Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
0answers
135 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
3
votes
3answers
2k views

Encrypting loopback images without using a loopback device

I'm trying to design a firmware update system for an embedded Linux system. My plan is to send an image that can be mounted on the target system, so I don't need to unpack the entire file. I also want ...
0
votes
1answer
210 views

Iptable rule to ssh over the internet

I've a server abc.example.com and a remote desktop zzz.example.com. I'm using SSH over a custom port, say, 6789. Whenever my firewall is off, I'm able to connect to the server successfully. But, as ...
3
votes
3answers
951 views

Privilege escalation detection?

I am not a linux/unix expert but everytime when I read about some local privilege escalation exploit (e.g. this), I wonder if an OS can detect that there is someone logging in as root (or new root ...
3
votes
4answers
11k views

What type of permissions should a user's home directory and files have?

I'm working with a fresh install of Ubuntu 12.04 and I've just added a new user: useradd -m testuser I thought that the -m flag to create a home directory for users was pretty standard, but now ...
1
vote
0answers
58 views

ufw in laptop running Ubuntu

I installed ufw and enabled it. The status is: Status: active Logging: on (low) Default: deny (incoming), deny (outgoing) New profiles: skip But, I am able to navigate the web, get emails and ...
3
votes
1answer
405 views

How to lock-down input on a Linux machine?

We need to put out a web browser to a public place to show informations. I need to lock down all the input interfaces via software methods. So ex.: if someone plugs a USB keyboard to the machine it ...
0
votes
0answers
140 views

Installing Ossec on an existing centos 6.4 machine

I have an existing machine running centos 6.4. Is it ok to install now the Ossec or it's not worth any more as the machine is already running for few months. Which is the best mechanism to install ...
3
votes
1answer
2k views

Benchmarking Apache using ab

I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers. Initially, I did the testing for 1000 ...
6
votes
1answer
266 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
0
votes
1answer
377 views

How to generate 4 WEP keys with linux commands?

I have a sagem router. this router is able to generate 4 WEP keys from a given passphrase. Example: Passphrase: "hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha" key1: ...
5
votes
1answer
2k views

Which home directory should 'nobody' have?

I'm messing around with Tiger security audits on my CentOS box, ensuring the server is fit for being online, well as close as it can get anyway. I noticed a warning about the user nobody having / as ...
2
votes
3answers
691 views

files in /proc/$PID (e.g. ssh-agent, Chrome) are not owned by user but by root

I am just answering another question here :-) and thus had a look – wanted to have a look at /proc/$PID/fd of ssh-agent in order to find out which socket it uses. But I can't. I am quite surprised to ...
1
vote
1answer
362 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
-1
votes
3answers
470 views

Is there a way to 'authorize' a command typed in by a user?

is there a way we can authorize a command typed by a user before it takes effect? For example, when a user types cp file1 file2, the command will not be executed and a root / root-equivalent user ...
3
votes
2answers
355 views

How to make sure the shell builtin echo is invoked so that its not visible in process list?

Is this going to be visible in the process listing if the below line is executed from a command line or a shell script bash -c "echo $password" or i just need to do echo $password from within ...
1
vote
4answers
2k views

Is it possible to “hide” an account from /etc/passwd?

A typical Linux system has not only accounts for the actual user(s) of the system, but also various system accounts. Is there any file like /etc/passwd for daemons, or other means resources where an ...
2
votes
1answer
346 views

Nemo: Forget encryption password

I have mounted an encrypted disk by selecting it in Nemo (1.1.2), then typing a password. I can unmount the disk using Nemo, but now it can be remounted without requiring the password. Probably ...
1
vote
1answer
456 views

How to retrieve information about locked accounts

Is it possible to retrieve info regarding to locked unix accouts? I am interested in seeing information about what date and time the lockout happend and from what hostname (pc name). I would like to ...
1
vote
0answers
504 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the ...
9
votes
3answers
28k views

How to “close” open ports?

A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1 Surprise, surprise, I have lots of active services listen to localhost: $ nmap 127.0.0.1 ...
2
votes
1answer
649 views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
2
votes
1answer
1k views

wpa_supplicant store password as hash (WPA-EAP with phase2=“auth=PAP”)

Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext? By "password" I refer here to the password used for phase2 authentification. I do not ...
0
votes
2answers
216 views

unable login solaris box

There is problem on my Solaris 10 box. It's not possible to access directly to the box, but via ssh from another box after 3 wrong entries of username/password to box then login prompt changes, at ...
4
votes
2answers
744 views

How to encrypt my system such that suspend to RAM works and is also encrypted

How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
2
votes
1answer
129 views

How can I use ForwardAgent with keychain, or detect a new login?

