Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

5
votes
1answer
192 views

OpenBSD and limiting login to local only like in FreeBSD's login.access(5)

I am using OpenBSD as my desktop. I don't want to login to my machine remotely, and I don't want anyone else to login remotely. In FreeBSD there is a file called login.access(5) that can be used to ...
1
vote
3answers
157 views

Is it possible to have malware software in Linux without executing untrusted applications?

I'm linux user and I'm thinking about it's vulnerabilities to malware. Can I get any malware if I run only trusted applications from distro's repository?
1
vote
2answers
439 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
1
vote
0answers
1k views

Symbolic link to a socket

From a security point of view, is it safe to create a symbolic link to a socket file? The following bits of context refer to the deployment of a web application on a shared hosting service. $ ls -al ...
5
votes
3answers
324 views

Effectivity of shred on different file systems

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
4
votes
2answers
347 views

Shredding everything: files/folders and corresponding filenames

Using find, it is easy to shred a directory's contents recursively (as discussed in this question). However, sometimes the filenames on their own carry sensitive information already. Is there a way to ...
2
votes
2answers
880 views

Chroot Risks w/ /dev and /proc

I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into ...
2
votes
1answer
211 views

How do I ensure outbound TCP/IP traffic always uses a VPN, even when using Wifi?

I'd like to ensure that my VPN is started and running, before any TCP traffic from any of my background services send or receive data. How can I guarantee that this is the case? How do I handle ...
0
votes
2answers
1k views

What does “0” mean in the owner and group permission lists of a file/folder?

The question is in the title. What does the number 0 signify?
6
votes
1answer
714 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
0
votes
1answer
187 views

How to use linux tools to verify a site's authenticity

When I go to certain websites where it's important for me to know that I'm connected securely, certain browsers will say that the site failed the authenticity check. Firefox won't say anything, but ...
1
vote
1answer
1k views

SSL handshake failure with Shibboleth [closed]

I am using Shibboleth for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
2
votes
2answers
203 views

How to securely export a device (HDD)?

So I have a Scientific Linux 6.3 (RHEL clone so basically the question is Redhat related) machine called "B" (with an extra "A" HDD besides the system HDD) and a notebook with SL 6.3. They are in a ...
3
votes
3answers
111 views

Stop user being able to access live CD environment or recovery mode?

I'm haved created an account on ubuntu that is just a standard user but with no internet access. I have also removed 'recovery mode' from the grub menu so that one cannot just choose this option ...
2
votes
1answer
173 views

Can I lock the root account during an install of Debian GNU/Linux 6 “squeeze”?

By default, Ubuntu locks account root; can I do the same, in Debian GNU/Linux 6 "squeeze", during install?
2
votes
1answer
961 views

su-to-root fails when root user locked?

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account? Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
1
vote
1answer
642 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
4
votes
1answer
119 views

Can I force myself to enter a password when run certain processes?

I frequently work in an environment where, lets call them "pranksters" may gain access to my console. I am diligent in locking my screen whenever I walk away, but given enough time someone gets the ...
9
votes
3answers
457 views

Physically break into box? (Memory & disk)

I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it ...
1
vote
1answer
1k views

Safety of SMB versus SFTP

I have a server with OpenSSH enabled. I use it to make distant backups. I mainly use rsync over SSH and SFTP. I understood that these protocols are quite safe. I am interested in enabling Samba share ...
3
votes
3answers
466 views

Prevent users from killing processes that they own

I have started some processes (window based) from user's .bashrc file. I want to prevent users from killing those processes. Is there a way to transfer the process to superuser so that a normal user ...
4
votes
1answer
438 views

In my secure log there is a new group added that Im unsure about after adding semanage

I installed semanage onto my CentOS 6.2 box and I was going through my secure log after the install and noticed this entry: Aug 31 22:12:17 xxxx groupadd[12929]: group added to /etc/group: ...
3
votes
1answer
2k views

Can I automate mounting a cifs share without storing my password in plaintext?

I currently use a script which contains commands along the lines of sudo /sbin/mount.cifs $SERVER_SHARE $MOUNT -o username=$DOMAIN_$USER,uid=$USER,gid=$USER,file_mode=0664,dir_mode=0775 to mount my ...
2
votes
1answer
741 views

Is it *really* possible to directly steal a private key if it uses no passphrase?

I've read in various places, such as in this question that using an ssh key pair without a passphrase allows attackers to steal your private key if they gain access to your account. I assumed that by ...
8
votes
1answer
5k views

Is there a way to deactivate Buffer overflow protection on my machine?

I want to do some experiments with buffer overflows on my various virtual machines, including (but not limited to) Debian 6, Ubuntu 12.04, Fedora 16, but every time I try to execute the buffer ...
2
votes
4answers
4k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
11
votes
7answers
3k views

When does the Puppy linux security model make sense?

