Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

20
votes
1answer
10k views

Why are the first 1024 ports restricted to the root user only?

This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
26
votes
2answers
2k views

Is it safe to give out my SSH public key for work?

I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the ...
12
votes
6answers
668 views

Which linux distro's package repositories are secure and which are not?

Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure ...
4
votes
1answer
185 views

How do I know which files will be included in a linux kernel before I build it?

I am working on a project that includes building an old kernel version of linux. This is fine, but I still need to patch the kernel of all previously found security vulnerabilities based on CVEs. I ...
3
votes
3answers
2k views

How secure is Ubuntu in Virtualbox on Windows host?

I have the most recent version of Ubuntu in Virtualbox on Windows 7 host. How secure will that be? I mean if I get malware on windows how will that affect the Ubuntu system I am working on?
9
votes
2answers
1k views

How do I hide/anonymise/defend a computer when on hostile networks?

I connect to a lot of open networks when I'm pootling around. I'm fairly careful to VPN home for anything important but that's not really my boggle. The laptop runs several services (nfs, dev http ...
7
votes
2answers
315 views

Can I get infected in this case if I run a live cd?

I recently got rid of a nasty trojan on Windows and want to migrate to Linux(Ubuntu). I want to run a Live CD so that I can format an SD card to put my brand new firmware on my router and format the ...
0
votes
1answer
1k views

How to secure CentOS and FreeBSD by disabling USB ports and VGA output on-site?

Is it possible to disable USB ports and CDRom and VGA output in the Dell R310 from CentOS or FreeBSD (without BIOS)? A demo server is running in a customer test laboratory, where they can simply get ...
4
votes
6answers
468 views

Any program like `sudo` to gain root by having two users enter a password?

I run a server which is used by a group of individuals for e-mail, mailing lists, personal web homes etc. I thought about ways to provide root access for other members to allow them handling problems ...
10
votes
2answers
5k views

How come no core dump is create when an application has SUID set?

I setup my environment to create a core dump of everything that crashes, however when I run an program with SUID set on a different user than the executing user it doesn't create a core dump. Any ...
5
votes
1answer
693 views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
14
votes
2answers
2k views

How to avoid escape sequence attacks in terminals?

Reading the details of CVE-2009-4487 (which is about the danger of escape sequences in log files) I am a bit surprised. To quote CVE-2009-4487: nginx 0.7.64 writes data to a log file without ...
2
votes
2answers
153 views

How to create a new user without his own FS but with access to write to only one folder of user that creates him?

What are the command(s) to create a new user (not from su), give him the ability to write to only one folder which is some directory owned by an already existing user (the one that created him)? ...
7
votes
5answers
767 views

how do I wipe a server that I don't have physical access to?

I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
6
votes
4answers
7k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
9
votes
3answers
2k views

How can I set that only root + a given user can shut down my pc?

If I'm using Ubuntu 11.04, how can I configure it such that that only two users can shut down/suspend/hibernate my PC: the root user and one regular user?
6
votes
4answers
2k views

Are there any GUI's for Linux that doesn't use X11?

Are there any GUI's for Linux that doesn't use X11? Since X has very poor security :O e.g.: Ubuntu, Fedora - what else are there? Goal: having a Desktop Environment without X. - what are the ...
2
votes
1answer
768 views

How to create a “jailed” environment for an application under Linux?

Using Ubuntu 11.04 as a Desktop OS, I want to reach "bigger security" with a "jailing" processes: VirtualBox, Google Chrome, Firefox, VLC, PDF/djvu reader, MP3 player, wine, pidgin, transmission, ...
7
votes
1answer
1k views

Is /dev/random data a psuedo-random AES cypher, and where does the entropy come from?

My current understanding of an entropy pool is that it gathers truly random bits of data at a slow rate. I'd like to know how Unix & Linux collect entropy, and how that entropy is used by ...
11
votes
4answers
7k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
6
votes
2answers
1k views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
1
vote
2answers
488 views

DNSSEC in the root zone? How to use it?