My scenario: I have Server A at home, and Server B at my parents house. I also have Laptop A and Laptop B at home. I do all sorts of strange ssh hops - I might connect Laptop A -> Server A -> ...
4
votes
2answers
3k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
7
votes
4answers
348 views

Which data should be excluded from log files , error messages etc. if posted online?

What data should one erase from log files, error messages etc., if posting them as a screenshot so as not to expose sensitive information? As I have little knowledge about this topic, I can vividly ...
3
votes
1answer
650 views

Having the 'id_rsa.pub' file in my dotfiles public repo securely

So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo? I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my ...
4
votes
2answers
8k views

How to find out out WHEN an user account was locked

With passwd -S user_name one can find out, if an account is locked, but is there a way to find out when it was locked and who it locked? Further links: http://serverfault.com/a/485760/78439 Disable ...
13
votes
1answer
366 views

Can entropy consumption at program start be prevented?

I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program ...
4
votes
2answers
124 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
0
votes
2answers
799 views

How do I make PHP securely load files from the server root home folder on CentOS?

So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
6
votes
3answers
11k views

Check outgoing network traffic

In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to? I am not paranoid about security, ...
4
votes
3answers
220 views

Can someone execute a malware by just inserting a flash disk?

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
7
votes
2answers
920 views

ssh-agent: don't forward authentication for the whole keyring

I have two private ssh keys : one to access my personnal machines, one to access servers at my job. I add those two keys to my ssh-agent with ssh-add. Now, when I do ssh -A root@jobsrv I ...
2
votes
1answer
820 views

Best way to encrypt my system on an ssd

I consider to buy an ssd for my laptop (something like Samsung 830 or 840) to make the system more responsive. I want my system (at least my home partition) to be encrypted. However I know about ...
1
vote
3answers
2k views

Taking away a User's Read/Write/Execute Permission

So I have a user that is able to go in /etc and read files like httpd.conf. I would like to deny that user access to any critical locations such as /etc, /var and so on. What would be the best way ...
1
vote
5answers
3k views

How to securely automate running commands as root with “sudo su -”?

hint (on client side, how to encrypt files/pwd's): # encrypt pwd with ssh key: openssl rsa -in ~/.ssh/id_rsa -outform pem > ~/.ssh/TEMP-id_rsa.pem 2>/dev/null openssl rsa -in ~/.ssh/id_rsa ...
10
votes
2answers
10k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
5
votes
3answers
2k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
5
votes
1answer
353 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
0
votes
1answer
39 views

How to identify which application is trying to access the unixbuild server?

The error message I am seeing is: Failed publickey for raj from 10.*.*.** port 34355 ssh2 Mar 18 05:22:34 unixbuild sshd[16956]: [ID 1000034 auth.info] Failed password for raj from 10.*.*.* port ...
2
votes
1answer
200 views

Configure SSH keys for production and DR server

Here is the case, we have successfully configured SSH keys (and hence password-less SFTP connection) between ProdServer-A to ProdServer-B. It works, or so I thought still yesterday. Yesterday ...
5
votes
1answer
769 views

Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?

I've been looking for this for quite a while now but couldn't find a satisfying answer. My scenario: I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
26
votes
1answer
712 views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
1
vote
1answer
550 views

Securely reading and parsing a string from a parameter or file in bash

I've been writing a number of bash scripts lately which get variables from a parameter or from a file. Some of the scripts run as root (using sudo) This is on my notebook, so there aren't any other ...
2
votes
5answers
2k views

How do I disable copy permissions?

Can we set permissions, on a Linux box OR for a particular directory (Scientific Linux in my case) that, one can read files but cannot copy, move or delete them? Update: My Scenario is, We developed ...
3
votes
2answers
7k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
-3
votes
1answer
183 views

Priviledge separation for Firefox (aka: how to secure webbrowsing)

I do this on Scientific Linux 6.3 (to implement it, it requires a minimal Linux knowledge): Shared directory for downloads Remember you can only copy from or to this directory, never "move" files ...