Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

11
votes
4answers
7k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
6
votes
2answers
1k views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
1
vote
2answers
488 views

DNSSEC in the root zone? How to use it?

I'm using Fedora for desktop use and I: yum -y install caching-nameserver service named restart chkconfig --level 5 named on on it, and set the nameserver to 127.0.0.1. If I: dig google.com | grep ...
-1
votes
1answer
4k views

What are the most secure cryptsetup parameters to create an Encrypted filesystem? [closed]

According to http://16s.us/Linux/dm-crypt.txt, it's better to use only dm-crypt, because LUKS leaves a trace. That's OK. But, what are the most secure cryptsetup parameters to use? E.g.: ...
2
votes
1answer
240 views

What flags are used to compile debian stable packages?

Ubuntu wiki states that its packages are compiled with secure flags and secure kernel options. I cannot find this information about debian. See https://wiki.ubuntu.com/CompilerFlags
-1
votes
3answers
105 views

Does PGPDesktop supports OpenBSD or e.g. Fedora?

Does PGPDesktop support OpenBSD or e.g. Fedora, or can I only encrypt my whole hard drive when I use Windows?
2
votes
2answers
658 views

nmap output: what does “uptime” mean?

If I nmap a host, then it outputs an "Uptime" too. What does it mean, is it trustable? Does it gives correct times?
2
votes
1answer
412 views

A local, centralized, secure way to store FTP login data, including passwords

I want to be able to store the login details all of my remote FTP accounts in one place, securely. Then I'd like clients like autofs/curlftpfs, Filezilla, etc to use this one store of passwords. I'm ...
9
votes
1answer
702 views

Log every invocation of every SUID program?

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
5
votes
1answer
392 views

SSH tunnel with VNC?

In theory: I have a low-power consuption machine: eee pc, ok. I need to run a virtualized windows xp on it. (Because of a windows-only program..) I need to reach it from a smartphone (Android). The ...
-1
votes
1answer
198 views

Linux user security

When a user is created in Linux, their username can be seen publicly in the passwd file. Is there a hash set for that?
1
vote
1answer
221 views

fully disable the .desktop file function under GNOME?

http://www.geekzone.co.nz/foobar/6229 How can I fully disable the .desktop file function under GNOME?
1
vote
3answers
157 views

Tool to remove all non-package files on a system

If you want to keep for example a build or server system clean, it is very useful to be able to check that all files are present and accounted for by the package metadata. At work we have a very nice ...
3
votes
2answers
574 views

How to block outgoing connections from process/user on FreeBSD?

My server executes third party software which processes user submitted files. I want to block outgoing connections from my process. How can I do it in FreeBSD?
12
votes
7answers
6k views

What's the best way to format a HDD in Linux in order to leave no trace?

I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
11
votes
4answers
855 views

How exactly do people “crack” Unix/Linux Systems?

No im not looking to become a cracker or something like that, but Im trying to figure out the process (more from a programming perspective). So im assuming (guessing) a cracker's main goal is to gain ...
7
votes
1answer
575 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
4
votes
1answer
1k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
2
votes
4answers
2k views

Private VLAN's under Linux?

http://blog.ine.com/2008/07/14/private-vlans-revisited/ Has anyone tried private vlan's under Linux? Any experiences with them? My real question is does anybody have howtos regarding this?
4
votes
5answers
156 views

Hiding work in account with multiple users

I'm currently working on an assignment in a cluster programming class. The class has been given an account on the cluster, so we can ssh in and do our work. The problem is that the one account is ...
2
votes
1answer
237 views

How do I make a certain command sudo-only on Debian?

What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
4
votes
1answer
2k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
8
votes
1answer
350 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
3
votes
1answer
175 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
2
votes
2answers
504 views

Cannot understand chkrootkit's result

I couldn't understand the output of chkrootkit command: $ chkrootkit -q -r / /usr/lib/.libssl.so.10.hmac /usr/lib/.libfipscheck.so.1.hmac /usr/lib/firefox-3.6/.autoreg ...
4
votes
4answers
335 views

SSH to untrusted machine

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
2
votes
2answers
2k views

How to change dm_crypt aes/256 LVM password after install?

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this ...
5
votes
2answers
2k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
3
votes
3answers
285 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
5
votes
1answer
5k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
4
votes
2answers
4k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
40
votes
7answers
33k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
4
votes
1answer
824 views

Linux - why is kernel.shmall so low by default?

I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments. This page is typical of the info that I've found about shmall/shmmax: ...
6
votes
1answer
1k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
2
votes
2answers
938 views

GPG check regarding packages on various distributions

It's ok that the various linux distributions use gpg to verify e.g. new packages downloaded with http. But what happens if the server that holds the packages gets hacked? OK, they need a new gpg key, ...
11
votes
7answers
2k views

How do I encrypt git on my server?

Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring ...
0
votes
0answers
145 views

git and remote security with Encfs [duplicate]

Possible Duplicate: How do i encrypt git on my server? I wanted to create a user on my server to use as a private repository. I'd like the files to be encrypted. Encfs will timeout after ...
2
votes
1answer
116 views

Is it safe to leave a enc folder mounted?

I was looking at this and ecryptfs seems cool. I'd like to use it on my server to encrypt git pushes. I dont want to ssh in everytime to mount/unmount the encrypted folder. However once in a while ...
2
votes
4answers
723 views

How to guarantee the integrity of an OS?

In information security, integrity means that data cannot be modified undetectably. This answer raised my interest, of course, I want to guarantee the integrity of my OS, outlined here. ...
7
votes
4answers
353 views

How can I safely give a shell to somebody?

I have a question about giving a shell account to somebody. How safe is it? He could read /etc. How can I give a secured shell account that will only restrict the user to some bins and his own home? ...
7
votes
2answers
236 views

Hibernate and security considerations

How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?
3
votes
1answer
2k views

Privoxy redirect rule for Wikipedia

I have a few Privoxy rules, that can redirect HTTP Wikipedia [en,de] traffic to HTTPS: (a little part from the "user.action" file) { ...
0
votes
2answers
574 views

Is there a Debian security APT repository that allows access via ftp?

If I want security updates for Debian, I add the following line to /etc/apt/sources.list: deb http://security.debian.org <codename>/updates main Is there a repository that allows the http to ...
13
votes
3answers
7k views

How should one set up full-disk encryption on OpenBSD?

Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux? I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...
3
votes
1answer
3k views

Can a user with /sbin/nologin shell login through ssh?

Is it possible to ssh to a machine as a user with no valid shell (say, mail)? So far I cannot, and using the command below doesn't work: $ ssh mail@machine.local /bin/bash It will always say "This ...
3
votes
3answers
279 views

Turning an old computer into a network firewall

I have an old Dell Dimension with two ethernet cards, and I need to turn it into a firewall. I've tried FireStarter and IPCop, but I don't think I'm setting them up right. Here's the setup that I'm ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
5
votes
2answers
739 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
2
votes
2answers
252 views

What is the “Online Certificate Status Protocol”?

I use privoxy. In the user.action file i have a redirect rule and a few websites: { +redirect{s@http://@https://@} } .twitter.com .facebook.com Ok! it's working great, e.g.: if i visit any ...
3
votes
2answers
341 views

Recommended way to login to root?

After I found out hundreds of hacking attempts are made in a day I decided I want to disable logging in to root remotely via a password. But then I found I can't switch users in WinSCP so I can't ...