Questions tagged [security]
Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.
2,661
questions
5
votes
0
answers
2k
views
Change ptrace_scope temporarily for a specific user
ptrace_scope is a sysctl value (/proc/sys/kernel/yama/ptrace_scope) that prevents the use of ptrace on non-child processes when set to 1. This is generally considered good security practice.
...
0
votes
0
answers
62
views
centOS 7 access denied when logging on kerberized environment
When I am trying to log in to one of my hadoop nodes running centos 7. I am receiving a 'access denied' error. Typically, in these situations, I login as the local admin for the box, go to /tmp and ...
4
votes
2
answers
2k
views
Historically, what was the first OpenBSD remote hole?
On:
https://www.openbsd.org/
I can see:
Only two remote holes in the default install, in a heck of a long
time!
I understand the concept what are they pointing out, since other OSes have ...
10
votes
4
answers
22k
views
kernel: disabling /dev/kmem and /dev/mem
I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
245
votes
8
answers
341k
views
What's the difference between /sbin/nologin and /bin/false
Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
0
votes
1
answer
1k
views
How to set selinux labels for a folder hierarchy accessed server side by NFS, Apache, and SaMBa daemons simultaneously?
The Mandatory Access Controls or MAC labels are different for NFS which are different for httpd, and different yet again for SaMBa. What is the proper way nowadays to label a SINGLE shared filesystem ...
-1
votes
1
answer
74
views
Should we have a lot shells in our Ubuntu server?
I have these shell in my VM
# /etc/shells: valid login shells
/bin/sh
/bin/bash
/bin/rbash
/bin/dash
/usr/bin/tmux
/usr/bin/screen
/bin/zsh
/usr/bin/zsh
Is it a good thing ? Should I safely remove ...
1
vote
2
answers
3k
views
How to Disable Kernel module installation capability in Unix Based operating system?
As we are living in the Linux kernel rootkit era, Is there any way to Disable any additional module to load into operating system kernel by any user or any operation or command , in Linux? some sort ...
3
votes
1
answer
395
views
Solaris: is possible to permit root login on some terms?
I have a server with some serial ports.
One is /dev/console, another is /dev/term/b(the ttyS1 under linux and the COM2 under dos).
I want root to login under /dev/term/b but..
myserver termb login: ...
0
votes
2
answers
139
views
Can a program get root access if it gets the password?
If there's only 1 user on a system with sudo permission, can another program that ran by the user get root permission without the user knowing it if it has the sudo password?
-1
votes
1
answer
1k
views
Mount options for increased security
I am aiming to increasing security of our Linux server with nodev, nosuid and noexec mount options. Please find the attached image about showing my fstab file.
My question is about /boot written in ...
0
votes
0
answers
140
views
Make https request with HAProxy without explicitly mentioning certificates?
Why?
Some app started making annoying authentication verification that work with the region. Every time I travel, and I login from another country, I have to go through a very annoying process of ...
5
votes
3
answers
299
views
Why can't entire kernels be patched live?
Over the past few years, various live kernel patching techniques have become popular among sysadmins who strive to ensure the highest possible uptimes for their systems.
For that process to be ...
16
votes
3
answers
29k
views
How to make a folder private?
I'm using Ubuntu with several users and I want to make folders viewable just for a specific user. Any idea how to do it?
0
votes
1
answer
319
views
Add ssh authorized key and hide it in the authorized_keys?
Is it possible to add an ssh key to a system and make hidden (at least at first glance) from the user?
UPD: Recently I was participating in a CTF and had access to another team's machine. I wanted to ...
0
votes
0
answers
181
views
How to interpret the output of the "who" cmd? - wrong date, non-existing user
On a SLES11, I can see the following output:
$ who | grep -i FOOBARUSER
FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (::ffff:127.0.0.1::ffff:127.0.0.1:3)
FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (:...
2
votes
0
answers
2k
views
Security issues for passing credentials over a UNIX socket
UNIX sockets often have a mechanism to authenticate their peer processes. However, there is a requirement for care in order to avoid confused deputy attacks.