I have just spent a few hours playing with Puppy linux, which has some very nice features, but there are some things about its approach to security (at least the default settings) that worry me: It ...
8
votes
5answers
2k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
1
vote
1answer
702 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
2
votes
2answers
144 views

SSH encryption security

If I log in to my server through ssh and copy files to my local computer can I be eavesdropped? How do I make sure nobody can intercept the data or even know what I am copying? Are there levels of ...
3
votes
2answers
339 views

Prevent hacking the grub.conf using a 'live rescue' from a live linux iso

It happened that I had set the grub password in grub.conf. But, using a live linux iso, I was able to delete the password from the grub.conf. Please read the steps for the same mentioned in this link: ...
7
votes
1answer
201 views

Is it normal to have a file called “shadow-” in the /etc directory?

I am noticing a lot of weird files appearing in my router and on my various filesystems. Files in weird places or files that have to do with security with a - sign after them. If I do ls -l ...
4
votes
1answer
1k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
3
votes
2answers
857 views

Is it possible for a CentOS system on EC2 to not have a bootloader?

I'm attempting to look for grub: [root /]# find / -iname "*grub*" /sbin/grubby /usr/share/man/man8/grubby.8.gz /usr/share/vim/vim70/syntax/grub.vim /usr/share/vim/vim70/ftplugin/grub.vim ...
3
votes
2answers
2k views

Protecting postfix from bruteforce attacks

a few days ago I've set up a VPS, including personal SMTP service using postfix + procmail under Debian / Wheezy. I am already seeing a LOT of hammering onto the SMTP and other ports. Here's an ...
5
votes
1answer
335 views

Automated ssh login with passphrase?

Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine ...
2
votes
0answers
192 views

When was this vulnerability fixed in Debian? (CVE-2012-2088 affecting libtiff4) [closed]

I have Debian Squeeze installed on my one of my workstation. On my Ubuntu 10.04 workstation there have been two security updates to the libtiff4 package in the last couple of weeks, addressing the ...
6
votes
2answers
1k views

Optimize performance for encrypted disk

Recently I tried to copy 200GB to a 1TB external / USB2 / encrypted disk and it took 36 hours. The same copy when the disk was not encrypted took no longer than 1 hour. I am using dm-crypt (LUKS) ...
2
votes
2answers
153 views

need explainations on this network route

I'd like to get some insight as to how I can possibly access network devices that are on a different IP range (obviously not mine) compared to what is configured on my wifi router? setup home wifi ...
12
votes
2answers
34k views

SSH key-based authentication: known_hosts vs authorized_keys

I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong… Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
3
votes
2answers
381 views

Can AIDE scan a directory inside a directory the user doesn't have read permissions for?

I would like to use AIDE to help me verify the integrity of my home directory on a shared Linux system. I am not an administrator of this system. I have built and installed AIDE in my home directory ...
1
vote
2answers
94 views

Linux VPS Configuration

I just recently got my hands on a linux (Fedora) VPS and I would like to ask if there are special configurations that I have to be wary of. Do I still configure it like I would configure a normal ...
8
votes
2answers
18k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
0
votes
1answer
149 views

knock on Scientific Linux 6.1? (perl script for knocking?)

I have an OpenWrt router where I installed knockd: knockd.conf [options] logfile = /var/log/knockd.log [openSSH] sequence = 7000,8000,9000 seq_timeout = 5 command = ...
7
votes
1answer
267 views

Why is it a security problem to have /usr/sbin owned by bin?

The Sendmail Installation and Operation Guide (§1.3.1) asserts: For security reasons, /, /usr, and /usr/sbin should be owned by root, mode 07552[...] 2Some vendors ship them owned by bin; this ...
3
votes
3answers
704 views

Is encrypting your web browsing via SSH to localhost useful?

For example, if I did an ssh -X to localhost and invoked Firefox, would that be enough to be considered safe browsing, like if done on some public wifi?
5
votes
2answers
2k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
5
votes
2answers
2k views

Preventing access to TTY when X is killed

Assume I start an X server manually from a virtual console /dev/tty1 with xinit or startx, with the line id:3:initdefault: set in /etc/inittab. The X server gets run and put on another virtual ...
3
votes
2answers
1k views

fprintd-enroll works with right-index finger only

When I try any other finger with: %> fprintd-enroll left-index-finger Using device /net/reactivated/Fprint/Device/0 failed to claim device: Not Authorized: ...
3
votes
1answer
94 views

Encryption of home directory for securing data after harddisk corruption

Always when I install Linux OS (e.g. Ubuntu), there is a possibility to encrypt the home directory. I was asking myself why is this useful. Is it good in the case when my harddrive is corrupted and I ...