Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
3answers
2k views

Making sense of auth log

I am seeing some log enties that look like hacking attempts Type 1 Dec 26 03:09:01 ... CRON[9271]: pam_unix(cron:session): session closed for user root Dec 26 03:17:01 ... CRON[9308]: ...
9
votes
4answers
568 views

Good practice to use same SSH keypair on multiple machines?

I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...
4
votes
3answers
312 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
18
votes
6answers
17k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
4
votes
2answers
677 views

How can I use Skype with lxc?

Under Scientific-linux? https://en.wikipedia.org/wiki/LXC I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
8
votes
3answers
8k views

How can I track who SSH'es into my linux machine?

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
2
votes
1answer
830 views

Deny external SSH access to a user

Is it possible to deny access to a user (in my case www-data) from outside the network? Or possibly deny this: ssh www-data@example.com But allow this if already logged in: su www-data
3
votes
2answers
626 views

If you SSH into another computer, how to access other X displays?

This is a query based on personal use. A troll in our local network had downloaded Crikey, the key-event simulator. He used it to simulate events on other computers, leading to unwanted things. For ...
1
vote
1answer
192 views

How 'safe' is it to use new distributions of linux? [closed]

I hope this is the right place to ask this. I was looking at some new distros of linux that came out fairy recently and I really like their UI. I want to start using one of these but I'm a bit ...
2
votes
1answer
848 views

Debian + Nginx/Unicorn permissions

Is there a security risk in running a web server like Unicorn as root? The Nginx master process runs as root, the Nginx worker runs as the limited www-data user, but I can't set another user like ...
4
votes
2answers
453 views

Is it possible (and a good idea) to do `pw lock root` on FreeBSD?

I have set up sudo on my FreeBSD server. As I now never want to log in as root anymore, I was wondering whether I should do sudo pw lock root. My questions are: Is this possible, without forever ...
-1
votes
3answers
529 views

no root shell freely available sudoers policies

I want to prevent users who need escalated privileges from obtaining any kind of a root shell. However since there are many ways to attain this, and many non root commands ( like those found in ...
8
votes
2answers
149 views

Signing/Checksumming the kernel to prevent/detect manipulation

All my partitions are encrypted (/ and /home), but the /boot partition has to remain unencrypted and is open for manipulation. I was thinking about hashing the kernel on bootup and checking the result ...
28
votes
4answers
1k views

Execution of possibly harmful program on Linux

I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it. I was thinking ...
5
votes
1answer
252 views

How can I find a Ubuntu package to use with Amazon EC2?

I'm looking to set up a new server on Amazon's EC2 and I wanted to use Ubuntu 11.04 is it is fairly new but not too new. I previously used 10.10 which I think is also very stable and time-tested. My ...
3
votes
3answers
314 views

Setting execution right to whole directory - is it good or bad idea?

I have a zip file containing lot of files and directories for a certain application which should be running on Linux. Some files needs to be set as executable, but the zip file format afaik does not ...
2
votes
1answer
2k views

Encrypt files using gpg (and them symetric encrypting the key) - is it a normal thing to do in the *nix world?

I read a lot of articles about using gpg to encrypt email, but I would like to use it to encrypt some files - mainly a bunch of *.isos. I'm going to describe what I thought I would do, so you can ...
1
vote
1answer
487 views

LoJack protection and recovery for Unix/GNU/Linux running systems?

The LoJack theft protection and recovery system looks very impressive, especially that they will find and return your computer for you, but the software is for Windows and OS X only. Is there an ...
3
votes
1answer
154 views

how to disallow user to change process group

Is it possible to restrict a process from changing it's process group? For example, user nobody seems to be able to call setpgid(0, 0) which sets process group of current process to pid of that ...
2
votes
2answers
280 views

How to deny rdesktop access to others?

Someone keeps trying to connect to my Ubuntu machine through remote desktop. Is there any way I can determine who it is, and permanently block access to my machine?
0
votes
1answer
908 views

How to find out that someone is using a Keylogger on the machine I am using?

HW/SW/whatever keyloggers are there. How to find out? E.x.: Regularly check the cable of the keyboard, because there could be HW keyloggers: http://i.imgur.com/TeMwo.jpg But what about other HW ...
5
votes
1answer
775 views

SSH Public key comment separator

I've created a SSH authentication key (with ssh-keygen) in two different servers, both with a useful comment, but the public key of one server has == between the key and the comment, while the other ...
8
votes
2answers
5k views

How to check, which limit was exceeded? (Process terminated because of ulimit. )

Let's assume process runs in ulimited environment : ( ulimit ... -v ... -t ... -x 0 ... ./program ) Program is terminated. There might be many reasons : memory/time/file limit exceeded ; just ...
1
vote
2answers
375 views

Is there file format for checksums?

