Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

-2
votes
2answers
39 views

Can I restrict the root to a single browser?

I want to be able restrict myself to firefox. I do not want to be able to use any other browser. So if I install chrome or any other browser, I don't want them to work on my Linux machine. Here is ...
2
votes
1answer
21 views

Understand HMAC authentication in case of site-to-site OpenVPN tunnel

I have a very simple OpenVPN setup where OpenVPN server is started with openvpn --ifconfig 10.10.10.1 10.10.10.2 --dev tun and client is started with openvpn --ifconfig 10.10.10.2 10.10.10.1 --dev tun ...
46
votes
2answers
1k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
0
votes
1answer
28 views

What changes my boot partition and how to prevent it?

As an another countermeasure against security threats I wrote a little script that computes MBR and boot checksum and then compare it to the old one. As long as the computer is running this is OK, but ...
2
votes
0answers
66 views

Security of sudo not asking for a password after the first time

After using sudo and entering a password to do so, sudo remembers that we have entered a password and we do not have to enter a password the next time we use it. I am concerned about the possibility ...
81
votes
3answers
18k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
2
votes
1answer
92 views

Exploit FOUND with clamav on Fedora 21 in Oracle's java

I'm scanning one of my systems with Clamav like this: $ clamscan -r -i --remove --max-filesize=4000M --max-scansize=4000M \ --exclude=/proc --exclude=/sys --exclude=/dev ...
0
votes
1answer
63 views

How can I study Linux, in and out? [closed]

My team and I will soon begin studying and practicing for the nation-wide Cyber Patriot program. As I'm famed for being our "Linux guy", I would really like to improve my knowledge on the subject. ...
1
vote
1answer
30 views

Where to verify and review various packages before installing them

I am new to Unix/Linux and corrently setting up a Debian Wheezy server for my domain name. Here and there I find useful tutorial on how to do this-and-that, but I am not sure where I can find a ...
4
votes
2answers
108 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
0
votes
1answer
44 views

UNIX Account management

Would like to know if there's some opensource solution aimed to manage and administer system authentication and RSA keys for staff, contractors and clients across the organization. My systems to ...
2
votes
1answer
45 views

How to scan a directory with a space in its name with maldet

I'm trying to scan some directories with Linux Malware Detect (command-line command maldet): maldet -a /SOMETHING\ 1/ But I get: maldet(13857): {scan} invalid path /SOMETHING 1/ I've tried ...
2
votes
2answers
528 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
2
votes
2answers
872 views

AIX 6.1 — Without root can I get the last failed login for a user i have access to?

I know the information is in the security files but I don't have access and it's more work then I want to do to go to our Unix admins to get the information (everytime the account gets locked which is ...
1
vote
1answer
809 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
3
votes
3answers
91 views

Remove passphrase from private key and set specific file mode

If I set a passphrase on my private key like so: openssl rsa -des -in insecure.key -out secure.key and I remove the passphrase like so: openssl rsa -in secure.key -out insecure.key then my ...
1
vote
1answer
54 views

wheel groups and permissions

I'm new to a lot of things Linux, so this might be basic stuff. We're thinking about setting up a wheel group and removing permissions from root. Not even sure that's possible. We are having a ...
1
vote
1answer
374 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
0
votes
1answer
25 views

Sanitise bash arguments

I have a script which takes user input and does a lot of things. One thing which I am worried about is it takes a file name and removes that file. e.g. rm -rf $arg1. A user could technically input / ...
5
votes
1answer
112 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
4
votes
1answer
93 views

SSH server listening on multiple ports with passwordless access not allowing connections to second port

I have my Synology NAS running an SSH server listening on the default port 22 and I set up passwordless authentication with a public/private key and a passphrase: From sshd_config: ...
5
votes
2answers
427 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
0
votes
1answer
82 views

How to import the official Tor GPG keys?

