Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
3answers
1k views

What happens if I delete all user passwords?

I have a Fedora VPS with a root user that has no password. I login with SSH keys. I had another, less privileged account on that server, used for web administration. I've now deleted its password ...
3
votes
3answers
1k views

Use EncFS to encrypt files so that a particular user or process can access them, but root cannot

I have a process which I would like to have access to an encrypted file system. This is very easy to do with EncFS, but this requires a user mounting the encrypted file system, therefore giving any ...
3
votes
1answer
115 views

New webserver: What all user accounts should I create and permissions to provide for

This is a followup on my question here. I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have. ...
2
votes
2answers
403 views

What kind of Linux can verify all of its files / packages like debsums(Debian), but more?

# debsums -a, --all check configuration files (normally excluded) However, there is large amount of temporary, ancillary files here and there, not only in tmp-dir. About 4,000 of binaries .pyc ...
4
votes
2answers
353 views

How to harden linux against DMA attacks?

How can I configure my linux system to be secure against DMA-attacks? Is there a way to make them impossible? DMA Attacks excerpt From wikipedia In modern operating systems, non-system (i.e. ...
5
votes
2answers
669 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
8
votes
2answers
2k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
4
votes
1answer
177 views

TCP wrapper “except” option

I configured the /etc/hosts.allow at the machine 192.168.122.50 with the following option. sshd : ALL EXCEPT 192.168.122.1 and tried ssh root@192.168.122.50 from the machine 192.168.122.1 and I was ...
2
votes
3answers
1k views

Restrict standard users to run a command with a specific argument

I know how to restrict standard users to run a command by removing execute permissions for that command. But it's possible restrict standard users to run a command with a specific option/argument? ...
4
votes
2answers
13k views

Postfix, Amavis-new, ClamAV: Permission denied. ERROR

Error lines in /var/log/maillog Sep 22 12:08:20 sun amavis[4493]: (04493-09) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/spool/amavisd/tmp/amavis-20130922T052321-04493-crApLkq5/parts: ...
2
votes
4answers
24k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
4
votes
1answer
1k views

How can I secure my Ubuntu 13.04 to prevent network attacks? [closed]

Is there a way I could protect my pc computer from being hacked in an event where the internet conection will be opened? Thing is I am going to Campus Party Colombia 2013 and I was sugested to format ...
8
votes
3answers
8k views

Why is PATH reset in a sudo command? [duplicate]

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH ...
6
votes
3answers
526 views

Under what scenarios would I want to set a SUID bit?

I'm struggling to wrap my mind around the concept of SUID bits and why they're would be useful. For example, let's say I have a program: -rwsr-xr-x 1 root root 12364 Jan 12 2013 ...
2
votes
2answers
1k views

AIX 6.1 — Without root can I get the last failed login for a user i have access to?

I know the information is in the security files but I don't have access and it's more work then I want to do to go to our Unix admins to get the information (everytime the account gets locked which is ...
21
votes
5answers
13k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
11
votes
4answers
6k views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA revelations and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I ...
6
votes
1answer
1k views

Security of an encrypted (dm-crypt & LUKS) Ubuntu 12.04 installed by somebody else?

Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation. Suppose also that I have somebody (e.g. my vendor) else set this up ...
2
votes
1answer
946 views

Is many consoles in securetty file a risk?

I got a problem So I expect you can give me an answer. I have to evaluate the security of a RedHat server. The idea is review the /etc/securetty file to ensure that only the console tty is listed. But ...
11
votes
2answers
5k views

Test whether Linux binary is compiled as position independent code

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization ...
4
votes
3answers
1k views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
8
votes
2answers
10k views

how to know the type of symmetric encryption used by ssh?

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?. I have looked in ...
4
votes
1answer
126 views

Tomoyo Linux: Have a private folder, that can't be read by default

Is it possible to specify folders, eg: /home/$user/private that can not be listed, read or written to by any application in the default profile 0, but only with programs where I specify this as ...
3
votes
2answers
303 views

Securely allowing users to create accounts

1) I'm struggling to find a secure way to allow new users to create accounts without granting them admin rights to do so. If you already have an account on my system and can work UNIX command line, ...
2
votes
3answers
18k views

OpenVPN - Socket bind failed on local address [AF_INET] IP:1194: Cannot assign requested address

How get it resolved? I am trying to start the openVPN server so that i can login remotely using username: demo and password: demo, but openVPN server is failing to start. What am i doing wrong, how ...
16
votes
2answers
5k views

How does ps know to hide passwords?

