Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
0answers
482 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
2
votes
2answers
2k views

wpa_passphrase must be 8..63 characters

I'd like to connect to wireless network via command line in Linux. When doing it I've stuck with this issue: $ wpa_passphrase NETWORK_SSID NETWORK_PASSWORD Passphrase must be 8..63 characters The ...
1
vote
1answer
412 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
4
votes
1answer
173 views

Where are passwords stored and how are they encrypted in OS X?

I know that on a Linux system passwords are stored in /etc/shadow and are salted and encrypted using a one way hashing algorithm like MD5, SHA-256 or SHA-512. It looks like there is no /etc/shadow ...
1
vote
2answers
1k views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
7
votes
2answers
603 views

With which user should I run web servers, redis & mongodb?

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web ...
3
votes
1answer
1k views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
7
votes
3answers
1k views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
6
votes
1answer
375 views

Any random password results in successful login on tty

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type... I tried to reset password for ...
1
vote
1answer
102 views

Are there any PaxTest for OpenBSD?

Pax: PaX is a process memory protection patch For FreeBSD, there exists a testsuite called PaxTest, is there a PaxTest available for OpenBSD?
3
votes
0answers
732 views

Is there any DLP solution for linux? [closed]

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
5
votes
3answers
3k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
50
votes
4answers
10k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
0
votes
1answer
498 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf ...
3
votes
2answers
2k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem someUser@1.2.3.4:~/files.tgz . Warning: ...
0
votes
1answer
55 views

Prevent access to files on linux file server

I have a linux system running Debian Wheezy stable on it and am using it as a file repository (not a true file server because I am using BitTorrent sync to move files as I move around the world). Some ...
2
votes
2answers
1k views

How to password-protect a script on Linux?

How do you set a password to execute a command or script in Linux? I need to avoid a script (in which user and password details are included) from being used/executed from unauthorized users. So is ...
-1
votes
1answer
949 views

SSH key based login bypasses password policies

I noticed that logins via an SSH key bypass the LDAP password policies (password ageing, password warning, and password lockout due to failed attempts, etc). Is there any way to force key-based ssh ...
0
votes
1answer
2k views

Security - Giving Apache write access to /var/www/html

I am running Worpdress on an CentOS Webserver. Now, to enable wordpress to be able to upload/write files to the default webserver directory /var/www/html I had to do the following change on the ...
2
votes
0answers
173 views

Ubuntu : puppet f5 device config : Partition '' doesn't exist

This is a Puppet question that I've posted on the PuppetLabs forums with no response. I'm also posting here because I'm hoping that with a wider audience I might find someone knowledgeable re Puppet ...
0
votes
3answers
256 views

How to hide an OpenBSD 5.3 server as it would be a windows server or something else?

There is an OpenBSD 5.3 server. It only listens on port 443 with an apache (on higher port an sshd listens, but port knocking is used). How can I hide the servers operating system/webserver to be ...
1
vote
1answer
106 views

mount other encrypted volume on wrong password entry

I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine. The problem A possible attacker will ...
5
votes
7answers
514 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
1
vote
1answer
71 views

How do I isolate my file system data from another system root?

I have a linux machine(kubuntu 13.04) A my friend asked me give him an account with being able to use sudo. So, I made an account for him and put the account in /etc/group for him to use sudo I don't ...
-3
votes
1answer
276 views

Break write permission for non root user?

Can non root user edit files he/she doesn't have access to or create new a file in a directory he/she doesn't own? Is there a way to do that? P.S : I know if root user or file owner gives him write ...
9
votes
0answers
4k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
3
votes
1answer
393 views

Is it a bad idea to add myself to the sudo group?

Members of the sudo group in my Debian install can execute anything without entering a password. This is convenient, but seems like a bad idea. NOTE: My computer is an ordinary desktop, not a server ...
5
votes
1answer
334 views

How can I find the Secure Attention Key (SAK) on my system and can I disable it?

