Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

3
votes
2answers
1k views

What directories/file permissions should i ensure are set?

I have a similar question about default software configuration. For this question i would like to ask What directories/file permissions should i ensure are set? Aprrently Is it normal to get ...
9
votes
1answer
450 views

Is locking the screen safe?

See USB driver bug exposed as "Linux plug&pwn", or this link Two choices [GNOME, Fedora 14]: Use the gnome-screensaver Use the "switch user" function [gnome menu -> log out -> switch user] ...
4
votes
1answer
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
2
votes
1answer
2k views

Ideas for securing OpenVPN on an OpenWrt router

I put an OpenVPN server on port 1194 on an OpenWrt 10.03 router: echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install luci-app-openvpn openvpn openssl-util openssh-sftp-server ...
2
votes
1answer
3k views

How to connect to OpenVPN with NetworkManager

I have installed an OpenVPN server on my OpenWrt 10.03 router [freshly flashed]: https://pastebin.com/raw.php?i=hRECWuf1 echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install ...
0
votes
2answers
141 views

Where to handle packets between clients?

"Server": 192.168.1.1 I want to "theoretically" disable that the clients can "ping" each other. Can i use an iptables rule for it? e.g.: iptables -A FORWARD -m iprange --src-range ...
2
votes
1answer
218 views

tripwire report - inode number

Hi I am investigating tripwire and have stumbled upon something which i am unsure about. in a tripwire report generated after i modified hosts.deny to include an extra # I noticed the inode number ...
1
vote
1answer
1k views

IPTABLES rule for separating users

I have an OpenWrt 10.03 router [ IP: 192.168.1.1 ], and it has a DHCP server pool: 192.168.1.0/24 - clients are using it through wireless/wired connection. Ok! Here's the catch: I need to separate ...
85
votes
7answers
11k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
17
votes
3answers
1k views

Is it secure to leave a root shell running in detached screen session?

I'm curious about the security of leaving a root shell running inside a detached screen session. I typically never do this. Aside from the potential of my non-root user account being compromised ...
1
vote
1answer
126 views

Default configuration I need to change?

A few days ago I installed a new linux os. Today i realize /root has o+r (755) so EVERYONE is able to see my root sql password in /root/.my.cnf. I freaked out and simply changed /root to 750. My ...
1
vote
2answers
554 views

How can I disable /proc pseudo-filesystem on a shared Linux environment?

Is it possible to disable the /proc pseudo-filesystem to prevent w, ps, top, etc, from showing what other users are doing? Of course, I still want "everything else" to work correctly. Is there a ...
20
votes
3answers
839 views

Can other users view the arguments passed to a command?

If I invoke a command with arguments like so: bob@bob-pc:~$ command -arg1 -arg2 ...can other users view the arguments passed to the command?
3
votes
1answer
204 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
7
votes
1answer
834 views

Why root's default shell is configured differently with other normal user account's default shell?

As I know, root's default shell is configured csh and normal user's default shell is sh in FreeBSD. And in Ubuntu, root is dash, normal user is bash. (refer: What's the Ubuntu's default shell?) Why ...
6
votes
2answers
4k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...
1
vote
1answer
162 views

What are the cons of posting dmidecode output publicly?

I remember somewhere mentioned that posting dmidecode output publicly is risky (security/privacy).
5
votes
3answers
207 views

I'm moving up from managed hosting to a VPS. What do I need to know?

I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux and I'm not afraid of ...
2
votes
1answer
1k views

How do you derive the passphrase from hexadecimal wep key?

I have a hexadecimal WEP key in the setting of my router. When I try to connect, the system asks me for the WEP passphrase. How can I derive it from my hexadecimal? This is what I have: ...
5
votes
1answer
3k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
36
votes
4answers
4k views

Is there any way to keep a command from being added to your history?

Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
5
votes
3answers
477 views

Unix users, groups, and permissions

I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?
6
votes
1answer
2k views

GNOME-keyring KWallet integration?

