Content related to computer security.

learn more… | top users | synonyms

0
votes
2answers
35 views

reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
1
vote
1answer
36 views

How can I tell why I have permissions to read a file? [on hold]

Here's what I just noticed on my CentOS SSH account: stat output $ stat /dev/kvm File: `/dev/kvm' Size: 0 Blocks: 0 IO Block: 4096 character special file Device: ...
1
vote
0answers
7 views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at ...
2
votes
1answer
20 views

setup sudoers to mount network shares and loop devices and misc

I would like to setup sudoers to grant users to mount all kind of network shares and loop devices to their home directory. Here is a try that I found and changed a bit on one old post in ...
3
votes
2answers
119 views

How to implement logwatch functionality on top of systemd journal?

Logwatch scans logfiles with regular intervals, collects errors and stuff, then mails it to the admin. This was back in syslog and logfiles days. What's the corresponding solution for systemd's ...
8
votes
3answers
5k views

How can I track who SSH'es into my linux machine?

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
3
votes
3answers
41 views

Monitor all login attempts

Few weeks ago I thought it would be a good idea to write a script to send me an email whenever some user logs in into my server. So I came with a perfectly working script notifyLogin.sh, then I ...
5
votes
2answers
577 views

Setting ulimit correctly for PHP on Linux

I have /etc/security/limits.conf set to the following: nobody soft nofile 409600 nobody hard nofile 1024000 phpuser soft nofile 409600 phpuser hard nofile 1024000 httpd soft nofile 409600 httpd hard ...
1
vote
2answers
66 views

Shell Script - how to scp into remote server and download files and protect password

I have a remote server that I need to download Apache logs from. I can manually scp into the server and get the files, but I'd like to put this in crontab. The only way to automate it is to include ...
5
votes
2answers
126 views

Why ssh-agent group ownership is not root

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? ...
4
votes
1answer
88 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
-1
votes
0answers
16 views

Maximum security unix distro [closed]

Are there any major differences between Qubes and Tails? (other than using VM for applications by qubes) Which distribution (not limited to these two) would you consider as most secure, and why?
3
votes
1answer
275 views

Is there any DLP solution for linux?

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
1
vote
1answer
28 views

SSH slow after configuring TCP Wrappers

We have SSH open on one of our production servers leaving it prone to various brute force attacks to break in. I reduced the attempts by changing the default port from 22. I want to further harden ...
13
votes
6answers
11k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
2
votes
1answer
27 views

Why isn't 'nethogs' installed with the setuid bit set?

I've been using nethogs for a while now, having to sudo every time, while ping has the setuid bit set. Today I set it for nethogs and it works: $ ls -l $(which nethogs) $(which ping) -rwxr-xr-x 1 ...
3
votes
2answers
29 views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
4
votes
1answer
36 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
1
vote
0answers
58 views

Limit program execution to a list of arguments

I would like that my Unix users can only run a specific command insecurecommand with a controlled list of arguments stored in a file. The only solution I have found at this time is to : Create a ...
3
votes
1answer
35 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
3
votes
3answers
233 views

What are the world writable directories by default?

In a standard Linux filesystem, which of these common directories are world-writable by default? /tmp /etc /var /proc /bin /boot /.... .... Why are they world-writable? Does that pose ...
5
votes
0answers
42 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data?

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
1
vote
1answer
352 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
2answers
31 views

Permissions under a 700 (rwx------) directory

If a directory /foo/bar/baz has 700 (rwx------) for its permissions, thereby making it inaccessible to all but its owner (and the superuser), does it matter what the "group" and "other" permissions ...
2
votes
1answer
19 views

Credential in PPD file: Is there a way to hide it?

We have a copying machine that can be used as a printer. In order to do that, I have to provide a credential in plain in the Xerox.ppd file. Problem: Any user on the system can grep credential ...
1
vote
0answers
18 views

apache mod_security and performance

I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks. The number of bots is huge, so ...
3
votes
1answer
53 views

Monitoring filesystem activity

Say, I have a program, and I want to monitor its filesystem activity (what files/directories are created/modified/deleted etc.) This program may be capable of spawning further processes, and thus, I ...
1
vote
2answers
67 views

Why are custom programs always installed in /opt, /srv, /usr/local, etc. and not in ~/ (home) folder?

The LTS repo is pretty good, but for some reason I prefer the "build from source" method for some programs. One reason is that I get the preferred version (PHP on LTS is on 5.3, whereas I can compile ...
1
vote
1answer
64 views

Heartbleed Bug, which OpenSSL services are vulnerable to the leak?

I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL). Before I get started patching, I'd like to have a ...
6
votes
3answers
145 views

Force Firefox to remember passwords on particular sites

Usually, when I log into a website with username and password, Firefox asks whether it should remember the login details. When I click yes, next time I visit the website, the username and password ...
1
vote
1answer
611 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
0answers
20 views

Secure Remote Backups Using Duplicity

The recent take-down of codespaces got me thinking about off-site backup processes (which I currently perform manually with password entry). I have been reading tutorials showing how to automate ...
0
votes
1answer
31 views

Is validation of CN/Hostname verification against SSL certificate required in openssl & why? [closed]

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement?
1
vote
1answer
698 views

SSL handshake failure with Shibboleth

I am using Shibboleth for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
8
votes
4answers
5k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
7
votes
2answers
490 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
4
votes
1answer
58 views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...
1
vote
1answer
481 views

How can I use Skype with lxc?

Under Scientific-linux? https://en.wikipedia.org/wiki/LXC I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
1
vote
2answers
55 views

Is it bad to select remember me option in the browsers of a compromised machine?

I was reading an article on how to sniff network packets. (of course for knowledge purposes only). I came across these particular lines. For instance, say I was sniffing traffic on the network, ...
1
vote
1answer
27 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting ...
4
votes
3answers
364 views

Something like pwgen-win for linux?

Is there some kind of pwd generator for Linux that has a nice GUI and options like this one for Windows? I know that there is pwgen, but as far as I know it does not support mouse/keyboard entropy and ...
8
votes
2answers
7k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
13
votes
4answers
395 views

Books/Guides for Securing a Server [closed]

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). The problem is that I'm ...
0
votes
2answers
67 views

how to nsupdate remotely?

I have BIND as a DNS server, what I want is to let this server to allow me to add or remove records to a zone without manually editing the zone file and I want to do this remotely. Is this updating ...
0
votes
0answers
23 views

hydra verification before stopping

I am getting false positives when I try a penetration test on my local service with hydra: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post ...
0
votes
1answer
237 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf ...
1
vote
2answers
54 views

Secure wipe (scrub) filesystem of VPS from VPS itself

I have a VPS I'm planning to delete. This particular cloud provider makes no guarantee that the data on the drive will be wiped before giving the disk to the next person. What's a best effort attempt ...
1
vote
2answers
142 views

gvfs-mount auto password

I would like to make shortcuts for gvfs mounts (I prefer to mount from the shell). For this, it is quite necessary/convenient not to have to enter the password for the ftp:// and sftp:// connections . ...
0
votes
1answer
31 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
1
vote
2answers
33 views

List of files accessed by application

I want to install propertiary AMD driver but I would also like to know which files were created/changed by installer. Is there some application which can observe (probably by inotify) which files were ...