Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

11
votes
3answers
605 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
6
votes
6answers
185 views

Allow regular users to SSH using a private key they cannot read

Let's say I have a set of machines (called here the customers' machines) that only a small list of people (called the support staff) is allowed to SSH into, using only one account by machine (the ...
4
votes
2answers
248 views

How to check a Linux Distro is secure and has no malicious code? [on hold]

I am new to Linux and I love it. However, while I have been playing around with several flavours of Linux, only one question comes into my mind as a new user to the Linux systems: how can I ensure a ...
1
vote
2answers
14 views

How to assure that NIS home directories are private?

I am wondering what options are for using centralized authentication and access to user home directories from any Linux machine while keeping the privacy of the home directories. Now I am facing a ...
2
votes
2answers
230 views

How to force rpm and yum to fail if a GPG signature is missing or cannot otherwise be verified?

How can I force rpm and yum to fail if a GPG signature is missing from a package or otherwise cannot be verified due to a missing key? For the example below, assume the RPM has been signed but the key ...
1
vote
1answer
22 views

OSX: Delete all matching certificates by command-line

Using shell script to delete all matching certificates. I found a list of certificates using: security find-certificate -c "certificatename" -a -Z|grep SHA-1|awk '{ print $NF }' Output is like ...
2
votes
0answers
22 views

Is information security less hard in an open source system? [on hold]

In the excellent article Why Information Security is Hard - An Economic Perspective, Ross Anderson poses that: ... you can make the security critical part of the system small enough that the bugs ...
1
vote
1answer
14 views

Security of zone transfers for bind

When having two public DNS servers that provide NS, A, MX, and CNAME records for your domain (website), is it necessary to encrypt the zone transfer data or is it fine to have the master-to-slave sent ...
2
votes
2answers
533 views

How to update gnome keyring password?

Last weak I updated my password on my laptop. Then every time when I logged in, it would prompt for my old password to open the keyring for network manager. To fix this in a terminal I use rm ...
0
votes
1answer
17 views

Is it safe to run GPG tools in x11?

Given the relative (anyone with my present user permissions can swipe scancodes) ease of keylogging in an x11 environment, should I run GPG tools only in the TTY?
2
votes
0answers
24 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
2answers
55 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
2
votes
2answers
788 views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
2
votes
2answers
795 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
0
votes
2answers
693 views

How to import the official Tor GPG keys?

I am trying to install the latest Tor Browser Bundle on Arch Linux: $ makepkg --syncdeps --install [...] ==> Verifying source file signatures with gpg... tor-browser-linux64-4.0.8_en-US.tar.xz ...
20
votes
4answers
8k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
2
votes
0answers
28 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
2
votes
1answer
54 views

Restrict user script execution

I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players. A player write a bot in Python Upon validation, the code is sent to the server A ...
3
votes
0answers
989 views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user ...
20
votes
4answers
9k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
1
vote
0answers
21 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
2
votes
1answer
39 views

How to use network interface as non-root user on Android? [closed]

I want to communicate between my Android device and my Linux box over IP through the USB network interface mode. I have connected my Android device to my Linux box with and put the Android device ...
4
votes
1answer
53 views

Is it possible to add a password to moving or copying specific files on Linux?

I have a directory setup very nicely(i.e organized with READMEs and easy navigation etc.). I would like people to be able to access the files in this directory maybe even copy them to their own ...
2
votes
1answer
30 views

Wipe a Solaris Disk

Looking for something similar to Eraser for Solaris 9-10-11 Anything?
0
votes
0answers
14 views

Error while building Libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] ...
26
votes
2answers
8k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
1
vote
1answer
905 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
0answers
38 views

What are some basic indicators that your unit (Unix/Linux system) is hacked? What are specific, basic, preventive measures that need to be made? [closed]

This question is separated for three separate systems (Unix/Linux, Windows, Mac/Apple). A link will be posted to redirect here for other systems if this question/post is deemed valid or ...
0
votes
1answer
83 views

Custom Kernel to Disable SATA and USB Devices

I am setting up diskless clients that will run on an internal network. I have disabled SATA and USB ports using a BIOS locked with a password, but this is easy to get around by using the jumper to ...
1
vote
0answers
11 views

Libgcrypt warning: MD5 used - FIPS mode inactivated

Last week I enabled the openSSH FIPS 140-2 module on Server "A", and that system works flawlessly (including tsql queries to a SQL Server instance). I recently enabled the openSSH FIPS 140-2 module ...
2
votes
1answer
46 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
16
votes
2answers
523 views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...
2
votes
0answers
19 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
1
vote
1answer
42 views

How can I lock my screen automatically if internet connection is lost?

I will sometimes remote into my work computer from home using TeamViewer. Obviously I have to unlock the screensaver to use the GUI. When I'm done, I'll lock the screen either from the desktop or via ...
2
votes
2answers
34 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
2
votes
0answers
643 views

Intel Advanced-N 6235 wireless monitor mode problem

As far as I know, iwlwifi drivers (and this particular wireless card) support monitor mode. The only requirement is to install the latest driver from ...
5
votes
1answer
701 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
1
vote
1answer
688 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
2answers
29 views

User verification

Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that ...
3
votes
1answer
35 views

Same salt/hash value in /etc/shadow

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password). How could the system end up like this? Does this mean the password was not ...
2
votes
4answers
4k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
-2
votes
1answer
58 views

Bash Code Injection Vulnerability On Linux

Found a new bug in Linux System, a bash code injection vulnerability. The solution to this is the update the bash package. yum update bash My Question is "do I need to reboot the system"? ...
2
votes
0answers
25 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
3
votes
1answer
2k views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
2
votes
2answers
51 views

How to defend against a Live USB computer hack

A Linux installation can be simply hacked by using a live USB/CD, gaining root access on the live distro, chrooting to the target filesystem and running passwd root. One can use grub too. There may be ...
2
votes
1answer
40 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...
4
votes
1answer
132 views

Unexplained files found in home folder

For background information, I'm running openSUSE 13.2 and KDE 5. Today I found a number of unexplained files and folders in my home folder which state they've been edited 3 days ago. I do not ...
2
votes
2answers
410 views

Hiding an encrypted folder in a shared system without root access (unshare -m)

I'm a graduate student trying to use a cluster at my university. These machines are shared, so I want to protect the source code I use (I signed a NDA, so I'm scared about publishing the code by ...
-1
votes
2answers
31 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
54 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...