Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

3
votes
1answer
3k views

How to ensure that anonymous FTP has been disabled on a Solaris 10 system?

What line in which configuration files in the /etc/ftpd directory do I have to check to ensure that anonymous FTP has been disabled? From my understanding now, to ensure that anonymous FTP is ...
1
vote
0answers
92 views

Running Tomcat MySQL and Apache under a group

I am trying to set up a web server at home using Ubuntu, but prefer my bash scripts to be platform agnostic hence why I am asking here. I also dislike apt-get everything. I am trying to create a ...
5
votes
2answers
399 views

What does “Do you expect to run the X Windows System?” do when installing OpenBSD?

When installing OpenBSD 5.1, I got the question: Do you expect to run the X Windows System? What change does the installer make to my system if I say "yes"? I know what X Windows is, but I don't ...
2
votes
1answer
345 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
5
votes
2answers
870 views

How to disable login for an user?

My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be ...
5
votes
3answers
288 views

Are sudo and gksudo safe?

I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes). Now let's ...
3
votes
1answer
1k views

How to disable remote access on a linux distribution?

So I've read in Mark Sobell's book on Linux, that Linux by default is open to remote administration. Now seen as I'm running a Fedora 17, on a laptop I never have to administrate anything on remotely, ...
5
votes
1answer
721 views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...
3
votes
2answers
352 views

why slight delay after failed login in tty [duplicate]

Possible Duplicate: Why a wrong password gives a big delay Whenever I mistype my password when logging in in a tty, I have noticed that I have to wait for a second before I'm able to log in ...
8
votes
1answer
206 views

How to use /etc/fbtab in OpenBSD to secure X11?

OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X." How might one do this? What lines when added to /etc/fbtab would ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
3
votes
1answer
486 views

Why is it a bad idea to run as root? [duplicate]

Possible Duplicate: Concern about logging in as root overrated? I often hear that it's a bad idea to use root for general use. Why is this a bad idea?
2
votes
1answer
235 views

Security drawbacks of disabling tty password check

I found that, in /etc/inittab, this modification (-a username) for the user u disables the login/password check for all tty:s: 1:2345:respawn:/sbin/getty -a u 38400 tty1 2:23:respawn:/sbin/getty -a u ...
1
vote
1answer
290 views

For an init.d startup script, what is the ideal user to use as the owner of that process

Everyone says that running processes as root is bad, since it defeats the security and privileges model. But what user should be used to run a startup process? Is it really necessary to create a new ...
5
votes
1answer
691 views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
0
votes
1answer
78 views

What to make of system scans reported by psad

My system logs show that psad detects scans like this every minute. psad: scan detected: 192.168.1.10 -> 192.168.1.1 udp: [53] udp pkts: 2 DL: 2 If the first address is mine, and the second ...
5
votes
1answer
187 views

OpenBSD and limiting login to local only like in FreeBSD's login.access(5)

I am using OpenBSD as my desktop. I don't want to login to my machine remotely, and I don't want anyone else to login remotely. In FreeBSD there is a file called login.access(5) that can be used to ...
0
votes
3answers
154 views

Is it possible to have malware software in Linux without executing untrusted applications?

I'm linux user and I'm thinking about it's vulnerabilities to malware. Can I get any malware if I run only trusted applications from distro's repository?
1
vote
2answers
432 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
1
vote
0answers
1k views

Symbolic link to a socket

From a security point of view, is it safe to create a symbolic link to a socket file? The following bits of context refer to the deployment of a web application on a shared hosting service. $ ls -al ...
5
votes
3answers
301 views

Effectivity of shred on different file systems

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
4
votes
2answers
324 views

Shredding everything: files/folders and corresponding filenames

Using find, it is easy to shred a directory's contents recursively (as discussed in this question). However, sometimes the filenames on their own carry sensitive information already. Is there a way to ...
2
votes
2answers
848 views

Chroot Risks w/ /dev and /proc

I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into ...
2
votes
1answer
211 views

How do I ensure outbound TCP/IP traffic always uses a VPN, even when using Wifi?

I'd like to ensure that my VPN is started and running, before any TCP traffic from any of my background services send or receive data. How can I guarantee that this is the case? How do I handle ...
0
votes
2answers
1k views

What does “0” mean in the owner and group permission lists of a file/folder?