Linux, for example, has two ways to pass ...
1
vote
1
answer
291
views
Which services read the /etc/securetty configuration file?
Which programs / services are parsing contents of /etc/securetty configuration file?
0
votes
1
answer
987
views
Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?
This is what I did:
CentOS 6.2 server
installed nginx
installed vsftpd
in vsftpd.conf I set chroot_local_user=YES
created a new user "bleh"
created directory /home/bleh/public_html/
in virtual.conf I ...
2
votes
1
answer
1k
views
Debian 10 su command to existing user as root without password
I just installed a brand new VM with Debian 10 (buster) and joined it to our active directory using pbis.
what I encountered now is, that:
as the root user, I can su to every other available user ...
4
votes
1
answer
276
views
should I leave modifications on /etc/default/intel-microcode and changes in revision number?
I have a quad-core intel machine having i5-7400 CPU @ 3.00GHz .
Recently, Intel introduced a new bunch of updates for machines affected by the spectre vulnerabilities.
One can see the changelog.gz ...
27
votes
3
answers
12k
views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=...
0
votes
1
answer
40
views
Can a Linux partition unnoticeably create files in another partition and, if, how can I prevent it?
Is it possible that my Linux partition creates files in another partition with me not noticing it?
If yes, how to prevent it?
Background:
Manjaro partition encrypted, bootloader on Manjaro, swap ...
1
vote
0
answers
161
views
Is there something like HTTP Digest access authentication for SSH?
Apparently, SSH does send (albeit using an encrypted connection) the client's login password to the server if password authentication is being used instead of a pair of public and private keys: Does ...
1
vote
1
answer
357
views
Determining source of ulimit change
I have a server built with AWS OpsWOrks, so everything is in configuration. There is a process whose ulimit is set to 4096, as checked from /proc/$PID/limits. This process runs as root. I ran the ...
2
votes
2
answers
4k
views
How often to update Arch Linux? [closed]
Outside of announcements about critical security flaws, is a period of one month between Arch Linux updates (pacman -Syu) dangerous in terms of security?
3
votes
3
answers
1k
views
What are the strengths and weaknesses of the ssh-keygen algorithms and is one of them the most secure?
I was wondering about the different types of keys you can create with ssh-keygen -t (dsa | ecdsa | ed25519 | rsa | rsa1). Since different types are offered I assume that each has a specific advantage ...
0
votes
1
answer
165
views
Centos SSH & SFTP user restriction to specific directories
I am managing a server running Cantos 7. Some users login to the server via ssh/sftp for development. For them i have created a user devel. For security reasons, i need to confine them to certain ...
2
votes
0
answers
2k
views
sshd_config: using only the most secure ciphers, KexAlgorithms, MACs
In /etc/ssh/sshd_config I am using the following configuration settings. Can this be further hardened?
KexAlgorithms [email protected]
MACs [email protected],hmac-sha2-512
...
2
votes
1
answer
221
views
RKHUNTER does not recognise common options
At the bottom of rkhunter.conf (I also tried placing it separately in rkhunter.conf.local), and after checking for invisible chars,
Unknown configuration file option: CRON_DAILY_RUN="false"
...
0
votes
2
answers
70
views
Recommendation for securing a external hard disk
I have lost dates (film files and docs) on my external hard disk with dd (hd was on ext4 format, 2TB and had only videos and some files). I "restore" them with PhotoRec, with bad quality... Because I ...
2
votes
1
answer
253
views
The password of previously encrypted volume got changed by the Debian installer
I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community.
Short version of the issue: ...
1
vote
1
answer
133
views
Xorg: Having authenticated in X as a remote user allows me to have access to another users' applications?
I'm trying to run a docker container (for security reasons) from which I want to see a GUI application.
I'm between two options at the moment, I'm not sure if I should forward its traffic to my X ...
1
vote
1
answer
2k
views
Unauthorized access to cron
I was hacked this morning!