I'm using Fedora for desktop use and I: yum -y install caching-nameserver service named restart chkconfig --level 5 named on on it, and set the nameserver to 127.0.0.1. If I: dig google.com | grep ...
-1
votes
1answer
4k views

What are the most secure cryptsetup parameters to create an Encrypted filesystem? [closed]

According to http://16s.us/Linux/dm-crypt.txt, it's better to use only dm-crypt, because LUKS leaves a trace. That's OK. But, what are the most secure cryptsetup parameters to use? E.g.: ...
2
votes
1answer
245 views

What flags are used to compile debian stable packages?

Ubuntu wiki states that its packages are compiled with secure flags and secure kernel options. I cannot find this information about debian. See https://wiki.ubuntu.com/CompilerFlags
-1
votes
3answers
105 views

Does PGPDesktop supports OpenBSD or e.g. Fedora?

Does PGPDesktop support OpenBSD or e.g. Fedora, or can I only encrypt my whole hard drive when I use Windows?
2
votes
2answers
666 views

nmap output: what does “uptime” mean?

If I nmap a host, then it outputs an "Uptime" too. What does it mean, is it trustable? Does it gives correct times?
2
votes
1answer
417 views

A local, centralized, secure way to store FTP login data, including passwords

I want to be able to store the login details all of my remote FTP accounts in one place, securely. Then I'd like clients like autofs/curlftpfs, Filezilla, etc to use this one store of passwords. I'm ...
9
votes
1answer
715 views

Log every invocation of every SUID program?

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
5
votes
1answer
394 views

SSH tunnel with VNC?

In theory: I have a low-power consuption machine: eee pc, ok. I need to run a virtualized windows xp on it. (Because of a windows-only program..) I need to reach it from a smartphone (Android). The ...
-1
votes
1answer
198 views

Linux user security

When a user is created in Linux, their username can be seen publicly in the passwd file. Is there a hash set for that?
1
vote
1answer
222 views

fully disable the .desktop file function under GNOME?

http://www.geekzone.co.nz/foobar/6229 How can I fully disable the .desktop file function under GNOME?
1
vote
3answers
157 views

Tool to remove all non-package files on a system

If you want to keep for example a build or server system clean, it is very useful to be able to check that all files are present and accounted for by the package metadata. At work we have a very nice ...
3
votes
2answers
575 views

How to block outgoing connections from process/user on FreeBSD?

My server executes third party software which processes user submitted files. I want to block outgoing connections from my process. How can I do it in FreeBSD?
12
votes
7answers
6k views

What's the best way to format a HDD in Linux in order to leave no trace?

I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
11
votes
4answers
859 views

How exactly do people “crack” Unix/Linux Systems?

No im not looking to become a cracker or something like that, but Im trying to figure out the process (more from a programming perspective). So im assuming (guessing) a cracker's main goal is to gain ...
7
votes
1answer
583 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
4
votes
1answer
1k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
2
votes
4answers
2k views

Private VLAN's under Linux?

http://blog.ine.com/2008/07/14/private-vlans-revisited/ Has anyone tried private vlan's under Linux? Any experiences with them? My real question is does anybody have howtos regarding this?
4
votes
5answers
157 views

Hiding work in account with multiple users

I'm currently working on an assignment in a cluster programming class. The class has been given an account on the cluster, so we can ssh in and do our work. The problem is that the one account is ...
2
votes
1answer
238 views

How do I make a certain command sudo-only on Debian?

What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
4
votes
1answer
2k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
8
votes
1answer
351 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
3
votes
1answer
175 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
2
votes
2answers
514 views

Cannot understand chkrootkit's result

I couldn't understand the output of chkrootkit command: $ chkrootkit -q -r / /usr/lib/.libssl.so.10.hmac /usr/lib/.libfipscheck.so.1.hmac /usr/lib/firefox-3.6/.autoreg ...
4
votes
4answers
344 views

SSH to untrusted machine

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
2
votes
2answers
2k views

How to change dm_crypt aes/256 LVM password after install?

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this ...
5
votes
2answers
2k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
3
votes
3answers
286 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
5
votes
1answer
5k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
4
votes
2answers
4k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...