Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
1answer
106 views

Bad to own a directory outside of your home directory?

Some how, can't remember why, I got into the habit of downloading source to the directory /opt, which I chown to my user/group. I have this feeling that it is not a good thing to do. Is there ...
0
votes
1answer
125 views

Has the launcher security issue in KDE and Gnome been fixed?

One of the first things I heard about Linux is that it doesn't get any kind of malware. Now, I see it can get malware through WINE and e-mail (although I don't even open attachments or follow links ...
4
votes
1answer
656 views

What is the effect of setting immutable bit on /boot partition [closed]

What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the ...
7
votes
1answer
5k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
6
votes
4answers
679 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
2
votes
3answers
242 views

Is running GUI apps on server a security issue?

To edit system files for example /etc/named/named.conf, I use: su - Password: gedit And then opens and edit above like files, instead of: nano /etc/named/named.conf or: vi ...
3
votes
1answer
481 views

mount --no-canonicalize?

Neither man nor info page provide more information on this than: mount --no-canonicalize Don't canonicalize paths. The mount command canonicalizes all paths (from command line or fstab) ...
1
vote
1answer
211 views

Losing (realtime) permission when sudoing from root to myself

After an upgrade to debian wheezy (I did not upgrade the kernel - it is still 3.8.2) I can no longer start jackd in the way I used to do it. I get you are not allowed to use realtime scheduling. My ...
11
votes
2answers
12k views

How can you log every command typed

How can you log every command someone has entered into the shell? I'm asking on both the basis of protecting yourself if you are logged into someone else's server and something breaks, or if someone ...
2
votes
3answers
13k views

Why do I get error “Could not chdir to home directory”

I work in support, and occasionally I'm given shell access to a remote Linux system. I frequently find that when the admin gives me remote access, that I get the following output upon login. ...
4
votes
2answers
182 views

Linux Kernel limit access to root with a button?

Is it possible to limit the access to a root account from within the kernel? I mean that if I press a button then the system detects the button being pressed and then allows access to the root ...
4
votes
1answer
150 views

Are there any security risks when mounting as root?

Are there any security related risks when mounting with root privileges compared to mounting with regular users? I have a script which does some ecryptfs mounting with non-root privileges (by design), ...
3
votes
2answers
1k views

Store password as hash in wpa_supplicant.conf? [duplicate]

This question is very much related to this one. I want to log into a user and password protected wifi which uses PEAP and maybe MS-CHAPv2. My wpa_supplicant.conf has to contain an entry like this: ...
1
vote
0answers
179 views

Assigning an identity to an IPsec policy in Linux

Page 36 of RFC2367 (PF_KEYv2 Key Management API) states that when the kernel needs an IPsec security association for an outbound packet, but does not have one, it will ask the key management daemon ...
1
vote
0answers
513 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
2
votes
2answers
2k views

wpa_passphrase must be 8..63 characters

I'd like to connect to wireless network via command line in Linux. When doing it I've stuck with this issue: $ wpa_passphrase NETWORK_SSID NETWORK_PASSWORD Passphrase must be 8..63 characters The ...
1
vote
1answer
455 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
4
votes
1answer
185 views

Where are passwords stored and how are they encrypted in OS X?

I know that on a Linux system passwords are stored in /etc/shadow and are salted and encrypted using a one way hashing algorithm like MD5, SHA-256 or SHA-512. It looks like there is no /etc/shadow ...
1
vote
2answers
1k views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
7
votes
2answers
682 views

With which user should I run web servers, redis & mongodb?

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web ...
3
votes
1answer
1k views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
7
votes
3answers
1k views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
6
votes
1answer
381 views

Any random password results in successful login on tty

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type... I tried to reset password for ...
1
vote
1answer
118 views

Are there any PaxTest for OpenBSD?