Does anyone have an idea of what the entry of the crontab below might mean?
1st They created a dir structure
.rsync/
├── a
│ ├── a
│ ├── anacron
│ ├── cron
│ ├── ...
11
votes
2
answers
1k
views
FreeBSD package repo - how to do manual signature verification?
I'm trying to verify a signature of a package on the FreeBSD package website
wget http://pkg.freebsd.org/FreeBSD:11:amd64/latest/digests.txz
tar xf digests.txz
This gives three files: digests, ...
0
votes
1
answer
55
views
Are there drawbacks (security or otherwise) to using 'su <user>' into a lesser-priveleged user to start a web application?
My goal is to manage the startup of a number of applications with an application executed by a user with elevated permissions.
The plan is to have the startup manager (a node.js script using require('...
1
vote
2
answers
557
views
apache mod_security and performance
I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks.
The number of bots is huge, so ...
3
votes
2
answers
6k
views
fprintd-enroll works with right-index finger only
When I try any other finger with:
%> fprintd-enroll left-index-finger
Using device /net/reactivated/Fprint/Device/0
failed to claim device: Not Authorized: net.reactivated.fprint.device....
1
vote
2
answers
1k
views
Avoid Public IP based browsing of website in Apache 2.4
We are hosting a website locally. For this purpose, we have a public IP and corresponding DNS entry. We are using Apache 2.4 web-server. The website is publicly accessible without any problem. But ...
1
vote
0
answers
1k
views
How to list the packages from 90-updates-available?
The script /etc/update-motd.d/90-updates-available provides a summary of system updates, for example:
/etc/update-motd.d/90-updates-available
281 packages can be updated.
209 updates are security ...
-1
votes
1
answer
37
views
I have no firewall2 file
I have firewall2.d but no firewall2 file. I am trying to set up a lamp server but all the directions I get are for firewall2 "no d". I looked into firewall2.d but it doesn't have what they are ...
1
vote
0
answers
655
views
selinux preventing init_t access to httpd_sys_content_t
I have a systemd service file that runs a script. It is getting blocked by selinux:
type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index....
7
votes
3
answers
18k
views
Do I need to encapsulate awk variables in quotes in order to sanitize them?
As per an answer on stackoverflow, it's my understanding that encapsulating bash variables in double-quotes is a fairly safe way of sanitizing user input.
What about awk variables? For example, if ...
2
votes
1
answer
912
views
yum list-security no longer reports package as needing security update
We have an audit system that, daily, tracks packages in need of a security update using:
yum list-security --security -q 2
For better or worse, some machines are not patched timely or missed, or are ...
7
votes
2
answers
2k
views
What is the purpose of extrausers?
Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /...
0
votes
0
answers
345
views
Configure PAM to ask for 2FA token even if password is incorrect
I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the ...
1
vote
1
answer
1k
views
Securing Tomcat-Server where to set deployXML = false?
For Securing my Apache Tomcat server on Ubuntu Server 18.04 LTS,
I wanted to set attribute deployXML = false, but I don't know in which xml file. In the tomcat folder, I have the files server.xml / ...
0
votes
1
answer
176
views
Performance and security differences between Ubuntu and other linux distros [closed]
Assume I have a physical server with vanilla Ubuntu Server 18.04 LTS where I'll do some minimal configuration adjustments in iptables and /etc/ssh/sshd_config and only install docker.
Using docker I'...
18
votes
1
answer
58k
views
How do I list all sockets which are open to remote machines?
A vanilla ss -l lists (on my current machine) lots of open sockets, with various Netid types and many of which are only listening on localhost.
How do I get a list of all and only those sockets ...
1
vote
1
answer
511
views
Is minissdpd known to have been auditted for security, at a similar level to avahi-daemon?
Ubuntu have or had an effort, sometimes described as No Open Ports for the default install.
Exemptions are made for the DHCP client (otherwise you break networking for everyone), and for Avahi. Of ...