I use some GNOME apps, and some KDE apps, so some of them use G-keyring and some KWallet... What I would like to have is a single place for managing passwords. Is there a way to integrate G-keyring ...
4
votes
1answer
129 views

How can I run keychain in a way that only has the first shell prompt for keys on startup?

I open multiple shell tabs when I start KDE, and I've just added keychain to my ~/.shellrc the problem is that all the tabs prompt for key passwords when I login. This is quite annoying to do this. Is ...
7
votes
7answers
1k views

Is there a way to store Firefox passwords in a local encrypted database in Linux?

I want Firefox to "remember" my passwords so I don't have to type them in; unfortunately, the built-in password manager stores them in plain text, which is too high a security risk. I'd like to find a ...
14
votes
4answers
450 views

What specific vulnerabilities am I creating by disabling the sudo password?

Here are some instructions on how to disable your sudo password. These carry the following warning If you disable the sudo password for your account, you will seriously compromise the security of ...
8
votes
2answers
5k views

How do I get sudo -u $user to use the users env?

It seems when sudoing down that using sudo -u $user that the environment of root is still being used. How can I make sudo use the users environment? as a special note not all users that I will be ...
10
votes
5answers
891 views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...
1
vote
2answers
129 views

How would you create a user with the HOME_DIR field in /etc/passwd completely blank?

Closest I can come is: useradd --home / -r --shell /sbin/nologin someuser But this creates an entry into /etc/htpasswd that looks something like this: someuser:x:100:100::/:/sbin/nologin I want ...
14
votes
4answers
3k views

How to detect and remove a Linux trojan?

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd) Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
5
votes
3answers
2k views

How to clear terminal after logging out?

Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?
3
votes
1answer
389 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
8
votes
2answers
1k views

What encryption does vim -x use?

I read man vim, :h -x and :h encryption none of this actually says what algorithm it's encrypted with.
1
vote
5answers
395 views

Does verifying packages enhance security and/or stability of a system?

RedHat/CentOS and Ubuntu both provide packages to verify the contents of a package. CentOS uses rpm -V. Ubuntu uses debsums. I've spoken to admins who run these tools to verify the packages on their ...
6
votes
2answers
816 views

I/O-overhead of dm-encrypted device?

What would be the Read-/Write-overhead when using dm-crypt (LUKS) as full disk-encryption (including root partition) on a Linux-Desktop (Ubuntu)? I plan to stack it like so: LUKS > LVM > ext4 The CPU ...
17
votes
2answers
4k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
2
votes
1answer
755 views

How to restore GnuPG key after reinstall?

I know that GnuPG is all about security, thus it's not giving many chance of retrieve private keys (otherwise anyone could do it) but I've got a private key, and my own rev.asc file. I had to ...
13
votes
3answers
3k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons ...
4
votes
1answer
231 views

What's the best way to configure shared filesystem directories? (beyond standard unix perms)

I have multiple users on my system. I'd like to have shared directories like music, video. pictures etc. The problems is that I want users to be able to write any new files to any directory, but not ...
15
votes
3answers
1k views

Why change default ssh port?

I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
2
votes
2answers
431 views

Install from RPM, then files change. How can I see the differences?

This is a RedHat Enterprise 5.5 system. I ran a verification check against an RPM, and it looks like two files have changed: # rpm --verify shadow-utils S.5....T c /etc/default/useradd S.5....T c ...
6
votes
4answers
4k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...
5
votes
4answers
314 views

Is it possible to use pendrive as key for Linux system

I want to give high security for my linux box. So i planed to use my pen drive as key for my linux box. How can i do it ?
4
votes
3answers
245 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...
46
votes
2answers
11k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
2
votes
1answer
658 views

Start X as a user other than root

I know some distro's (Moblin? ) have X starting as a user other than root already... What is required to do this? What steps need to be taken? I don't think it matters but I think X is started by KDM ...
5
votes
2answers
470 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
16
votes
5answers
2k views

Does installing and using Wine open up your Linux platform to windows virus'?

Just wondering if installing wine might open up a fairly solid linux desktop to the world of windows virus'. Any confirmed reports about that? Would you then install a windows antivirus product ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
7
votes
4answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...