In answer to My process was killed but I cannot understand the kernel notice, I was pointed to some documentation on the Secure Attention Key (SAK) on Linux. I have a embedded system generated using ...
2
votes
3answers
605 views

denyhosts is blocking existing users from logging in from unknown (new) IP addresses

I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict. I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config ...
0
votes
1answer
61 views

Random file accesses to server's ip

[Sat Jun 22 13:07:06 2013] [error] [client 208.80.194.26] File does not exist: ...
1
vote
0answers
225 views

Reverse ssh-agent forwarding and unlocking remote keys with your local keys

So the following two things should both be possible to do with ssh the question is just how difficult they would be and I'm hoping someone can give me an easy answer. 1) Suppose I have several ...
4
votes
2answers
10k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
0
votes
1answer
146 views

Is there any tools which can be used to make ports available from any firewall network?

I have been testing my application which has TCP/UDP ports for peer to peer with the help of server signalling commands for making communication, that works when I have Public IP or Lan IP and not ...
2
votes
1answer
3k views

How to execute php file as different user securely?

I want to confirm that my thoughts are correct as this is about security matter. We have web based application which is using db2 database. db2 runs under the db2inst1 user. Now we want users of the ...
1
vote
1answer
33 views

Do live (versions of) unix distributions ever automatically pick up config info from a OS already installed on the machine?

Maybe this is a silly question, the answer is probably no; but I gotta ask. For example, if I have an Ubuntu Live USB running on a machine with Ubuntu already installed, might the Live OS ever look ...
1
vote
1answer
157 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...
3
votes
5answers
2k views

Protect folder from sudoers

Is there an ability to not allow sudoers view your folder (only you and root can access folder)?
6
votes
2answers
1k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
1
vote
1answer
114 views

Ninja privilege escalation problem

I have a problem with ninja. I think I have configured it correctly. However, when I type in su test to login as test and then run sudo -i the log shows that test is in the ninja group when in reality ...
4
votes
3answers
855 views

Securely feeding a program with a password

After understanding the problem with using a password in the command line, I need to find a way of feeding a program with a password without it being a problem (without the password being recorded ...
28
votes
3answers
3k views

Why shouldn't someone use passwords in the command line?

Why do people fear writing passwords in the command line? The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
2
votes
2answers
503 views

Does PHP exec() store the executed command anywhere?

Suppose I have the following code in a PHP web application. $encrypt ? $password = generatePassword($passwordstrength): $password=""; $estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo"; ...
3
votes
2answers
10k views

Allow a specific user or group root access without password to /bin/date

As the title would suggest, I'd like to give a user or group full root access to the /bin/date command, including any manner of arguments as defined in the man pages. I understand /etc/sudoers ...
2
votes
3answers
734 views

I have installed Linux distribution. Do I need to set root account or the user account is enough?

I have these credentials that I am using for logging in with my Linux distribution (Ubuntu 13.04) when starting the computer: james myawesomepassword123 I type the password on the login screen and ...
4
votes
2answers
439 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
3
votes
1answer
481 views

ufw firewall rules for security.debian.org

What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)? My understanding is ...
0
votes
1answer
4k views

fopen: $JOHN/dynamic.conf: No such file or directory

I have an unshadowed db.txt file: [root@SERVER ~]# rpm -qa | grep -i john john-1.7.9-1.el6.rf.x86_64 [root@SERVER ~]# head -1 /etc/issue Scientific Linux release 6.3 (Carbon) [root@SERVER ~]# cat ...
0
votes
1answer
68 views

Let pam module use hostname -s

Our hostname command gives back the servername.domain. This is in conflict with our authentication mechanism with our Active Directory. Is it possible to let the pam module use hostname -s (the ...
0
votes
2answers
116 views

are daemon tmpfs executables copied unencrypted to memory upon execution? (prevent if so?)

When a daemon is executed, is the executable copied to memory? If so, can it be copied encrypted? If not, is there a way to prevent the executable from being copied to memory? The executable is ...
2
votes
0answers
135 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...