Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
2answers
821 views

Can someone change content of a file with permission 777 on a server?

If in my server I have a file(for example a php file) with permission 777, can someone edit or delete it without having an account on the server?
0
votes
1answer
1k views

What is the default encryption type of the ssh-keygen?

When generating private/public keys with ssh-keygen what types of keys will it generate if I wont pass -t option followed with the encryption type like rsa?
4
votes
1answer
488 views

Why do SELinux policies require a system restart?

When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
2
votes
3answers
875 views

Is there a good way to encrypt and store a mailbox while still being able to quickly access and search it?

I am wondering if it is possible to : Store a mailbox in a way that the system administrator (ie: root) cannot see it User(s) with the valid credentials would be able to see it AND be able to search ...
15
votes
4answers
53k views

SSH login with clear text password as a parameter?

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I wont have access to ...
3
votes
1answer
2k views

See if file has been copied to USB

Is there a way to see if a file has been copied to an USB drive? (Ex: I have the file secret.db and I suppose that my friend has copied it into his USB drive. With stat $filename I cannot see the ...
3
votes
1answer
489 views

How to check downloaded package on OpenBSD 5.1?

Under linux there is a package called "ubuntu-keyring" - it's for checking that the downloaded packages (from the offical repositories) are the ones that are on the server. How can I do this under ...
3
votes
5answers
19k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
10
votes
2answers
3k views

Should you run automatic updates

I'm running production Centos web servers. I want to know what is best practice for running updates. Should I automate this with yum-cron or yum-updatesd? Or is there a danger of updates breaking ...
4
votes
2answers
919 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
3
votes
2answers
306 views

Linux security vulnerabilities?

A while back I started an embedded project using the 3.2.10 kernel. Now the project should go into production and the stable kernel is 3.2.16. I would prefer not to upgrade anything to avoid ...
4
votes
3answers
6k views

Fork bomb on a Mac?

I just learned about a fork bomb, an interesting type of a denial of service attack. Wikipedia (and a few other places) suggest using :(){ :|:& };: on UNIX machines to fork the process an infine ...
1
vote
0answers
280 views

Information about the 1630/master app

When I run $ sudo netstat -a --programs | grep LISTENING | grep 1630 I will get this output. Do you know what good are processes running under this app name? Why they I running on my system and if ...
1
vote
3answers
259 views

How can I identify processes that use network facilities, and can they be killed?

In the output of netstat -a | grep LISTEN there are usually a lot of processes. How (where) can I find out information about them, what is their purpose in the system and if I can kill them? Which ...
10
votes
2answers
679 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
1
vote
1answer
399 views

How to know who accessed a file or if a file has 'access' monitor in linux

I'm a noob and have some questions about viewing who accessed a file. I found there are ways to see if a file was accessed (not modified/changed) through audit subsystem and inotify. However, from ...
1
vote
4answers
164 views

Erasing HDD , re-write only headers , is that safe?

I want to erase my HDD quickly with dd, so If I only "zeroify" the partition headers , like destroy the inode table, block size etc. But is that safe? UPDATE I have some partition not encrypted ...
2
votes
2answers
638 views

Is xinetd still the best method to let non root daemons listen on privileged ports?

When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port. If there is no other alternative, of course I can ...
4
votes
2answers
1k views

Arch: Is “SigLevel = Never” the only convenient way?

The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf. Its not supposed to be the right way, but I don't seem to be able ...
1
vote
1answer
120 views

A tool that helps me to be sensible on permissions?

Is there a tool or understandable source (manual, webpage, ...) in existence that helps a moderate* user to be more sensible about user permissions? In my ideal-dream-world I'd have a CLI tool that ...
2
votes
1answer
271 views

dm-crypt and LUKS password rotation

How do you protect the master key, and distribute multiple passwords for admin access? Is there a 3rd party user management tool or is this native?
1
vote
1answer
436 views

How do I hide login information passed to command line programs from appearing in the process list?

I have to execute a program that passes in as command line options the username and password. Is there a way to hide the username & password from appearing in the /proc entry for this process.
9
votes
3answers
2k views

Is it safe to close shell just by clicking “X” or using “ctrl+d”?

