Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
26 views

Install ModSecurity Commercial Rules

We bought the ModSecurity commercial rules, but I am not having success installing them. I tried using the ModSecurity dashboard, but it seems that it is not working. Even though I get a message ...
6
votes
1answer
13k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
1
vote
0answers
23 views

How to prevent the latest ImageMagick vulnerability? [migrated]

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
-1
votes
1answer
19 views

AIX : /etc/security/limits file Parameters

Can anybody please explain about following parameters found /etc/security/limits file default: fsize = 2097151 core = 2097151 cpu = -1 data = 262144 rss = 65536 stack = 65536 ...
79
votes
2answers
3k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
3
votes
4answers
6k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
0
votes
1answer
33 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
3
votes
1answer
17 views

Where can users' personal data be?

I want to secure my data on a multi-user system, so ful-system encryption is not an option. I encrypted /home/me with ecryptfs, the swap with cryptsetup. But I read that the applications can ...
1
vote
1answer
26 views

How to install Software in redhat 7.2 using downloaded rpm?

Take MariaDB for an example. Package management tools like yum is good solution to install software and handle the dependencies issue for you. But in a primitive situation, without internet access, ...
3
votes
1answer
25 views

How can I specify a system wide proxy without giving my password in plaintext?

I must use a proxy for all internet traffic, I currently have it specified like this in /etc/environment : http_proxy=http://jsj:plaintext_password_yikes@proxy.whereiwork.com:8080 ...
3
votes
1answer
17 views

White-list certain binaries and scripts inside a noexec/nosuid mount?

Just like the question. Is it possible to white-list certain executables from a noexec mounted FS? for instance, mine looks like this: /dev/vg/lv on /tmp type ext4 (rw,noexec,nosuid)
3
votes
3answers
53 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
1
vote
2answers
997 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
0
votes
2answers
493 views

Trying to use TLS SMTP against Exim, getting Security Error back; what's wrong?

OS: FreeBSD9 64 Bit MTA: EXIM4 with TLS with Self Signed Certificate. I am using telnet myserver.com 25 EHLO dummy@dummy.com STARTTLS It says TLS go ahead And then I issue MSG FROM: ...
2
votes
1answer
148 views

How to scan a directory with a space in its name with maldet

I'm trying to scan some directories with Linux Malware Detect (command-line command maldet): maldet -a /SOMETHING\ 1/ But I get: maldet(13857): {scan} invalid path /SOMETHING 1/ I've tried ...
11
votes
4answers
5k views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA revelations and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I ...
1
vote
1answer
837 views

Using Metasploit with 3G USB modem

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host ...
70
votes
8answers
75k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
66
votes
2answers
8k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
0
votes
0answers
32 views

Only allow port 80 access to VPN users

I have setup a OpenVPN server thanks to Docker (and this tuto: https://www.digitalocean.com/community/tutorials/how-to-run-openvpn-in-a-docker-container-on-ubuntu-14-04). What I want now is to allow ...
2
votes
2answers
31 views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ...
1
vote
1answer
47 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
1
vote
1answer
15 views

dconf fails when running X application from alternate user

In an effort to protect my personal files in my home directory, I am trying to run certain applications as an alternate user, but under the same graphical environment. I have enabled X permissions by ...
3
votes
2answers
373 views

Does the stable version of Debian contain a vulnerable version of wpa_supplicant?

I'm on Debian jessie the stable release. I noticed that version of wpa_supplicant is vulnerable to DoS attacks according to CVE-2015-8041: Multiple integer overflows in the NDEF record parser in ...
2
votes
1answer
19 views

Can module loading be globally disabled on modern Linux kernels?

Once upon a time (before kernel 2.6.25), one could use /proc/sys/kernel/cap-bound to drop CAP_SYS_MODULE system-wide, and be assured that the set of code that was presently loaded into kernel space ...
21
votes
5answers
12k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
1
vote
1answer
920 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
0answers
14 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
2answers
25 views

RAID1 vs rsync - security?

I'm setting up a NAS-Server using an Odroid XU4 and two 2TB HDDs. Which setup would be more secure (lower risk of losing data / easier recovery): setup a RAID1 with mdadm have two separate devices, ...
-1
votes
0answers
33 views

I busted my ssl.conf file and when I do a recovery I can't overwrite the file with new settings

So, I thought I would be super smart and figure out how to disable the older SSL v2 and v3 on the web server. Turns out I messed something up. So, I tried to open the file and then make the changes, ...
5
votes
6answers
705 views

What is the threat of a user trying to sudo without permission?

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing ...
27
votes
3answers
2k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
2
votes
1answer
256 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
4
votes
1answer
46 views

Encrypt files (private key, etc.) in an embedded system

I am working on an embedded device running on Linux. This device communicates with a server and sends data to it using a certificate and a private key. When we distribute the device, I am afraid that ...
5
votes
2answers
63 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
5
votes
1answer
1k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
40
votes
7answers
23k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
2answers
39 views

Should I create should my own user with less privileges on a server (Digit. Ocean)?

I'm trying to deploy a website at Digital Ocean. I have the user root as the default. However, since it's root I believe I should create my own, normal user, shouldn't I? Nonetheless, in the ...
5
votes
3answers
7k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
0
votes
1answer
2k views

What is the security impact of not using tls-remote with OpenVPN

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like ...
0
votes
0answers
32 views

How to add security (802-1x.eap) with nmcli

I've done nmcli con add type ethernet con-name SOMENAME ifname enp5 now how do I add security to it using nmcli(as if you had hit the on button in the gui.) so that I can than go and edit the ...
2
votes
1answer
29 views

Securing X window displays

I want to install X on a system I'm in charge of. I plan on running it with local connections only, e.g. with startx -- -nolisten tcp (which I understand is the default these days). Some relatively ...
-5
votes
2answers
41 views

How can I encrypt a file with dm-crypt? [closed]

I've never encrypted files in my Linux distribution. Now I need to do that. I'm on Arch. I went to the documentation, it says that support of TrueCrypt is discontinued and after examining other ...
2
votes
1answer
90 views

Replace Firewalld with system-config-firewall-tui on CentOS 7

I have a question regarding firewall config on CentOS 7. What I have done Disabled firewalld with systemctl stop firewalld.service Installed and configured system-config-firewall-tui Tested my ...
0
votes
1answer
52 views

limit user to only a single command: “su -”

I have setup a web server that hosts a Play! Framework application, the server is an Amazon Linux EC2. If you are not familiar with Amazon Linux, by default there is a root user and an ec2-user with ...
1
vote
2answers
24 views

Is it bad practice to call scripts from a users home dir from root tasks (eg. dhcp hooks)? [closed]

I have some small script that run at startup and on other events (for example, one that updates a dynamic dns hostname based on the machines IP changing). I would like to keep everything in my home ...
0
votes
2answers
30 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
51
votes
5answers
43k views

What is the point of sshd “UseDNS” option?

I know what it does, but i don't know why. What attack(s) does it prevent ? Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
21
votes
3answers
62k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
1
vote
2answers
45 views

Is it safe to set a cron job for apt-get upgrade? [closed]

Is it a good idea to create a cron job for apt-get update; apt-get upgrade for my webserver? So not apt-get dist-upgrade.