The question is in the title. What does the number 0 signify?
6
votes
1answer
671 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
0
votes
1answer
181 views

How to use linux tools to verify a site's authenticity

When I go to certain websites where it's important for me to know that I'm connected securely, certain browsers will say that the site failed the authenticity check. Firefox won't say anything, but ...
1
vote
1answer
1k views

SSL handshake failure with Shibboleth [closed]

I am using Shibboleth for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
2
votes
2answers
189 views

How to securely export a device (HDD)?

So I have a Scientific Linux 6.3 (RHEL clone so basically the question is Redhat related) machine called "B" (with an extra "A" HDD besides the system HDD) and a notebook with SL 6.3. They are in a ...
3
votes
3answers
111 views

Stop user being able to access live CD environment or recovery mode?

I'm haved created an account on ubuntu that is just a standard user but with no internet access. I have also removed 'recovery mode' from the grub menu so that one cannot just choose this option ...
2
votes
1answer
171 views

Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?

By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
2
votes
1answer
924 views

su-to-root fails when root user locked?

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account? Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
1
vote
1answer
573 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
4
votes
1answer
117 views

Can I force myself to enter a password when run certain processes?

I frequently work in an environment where, lets call them "pranksters" may gain access to my console. I am diligent in locking my screen whenever I walk away, but given enough time someone gets the ...
9
votes
3answers
449 views

Physically break into box? (Memory & disk)

I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it ...
1
vote
1answer
1k views

Safety of SMB versus SFTP

I have a server with OpenSSH enabled. I use it to make distant backups. I mainly use rsync over SSH and SFTP. I understood that these protocols are quite safe. I am interested in enabling Samba share ...
3
votes
3answers
438 views

Prevent users from killing processes that they own

I have started some processes (window based) from user's .bashrc file. I want to prevent users from killing those processes. Is there a way to transfer the process to superuser so that a normal user ...
4
votes
1answer
386 views

In my secure log there is a new group added that Im unsure about after adding semanage

I installed semanage onto my CentOS 6.2 box and I was going through my secure log after the install and noticed this entry: Aug 31 22:12:17 xxxx groupadd[12929]: group added to /etc/group: ...
3
votes
1answer
2k views

Can I automate mounting a cifs share without storing my password in plaintext?

I currently use a script which contains commands along the lines of sudo /sbin/mount.cifs $SERVER_SHARE $MOUNT -o username=$DOMAIN_$USER,uid=$USER,gid=$USER,file_mode=0664,dir_mode=0775 to mount my ...
2
votes
1answer
682 views

Is it *really* possible to directly steal a private key if it uses no passphrase?

I've read in various places, such as in this question that using an ssh key pair without a passphrase allows attackers to steal your private key if they gain access to your account. I assumed that by ...
7
votes
1answer
4k views

Is there a way to deactivate Buffer overflow protection on my machine?

I want to do some experiments with buffer overflows on my various virtual machines, including (but not limited to) Debian 6, Ubuntu 12.04, Fedora 16, but every time I try to execute the buffer ...
2
votes
4answers
3k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
11
votes
7answers
3k views

When does the Puppy linux security model make sense?

I have just spent a few hours playing with Puppy linux, which has some very nice features, but there are some things about its approach to security (at least the default settings) that worry me: It ...
8
votes
5answers
1k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
1
vote
1answer
656 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
2
votes
2answers
141 views

SSH encryption security

If I log in to my server through ssh and copy files to my local computer can I be eavesdropped? How do I make sure nobody can intercept the data or even know what I am copying? Are there levels of ...
3
votes
2answers
332 views

Prevent hacking the grub.conf using a 'live rescue' from a live linux iso

It happened that I had set the grub password in grub.conf. But, using a live linux iso, I was able to delete the password from the grub.conf. Please read the steps for the same mentioned in this link: ...
7
votes
1answer
193 views

Is it normal to have a file called “shadow-” in the /etc directory?

I am noticing a lot of weird files appearing in my router and on my various filesystems. Files in weird places or files that have to do with security with a - sign after them. If I do ls -l ...
4
votes
1answer
1k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
3
votes
2answers
786 views

Is it possible for a CentOS system on EC2 to not have a bootloader?

I'm attempting to look for grub: [root /]# find / -iname "*grub*" /sbin/grubby /usr/share/man/man8/grubby.8.gz /usr/share/vim/vim70/syntax/grub.vim /usr/share/vim/vim70/ftplugin/grub.vim ...