Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

11
votes
4answers
10k views

What are the world writable directories by default?

In a standard Linux filesystem, which of these common directories are world-writable by default? /tmp /etc /var /proc /bin /boot /.... .... Why are they world-writable? Does that pose ...
0
votes
0answers
36 views

How can we verify the Debian software and the download mirrors which provide it are safe? [on hold]

How can we verify or test if the Debian software and the download mirrors which provide it are secure, safe, and unmodified? Related: How is the authenticity of Debian packages guaranteed?
1
vote
1answer
39 views

How is the authenticity of Debian packages guaranteed?

What security systems and processes are in place to prevent malicious third parties from hacking/compromising the security of code in the Debian mirrors, or to verify that the packages we get are in ...
0
votes
0answers
28 views

Debian/Security: From an information security standpoint, what are the biggest vulnerabilities in the Debian/Linux software chain? [on hold]

This question is part of a three-question series: How Secure is the Debian package/server system? (Part: 3 of 3) Main theme Main question: How secure is the Debian package management/mirror system? ...
-1
votes
0answers
16 views

Hardening our existing Linux (Debian) system [on hold]

we are trying to implement some level of security to existing to our existing Linux system. Listed the are the requirement that has been gathered, 1. Application white listing 2. File integrity ...
1
vote
3answers
37 views

Does it make sudo more secure when indexing all commands by their SHA-2 checksums?

I'm asking myself whether system security substantially increases when I generate a security policy, i.e. sudoers file which contains one or more Cmnd_Alias definitions that enumerate all executable ...
0
votes
1answer
19 views

Add a second authentication to user log in

trap '' 2 code=`oathtool --base32 --totp "xxxxxxxxxxxx"` echo -n Enter Code: read -s password echo "" if [ "$password" == "$code" ]; then echo "You are allowed in" else exit fi trap ...
0
votes
1answer
22 views

Suspicious traffic in nethogs on fresh install

Earlier today google said that unusual traffic was emanating from my computer and gave me a captcha. I got curious and installed nethogs. Everything appears normal except for an unknown program ...
3
votes
0answers
52 views

Exploit in bash script parameter possible?

I want to pass an e-mail address from a web form to a bash script. I'm using the following regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}/ Is this sufficient? Or could one embed an ...
5
votes
2answers
1k views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
0
votes
1answer
26 views

2 factor login for gui and ssh imposes verification for sudo use

tldr: how can I make it so I don't have to use a verification code to sudo? Hello, I followed this guide on how to setup 2 factor login for my debian install. I have it so when you try to login ...
1
vote
1answer
932 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
24
votes
6answers
30k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
8
votes
2answers
195 views

Why is the ability to define functions in an environmental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
4
votes
1answer
3k views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...
1
vote
0answers
30 views

pam su authentication with RSA token [closed]

We are implementing RSA token authentication in our company and management decide su - should ask for RSA token passcode for individual (listed users) user. So no-one is going to get root password: ...
2
votes
2answers
24 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
13
votes
2answers
2k views

How to safely pass variables to root-enabled scripts?

This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
0
votes
0answers
6 views

openvassd hanging

I have a problem with openvassd hanging while starting: connect(6, {sa_family=AF_LOCAL, sun_path="/tmp/redis.sock"}, 110) = 0 fcntl64(6, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) ...
-4
votes
0answers
33 views

Do you really need antivirus software for Linux desktops? [closed]

Recently i got free antivirus for Linux from Comodo. But right now i don't install my desktop & laptop. Really antivirus software required for Linux desktops / Laptop.
0
votes
0answers
12 views

Greenbone/OpenVAS not starting tasks after reboot

I have Greenbone and OpenVAS installed on a Fedora machine. Configuration was OK and everything was working fine. After a reboot every attempt to start a task results in the browser waiting forever ...
5
votes
1answer
1k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
0
votes
1answer
34 views

Are NetBSD provide digital signatures for official ISO images and binary packages?