Is it safe to close shell just by clicking "X" or using "ctrl+d" while logged in as root with su or is it safer to close it by typing "exit"? Is there any difference (security-wise) at all or is it ...
3
votes
1answer
192 views

How are loaded SSH keys referenced by name?

I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel) It seems strange to me that it uses a name to reference the keypair - ...
1
vote
1answer
256 views

Hamachi for Web Surfing

I recently installed Hamachi on my FreeBSD 9 and I want to know how can I browse web anonymously by this software?
3
votes
2answers
98 views

In Gnome, how do I decide whether to accept a PackageKit software source?

When I try to install software in the Gnome environment of Linux (mine is openSUSE) from a repository that I have not used before, PackageKit asks me to respond "Yes" or "Cancel" to a dialog "Software ...
-2
votes
4answers
252 views

Steps to secure your server? [duplicate]

Possible Duplicate: What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot? I'm just completed install my web server. So what should i do to secure it? I just ...
6
votes
1answer
980 views

Jailbreaking HDTV

I have a Vizio internet TV, the predecessor to this one with basically the same specs, not 3D though. I wanted to try and gain root access to the tv. Using nmap I leaned that the only port open is ...
3
votes
2answers
238 views

SSH Bash Jail Session

I've seen some game tunneling service providers that jails the customer's account to a Information screen upon login and any input is ignored. Ctrl+C closes the SSH session, and disconnecting. This ...
1
vote
2answers
1k views

Allow non-root process to access all home directories without compromising security?

Any ideas how to allow one non-root process to access (read&write) all home directories without compromising security? Normal users should not have access to each other's home directories. All ...
11
votes
2answers
13k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
3
votes
1answer
138 views

What is the best way to restraint/secure a workstation?

I want to prevent users to copy on usb devices and some others actions. I was thinking of using polkit. Do you think it is a good solution or does someone know some alternatives ? EDIT: I also need ...
7
votes
1answer
3k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
2
votes
0answers
119 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName ...
2
votes
1answer
303 views

Securely Deleting A File In Ram

I'm running a live distro in ram. I need to write a password to a file. Later, I need to delete it securely. I don't know how live file systems work, so I'm unsure if I open the file for writing, ...
7
votes
5answers
1k views

Securing a Debian installation for general home usage

Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, ...
3
votes
1answer
926 views

Disabling Web camera

My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
1
vote
1answer
813 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
10
votes
1answer
642 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
6
votes
2answers
675 views

Why did SDF switch from NetBSD to Linux?

I personally don't have much experience, but I was reading about SDF, and at one point the article mentions that SDF migrated to Linux in 1997, but due to the large number of malicious attacks it ...
2
votes
1answer
593 views

SELinux outbound access to other sites with restrictions

We have CentOS 6 configured with SELinux to host a number of websites. Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
13
votes
3answers
2k views

Can SSH passwords be sniffed out over Wi-Fi?

When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).
3
votes
1answer
429 views

Does using epub2pdf pose a potential security risk? Is there an alternative?

epub2pdf is a fairly platform-independent program. Based on Java, it executes without a hitch on my machine, with no dependencies. However, strangely enough, the program requires an active internet ...
24
votes
2answers
59k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
4
votes
2answers
3k views

Hardening debian?

So I have thought a bit about hardening a Debian squeeze file & VPN server lately. Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
-3
votes
4answers
475 views

Since Android has malware, does it mean no Unix is immune from malware?

Android has virus: Android.Counterclank, Android.Tonclank (seal info, back-door). Does it prove that FreeBSD, Solaris, Fedora, CentOS, ArchLinux, Ubuntu all is running and having similar ...
12
votes
4answers
2k views

Why do we need a firewall if no programs are running on your ports?

When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if ...
5
votes
3answers
325 views

Preventing binary planting attacks in Linux

If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised. Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
9
votes
5answers
6k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I have an idea, I'm sure it would work, but I would really like an expert opinion. I prefer things to be as ...
1
vote
1answer
520 views

portsentry and IPTables on constant reboot, but not sure why

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs Commands Run: User root: /sbin/service portsentry restart ...