Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

4
votes
1answer
2k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
8
votes
1answer
346 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
3
votes
1answer
174 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
2
votes
2answers
490 views

Cannot understand chkrootkit's result

I couldn't understand the output of chkrootkit command: $ chkrootkit -q -r / /usr/lib/.libssl.so.10.hmac /usr/lib/.libfipscheck.so.1.hmac /usr/lib/firefox-3.6/.autoreg ...
4
votes
4answers
328 views

SSH to untrusted machine

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
2
votes
2answers
2k views

How to change dm_crypt aes/256 LVM password after install?

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this ...
5
votes
2answers
2k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
3
votes
3answers
284 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
5
votes
1answer
5k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
4
votes
2answers
4k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
38
votes
7answers
30k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
4
votes
1answer
815 views

Linux - why is kernel.shmall so low by default?

I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments. This page is typical of the info that I've found about shmall/shmmax: ...
6
votes
1answer
1k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
2
votes
2answers
931 views

GPG check regarding packages on various distributions

It's ok that the various linux distributions use gpg to verify e.g. new packages downloaded with http. But what happens if the server that holds the packages gets hacked? OK, they need a new gpg key, ...
11
votes
7answers
2k views

How do I encrypt git on my server?

Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring ...
0
votes
0answers
145 views

git and remote security with Encfs [duplicate]

Possible Duplicate: How do i encrypt git on my server? I wanted to create a user on my server to use as a private repository. I'd like the files to be encrypted. Encfs will timeout after ...
2
votes
1answer
114 views

Is it safe to leave a enc folder mounted?

I was looking at this and ecryptfs seems cool. I'd like to use it on my server to encrypt git pushes. I dont want to ssh in everytime to mount/unmount the encrypted folder. However once in a while ...
2
votes
4answers
710 views

How to guarantee the integrity of an OS?

In information security, integrity means that data cannot be modified undetectably. This answer raised my interest, of course, I want to guarantee the integrity of my OS, outlined here. ...
7
votes
4answers
352 views

How can I safely give a shell to somebody?

I have a question about giving a shell account to somebody. How safe is it? He could read /etc. How can I give a secured shell account that will only restrict the user to some bins and his own home? ...
7
votes
2answers
233 views

Hibernate and security considerations

How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?
3
votes
1answer
2k views

Privoxy redirect rule for Wikipedia

I have a few Privoxy rules, that can redirect HTTP Wikipedia [en,de] traffic to HTTPS: (a little part from the "user.action" file) { ...
0
votes
2answers
557 views

Is there a Debian security APT repository that allows access via ftp?

If I want security updates for Debian, I add the following line to /etc/apt/sources.list: deb http://security.debian.org <codename>/updates main Is there a repository that allows the http to ...
13
votes
3answers
6k views

How should one set up full-disk encryption on OpenBSD?

Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux? I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...
3
votes
1answer
3k views

Can a user with /sbin/nologin shell login through ssh?

Is it possible to ssh to a machine as a user with no valid shell (say, mail)? So far I cannot, and using the command below doesn't work: $ ssh mail@machine.local /bin/bash It will always say "This ...
3
votes
3answers
277 views

Turning an old computer into a network firewall

I have an old Dell Dimension with two ethernet cards, and I need to turn it into a firewall. I've tried FireStarter and IPCop, but I don't think I'm setting them up right. Here's the setup that I'm ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
5
votes
2answers
726 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
2
votes
2answers
247 views

What is the “Online Certificate Status Protocol”?

I use privoxy. In the user.action file i have a redirect rule and a few websites: { +redirect{s@http://@https://@} } .twitter.com .facebook.com Ok! it's working great, e.g.: if i visit any ...
3
votes
2answers
340 views

Recommended way to login to root?

After I found out hundreds of hacking attempts are made in a day I decided I want to disable logging in to root remotely via a password. But then I found I can't switch users in WinSCP so I can't ...
5
votes
2answers
5k views

How do I disable remote root login via ssh?