Witness: $ ps f PID TTY STAT TIME COMMAND 31509 pts/3 Ss 0:01 -bash 27266 pts/3 S+ 0:00 \_ mysql -uroot -p 25210 pts/10 Ss+ 0:00 /bin/bash 24444 pts/4 Ss 0:00 ...
3
votes
2answers
863 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
0
votes
1answer
890 views

Difference between Debian 7.1 and Linux Mint 15 Debian

What is the main difference between Debian 7.1 and Linux Mint 15 Debian besides look and Desktop Environment. Basically with a special reference to security stability, and updates if you are going to ...
2
votes
1answer
107 views

Bad to own a directory outside of your home directory?

Some how, can't remember why, I got into the habit of downloading source to the directory /opt, which I chown to my user/group. I have this feeling that it is not a good thing to do. Is there ...
0
votes
1answer
126 views

Has the launcher security issue in KDE and Gnome been fixed?

One of the first things I heard about Linux is that it doesn't get any kind of malware. Now, I see it can get malware through WINE and e-mail (although I don't even open attachments or follow links ...
4
votes
1answer
671 views

What is the effect of setting immutable bit on /boot partition [closed]

What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the ...
7
votes
1answer
6k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
6
votes
4answers
719 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
2
votes
3answers
244 views

Is running GUI apps on server a security issue?

To edit system files for example /etc/named/named.conf, I use: su - Password: gedit And then opens and edit above like files, instead of: nano /etc/named/named.conf or: vi ...
3
votes
1answer
488 views

mount --no-canonicalize?

Neither man nor info page provide more information on this than: mount --no-canonicalize Don't canonicalize paths. The mount command canonicalizes all paths (from command line or fstab) ...
1
vote
1answer
215 views

Losing (realtime) permission when sudoing from root to myself

After an upgrade to debian wheezy (I did not upgrade the kernel - it is still 3.8.2) I can no longer start jackd in the way I used to do it. I get you are not allowed to use realtime scheduling. My ...
11
votes
2answers
12k views

How can you log every command typed

How can you log every command someone has entered into the shell? I'm asking on both the basis of protecting yourself if you are logged into someone else's server and something breaks, or if someone ...
2
votes
3answers
13k views

Why do I get error “Could not chdir to home directory”

I work in support, and occasionally I'm given shell access to a remote Linux system. I frequently find that when the admin gives me remote access, that I get the following output upon login. ...
4
votes
2answers
182 views

Linux Kernel limit access to root with a button?

Is it possible to limit the access to a root account from within the kernel? I mean that if I press a button then the system detects the button being pressed and then allows access to the root ...
4
votes
1answer
152 views

Are there any security risks when mounting as root?

Are there any security related risks when mounting with root privileges compared to mounting with regular users? I have a script which does some ecryptfs mounting with non-root privileges (by design), ...
3
votes
2answers
1k views

Store password as hash in wpa_supplicant.conf? [duplicate]

This question is very much related to this one. I want to log into a user and password protected wifi which uses PEAP and maybe MS-CHAPv2. My wpa_supplicant.conf has to contain an entry like this: ...
1
vote
0answers
179 views

Assigning an identity to an IPsec policy in Linux

Page 36 of RFC2367 (PF_KEYv2 Key Management API) states that when the kernel needs an IPsec security association for an outbound packet, but does not have one, it will ask the key management daemon ...
1
vote
0answers
518 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
2
votes
2answers
3k views

wpa_passphrase must be 8..63 characters

I'd like to connect to wireless network via command line in Linux. When doing it I've stuck with this issue: $ wpa_passphrase NETWORK_SSID NETWORK_PASSWORD Passphrase must be 8..63 characters The ...
1
vote
1answer
464 views

Preventing script execution and file downloads in a directory?

I have a directory on my website where I'm storing files uploaded by users. I use a whitelist for uploaded file types and also save the files with hashed names, but from what I've read another good ...
4
votes
1answer
185 views

Where are passwords stored and how are they encrypted in OS X?

I know that on a Linux system passwords are stored in /etc/shadow and are salted and encrypted using a one way hashing algorithm like MD5, SHA-256 or SHA-512. It looks like there is no /etc/shadow ...
1
vote
2answers
1k views

Minimize PHP.CGI.Argument.Injection and further hardening of the Centos 6.4 web server

We have Centos 6.4 server with a physical firewall. We keep seeing quite an number of PHP.CGI.Argument.Injection is detected by the firewall. On the server itself we have done the basic apache ...
7
votes
2answers
701 views

With which user should I run web servers, redis & mongodb?

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web ...
3
votes
1answer
1k views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
7
votes
3answers
1k views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...