Pax: PaX is a process memory protection patch For FreeBSD, there exists a testsuite called PaxTest, is there a PaxTest available for OpenBSD?
3
votes
0answers
790 views

Is there any DLP solution for linux? [closed]

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
6
votes
3answers
4k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
52
votes
4answers
12k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
0
votes
1answer
525 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf ...
5
votes
2answers
2k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem someUser@1.2.3.4:~/files.tgz . Warning: ...
0
votes
1answer
55 views

Prevent access to files on linux file server

I have a linux system running Debian Wheezy stable on it and am using it as a file repository (not a true file server because I am using BitTorrent sync to move files as I move around the world). Some ...
2
votes
2answers
1k views

How to password-protect a script on Linux?

How do you set a password to execute a command or script in Linux? I need to avoid a script (in which user and password details are included) from being used/executed from unauthorized users. So is ...
-1
votes
1answer
1k views

SSH key based login bypasses password policies

I noticed that logins via an SSH key bypass the LDAP password policies (password ageing, password warning, and password lockout due to failed attempts, etc). Is there any way to force key-based ssh ...
0
votes
1answer
2k views

Security - Giving Apache write access to /var/www/html

I am running Worpdress on an CentOS Webserver. Now, to enable wordpress to be able to upload/write files to the default webserver directory /var/www/html I had to do the following change on the ...
2
votes
0answers
178 views

Ubuntu : puppet f5 device config : Partition '' doesn't exist

This is a Puppet question that I've posted on the PuppetLabs forums with no response. I'm also posting here because I'm hoping that with a wider audience I might find someone knowledgeable re Puppet ...
0
votes
3answers
263 views

How to hide an OpenBSD 5.3 server as it would be a windows server or something else?

There is an OpenBSD 5.3 server. It only listens on port 443 with an apache (on higher port an sshd listens, but port knocking is used). How can I hide the servers operating system/webserver to be ...
1
vote
1answer
109 views

mount other encrypted volume on wrong password entry

I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine. The problem A possible attacker will ...
5
votes
7answers
540 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
1
vote
1answer
71 views

How do I isolate my file system data from another system root?

I have a linux machine(kubuntu 13.04) A my friend asked me give him an account with being able to use sudo. So, I made an account for him and put the account in /etc/group for him to use sudo I don't ...
-3
votes
1answer
299 views

Break write permission for non root user?

Can non root user edit files he/she doesn't have access to or create new a file in a directory he/she doesn't own? Is there a way to do that? P.S : I know if root user or file owner gives him write ...
9
votes
0answers
4k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
3
votes
1answer
411 views

Is it a bad idea to add myself to the sudo group?

Members of the sudo group in my Debian install can execute anything without entering a password. This is convenient, but seems like a bad idea. NOTE: My computer is an ordinary desktop, not a server ...
5
votes
1answer
345 views

How can I find the Secure Attention Key (SAK) on my system and can I disable it?

In answer to My process was killed but I cannot understand the kernel notice, I was pointed to some documentation on the Secure Attention Key (SAK) on Linux. I have a embedded system generated using ...
2
votes
3answers
642 views

denyhosts is blocking existing users from logging in from unknown (new) IP addresses

I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict. I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config ...
0
votes
1answer
62 views

Random file accesses to server's ip

[Sat Jun 22 13:07:06 2013] [error] [client 208.80.194.26] File does not exist: ...
1
vote
0answers
236 views

Reverse ssh-agent forwarding and unlocking remote keys with your local keys

So the following two things should both be possible to do with ssh the question is just how difficult they would be and I'm hoping someone can give me an easy answer. 1) Suppose I have several ...
4
votes
2answers
11k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
0
votes
1answer
156 views

Is there any tools which can be used to make ports available from any firewall network?

I have been testing my application which has TCP/UDP ports for peer to peer with the help of server signalling commands for making communication, that works when I have Public IP or Lan IP and not ...
2
votes
1answer
3k views

How to execute php file as different user securely?

I want to confirm that my thoughts are correct as this is about security matter. We have web based application which is using db2 database. db2 runs under the db2inst1 user. Now we want users of the ...
1
vote
1answer
33 views

Do live (versions of) unix distributions ever automatically pick up config info from a OS already installed on the machine?

Maybe this is a silly question, the answer is probably no; but I gotta ask. For example, if I have an Ubuntu Live USB running on a machine with Ubuntu already installed, might the Live OS ever look ...
1
vote
1answer
164 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...