I am trying to install the latest Tor Browser Bundle on Arch Linux: $ makepkg --syncdeps --install [...] ==> Verifying source file signatures with gpg... tor-browser-linux64-4.0.8_en-US.tar.xz ...
1
vote
1answer
22 views

LDAP Force Password Change Through HTTPS

We have a "master" server running Suse Enterprise with LDAP that controls user's access to our systems. We want to implement a 90 day expiration policy, but the issue is that most of our servers are ...
0
votes
0answers
22 views

Bro-IDS CSV conversion

I have Bro-IDS currently operating under Centos 7. I need to convert the output to CSV format. The documentation that I have seen on this is not clear to me. Has anyone done this successfully? I have ...
1
vote
2answers
27 views

How do I install programs in /usr/local if they shouldn't be compiled by root?

Somewhere in the back of my brain is the memory of reading a cautionary internet voice warning against compiling (i.e. running make) as the root user. Perhaps it's something like this story ...
1
vote
1answer
70 views

Dubious entry in logwatch

Today I found the following in the daily logwatch of my debian server: --------------------- Connections (secure-log) Begin ------------------------ **Unmatched Entries** sg: user 'root' (login ...
0
votes
0answers
17 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
0answers
8 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...
62
votes
20answers
9k views

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a ...
0
votes
2answers
38 views

FreeBSD 10 and ZFS: Methods for encrypting files

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver. I'm really new to FreeBSD in general (coming from Debian Linux). I installed the system choosing ZFS with encrypted root volume ...
4
votes
2answers
3k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
0
votes
2answers
59 views

SSH authenticity couldn't be established

Last night I SSH'ed to different systems.... one system/SSH reported that the "authenticity of HOSTNAME couldn't be established......." and it asks if I want to continue or something, I didn't and ...
7
votes
3answers
11k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
2
votes
1answer
33 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
3
votes
1answer
134 views

CUPS and printer security

I would like some help on securing a networked printer. Specifically, I'm interested in the following: Preventing unauthorized access to the printer: I would like only certain laptops that connect ...
2
votes
2answers
46 views

Encrypted FileSystem in VirtualBox

I'm looking for any information regarding how secure an encrypted Linux file system is when contained in a VirtualBox virtual drive on a Windows host? Specifically I'm looking for answers to the ...
2
votes
0answers
7 views

Tails OS:Network Filtering Syntax to Allow I2PBrowser to listen at localhost:6666, Then Allow TorBrowser User to Connect to it

I've had a bit of experience in Linux, but I'm still learning and brand new. I've been able to proxy Tor right into I2P on a normal Debian Wheezy installation successfully. My process involves ...
9
votes
0answers
70 views

D-Bus authentication and authorization

I'm trying to set up remote access to D-Bus, and I don't understand how authentication and authorization are (not) working. I have a D-Bus server listening on an abstract socket. $ echo ...
5
votes
1answer
501 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
0
votes
1answer
79 views

Is my server being used as a proxy or malicious requests?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and am unfamiliar with the security and server side of my project. This is my first time ...
0
votes
1answer
29 views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
17
votes
3answers
8k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
2
votes
1answer
23 views

NOEXEC and RESTRICT in sudoers

I understand the script below has a serious problem, and NOEXEC and RESTRICT are not enough as a solution to this. user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf However, I still have some ...
74
votes
6answers
44k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
0
votes
0answers
52 views

Is my webcam driver being used to hack my computer?

I'm seeing this in the journal: Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (II) Using input driver 'evdev' for 'TOSHIBA Web Camera' Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (**) TOSHIBA Web Camera: ...
5
votes
2answers
419 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
2
votes
2answers
443 views

RHEL 7 (CentOS 7) security / ssh / sshd_config advise requested

I am not a sysadmin and try to create a more or less secure web server (LAMP based CentOS 7). I read several tutorials about setup an initial CentOS 7 droplet and got everything running fine. ...
6
votes
1answer
3k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
1
vote
1answer
36 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...