How do I disable remote root login via ssh? I want to log into my server (I use keys on my main comp) then su into root instead of access root directly. I am using Debian. I follow guides online ...
2
votes
3answers
959 views

Is there any chance that some of these processes are malicious?

My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers. There were a ...
3
votes
2answers
986 views

What directories/file permissions should i ensure are set?

I have a similar question about default software configuration. For this question i would like to ask What directories/file permissions should i ensure are set? Aprrently Is it normal to get ...
9
votes
1answer
444 views

Is locking the screen safe?

See USB driver bug exposed as "Linux plug&pwn", or this link Two choices [GNOME, Fedora 14]: Use the gnome-screensaver Use the "switch user" function [gnome menu -> log out -> switch user] ...
4
votes
1answer
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
2
votes
1answer
1k views

Ideas for securing OpenVPN on an OpenWrt router

I put an OpenVPN server on port 1194 on an OpenWrt 10.03 router: echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install luci-app-openvpn openvpn openssl-util openssh-sftp-server ...
2
votes
1answer
3k views

How to connect to OpenVPN with NetworkManager

I have installed an OpenVPN server on my OpenWrt 10.03 router [freshly flashed]: https://pastebin.com/raw.php?i=hRECWuf1 echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install ...
0
votes
2answers
139 views

Where to handle packets between clients?

"Server": 192.168.1.1 I want to "theoretically" disable that the clients can "ping" each other. Can i use an iptables rule for it? e.g.: iptables -A FORWARD -m iprange --src-range ...
2
votes
1answer
209 views

tripwire report - inode number

Hi I am investigating tripwire and have stumbled upon something which i am unsure about. in a tripwire report generated after i modified hosts.deny to include an extra # I noticed the inode number ...
1
vote
1answer
1k views

IPTABLES rule for separating users

I have an OpenWrt 10.03 router [ IP: 192.168.1.1 ], and it has a DHCP server pool: 192.168.1.0/24 - clients are using it through wireless/wired connection. Ok! Here's the catch: I need to separate ...
84
votes
7answers
11k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
17
votes
3answers
1k views

Is it secure to leave a root shell running in detached screen session?

I'm curious about the security of leaving a root shell running inside a detached screen session. I typically never do this. Aside from the potential of my non-root user account being compromised ...
1
vote
1answer
126 views

Default configuration I need to change?

A few days ago I installed a new linux os. Today i realize /root has o+r (755) so EVERYONE is able to see my root sql password in /root/.my.cnf. I freaked out and simply changed /root to 750. My ...
1
vote
2answers
536 views

How can I disable /proc pseudo-filesystem on a shared Linux environment?

Is it possible to disable the /proc pseudo-filesystem to prevent w, ps, top, etc, from showing what other users are doing? Of course, I still want "everything else" to work correctly. Is there a ...
20
votes
3answers
823 views

Can other users view the arguments passed to a command?

If I invoke a command with arguments like so: bob@bob-pc:~$ command -arg1 -arg2 ...can other users view the arguments passed to the command?
3
votes
1answer
203 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
7
votes
1answer
797 views

Why root's default shell is configured differently with other normal user account's default shell?

As I know, root's default shell is configured csh and normal user's default shell is sh in FreeBSD. And in Ubuntu, root is dash, normal user is bash. (refer: What's the Ubuntu's default shell?) Why ...
6
votes
2answers
3k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...
1
vote
1answer
159 views

What are the cons of posting dmidecode output publicly?

I remember somewhere mentioned that posting dmidecode output publicly is risky (security/privacy).
5
votes
3answers
206 views

I'm moving up from managed hosting to a VPS. What do I need to know?

I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux and I'm not afraid of ...
2
votes
1answer
1k views

How do you derive the passphrase from hexadecimal wep key?

I have a hexadecimal WEP key in the setting of my router. When I try to connect, the system asks me for the WEP passphrase. How can I derive it from my hexadecimal? This is what I have: ...