www-user), which is located in a file in /var (or any folder) (with root permissions?)

I wrote a script which "walks" through /var/www/xyz and scans folders and more. The folders are all 'user-bound', so the permissions for a single folder there are set to the specific user. Running ...
2
votes
1answer
342 views

modsecurity rule for blocking wordpress / joomla admin login - others

I have an old rule for ModSecurity 1.x to block admin brute force attacks, and only allow them in the internal network. When I migrated to 2.x, it stopped working. Also the networking ipmatch rules ...
1
vote
1answer
390 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
2
votes
1answer
505 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
21
votes
11answers
7k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
0
votes
1answer
16 views

Hash sum of partitions that haven't been mounted changes every time after a live usb run

I have a Live USB with puppy linux on it. Here's menu entry in Grub2 for Puppy: menuentry "Puppy Linux 6.0.5 tahrpup" { insmod ext2 search --no-floppy --fs-uuid --set=root 0641378e-...