I just install NetBSD in from ISO image inside VirtualBox. Official source ISO media contains only MD5/SHA512 sums. Similarly pkg_add binary packag repository contains only SHA512 sums. Both FTP ...
3
votes
1answer
29 views

How to limit connections to OpenSSH server to using private keys necessarily with passphrase?

Is there any way to configure OpenSSH (/etc/ssh/sshd_config) server to allow private keys necessarily with passphrase?
3
votes
1answer
35 views

groupadd -p Not Recommended?

I have a question about groupadd, specifically with password (-p). It says it is not recommended, "This option is not recommended because the password (or encrypted password) will be visible by users ...
1
vote
2answers
49 views

Safe execution of cat command without executing arbitrary code

I do this little file based on a combination of hexadecimal, that can broke cat and the terminal showing the file with cat, reset does not worked anymore, it is maybe putting cat in a kind of loop? ...
1
vote
1answer
20 views

linux periodic system check script or utility [duplicate]

Is there any commonly used shell script or utility to periodically check Linux file systems for changes, such as permission or ownership changes of configuration files. I am thinking of something ...
1
vote
1answer
29 views

Is there an additional option to display hidden command on the terminal?

Copy and pasting from a website to the terminal is very harmful , there are an example here You past the following line :ls /some/thing/much/too/long/to/type/ , by pressing Enter the following ...
1
vote
1answer
31 views

Install ModSecurity Commercial Rules

We bought the ModSecurity commercial rules, but I am not having success installing them. I tried using the ModSecurity dashboard, but it seems that it is not working. Even though I get a message ...
0
votes
1answer
227 views

How can I configure my server to avoid information leakage from the SERVER header of its HTTP response

I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out ...
0
votes
0answers
95 views

security2_module module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
1
vote
1answer
12 views

Standard Package updates of selinux-policy-*

I am wondering if after installing an update of a selinux-policy-* package you are using, do you need to reset all the labels in the system (i.e. fixfiles onboot) in order to keep the policy ...
4
votes
1answer
80 views

Executing commands in an elevated bash process by writing to the standard input of its parent script process

I have a simple bash script bash.sh that starts another bash instance using pkexec. #!/bin/bash bash -c 'pkexec bash' When executed this shows a prompt for the user to enter their password. The ...
4
votes
2answers
2k views

Disadvantages to having www-data able to log in

I run a tiny web server basically just for hosting small data projects and files. This server has a public IP address. I would like to be able to FTP in and upload files directly to /var/www/*, and ...
4
votes
2answers
1k views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
4
votes
1answer
2k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
0
votes
0answers
45 views

Can we run apache on a non-root account?

Apache is started by the root user, then switches to the user defined by the User directive; is there any chance where we can change this default behavior? Apache should start using a non-root account ...
0
votes
1answer
2k views

What is the security impact of not using tls-remote with OpenVPN

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like ...
7
votes
1answer
959 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
31
votes
2answers
88k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
40
votes
7answers
23k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
2answers
29 views

Why should not I update to most recent kernel immediately after release [closed]

Question intended for system administrators. Consider system running a old but working kernel and all the required functionality is available. (Ubuntu 12.04 LTS specifically with kernel 3.2) Then a ...
0
votes
1answer
293 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...
2
votes
1answer
998 views

httpd 2.4.10 in CentOS 7

How can I update my httpd version 2.4.6 to 2.4.10? If I try to update it with yum, it says that I have the latest version. I want to update httpd to 2.4.10 version because a security issue of the ...
25
votes
6answers
4k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim ...
2
votes
2answers
82 views

Malicious processes open connections to China

I recently started migrating some of my company's servers to Google's compute engine. Among other things I set up a 2-node elasticsearch cluster. Today I run top command on one of the nodes and I ...
83
votes
2answers
3k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
3
votes
7answers
5k views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
1
vote
2answers
33 views

History -c, where all the erased histories have been saved and in which directories though?

Usually, when i used (root@example ~ # history )and it displayed a lot of commands which had been entered before. So, my question is : when i enter "history -c" is to delete all the history at the ...
6
votes
1answer
13k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...