I want to store SHA512 checksum of the file for my application. How to do it in common (popular) way? So this checksum can be used but by third party application too.
1
vote
1answer
594 views

rpc.statd and avahi-daemon listening on all networks?

Background: - I'm running a home Debian GNOME desktop connected to the internet through an ethernet cable to an ethernet router. - I have a printer connected directly to my PC with a USB cable. - My ...
0
votes
1answer
2k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
4
votes
1answer
153 views

Mount and automount and security problems

Are there any security problems related with (auto)mounting device?
1
vote
0answers
489 views

How to make dnsmasq avoid DNS cache poisoning?

Some domain gets DNS cache poisoning if dnsmasq is the nameserver. But the problem is gone if switch to BIND (named). Is there a easy configuration of dnsmasq so that DNS cache poisoning can be ...
2
votes
2answers
1k views

Directory/files owned by a non-existent user

A user has created a directory with files, but the user does not exist in /etc/passwd or /etc/group. The system is a Fedora server with an FTP server and proxy which redirects to a CentOS server with ...
3
votes
4answers
227 views

Internet SSH Server Security Considerations

What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?
13
votes
8answers
2k views

How can we limit the impact of ssh probes?

My webserver is constantly attacked by various IP addresses. They try five passwords and then change the IP address. I have done various lockdowns like using ssh-keys and not permitting passwords, ...
2
votes
2answers
1k views

A command to check file access permission for another user

I need to know how to check the effective file access permissions for a given user, but it takes long to do this manually starting from / up to the target file or directory, checking group, ...etc.
4
votes
2answers
3k views

How do you protect a plain text credentials file with the username and password?

I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass. [not recommended] put the ...
-1
votes
1answer
11k views

What is sport and dport?

I want to stop internet on my system using iptables so what should I do? iptables -A INPUT -p tcp --sport 80 -j DROP or iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
1answer
3k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
4
votes
1answer
266 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
2
votes
4answers
673 views

sudo without password - security? [duplicate]

Possible Duplicate: What specific vulnerabilities am I creating by disabling the sudo password? I'm involved yet again in the old argument on whether sudo without password is secure enough ...
2
votes
2answers
501 views

Security with Kernel IP Forwarding Enabled

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
3
votes
1answer
442 views

Boot-loader to boot to an encrypted partition [duplicate]

Possible Duplicate: Linux boot loaders supporting full disk encryption? I am looking for a Boot-loader which is smart enough to boot from an Encrypted partition. I want to place the kernel ...
3
votes
1answer
137 views

Running proprietary software on Linux safely [closed]

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that ...
1
vote
1answer
654 views

Best practices for secure, separated virtualhost LAMP environment

What are the best practices for a Debian Squeeze + Grsecurity/PAX based system when multiple, and therefore insecure, websites must run on the same server? I mean how can I mitigate an attack, so that ...
3
votes
1answer
158 views

mounting volume protected against user access

I need to mount a directory in a way that prevents user accessing it. However I need to have access to all attributes (including permission) from root. Is following method safe or is there a way ...
12
votes
2answers
2k views

How to safely pass variables to root-enabled scripts?

This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
8
votes
1answer
174 views

Does ssh-agent store my passphrase?

Is it possible to determine the passphrases of private keys added to ssh-agent? I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
5
votes
4answers
1k views

How sudo/root-ness detection works

Programs that make changes system-wide require sudo unless I am already the root user. Now, the question is: how exactly does the system figure out that I am (not) root? Does it: Check to see if ...
5
votes
2answers
2k views

Can KWallet manage my ssh passwords?

I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill ...
2
votes
1answer
388 views

Debian unstable chroot security issues

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot. When doing this, ...
2
votes
0answers
880 views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user ...
2
votes
1answer
829 views

root password changed automatically

I have my system on dual boot (win7 and RHEL 6). I have 2 user account on RHEL 6. A normal user and a root user. I put passwords of both accounts same. It was working fine from 5 6 days. Yesterday I ...
3
votes
4answers
5k views

File permission execute only

How can I set file to be executable only to other users but not readable/writable, the reason for this I'm executing something with my username but I don't want to give out the password. I tried : ...