Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

3
votes
1answer
389 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
8
votes
2answers
1k views

What encryption does vim -x use?

I read man vim, :h -x and :h encryption none of this actually says what algorithm it's encrypted with.
1
vote
5answers
397 views

Does verifying packages enhance security and/or stability of a system?

RedHat/CentOS and Ubuntu both provide packages to verify the contents of a package. CentOS uses rpm -V. Ubuntu uses debsums. I've spoken to admins who run these tools to verify the packages on their ...
6
votes
2answers
823 views

I/O-overhead of dm-encrypted device?

What would be the Read-/Write-overhead when using dm-crypt (LUKS) as full disk-encryption (including root partition) on a Linux-Desktop (Ubuntu)? I plan to stack it like so: LUKS > LVM > ext4 The CPU ...
17
votes
2answers
4k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
2
votes
1answer
759 views

How to restore GnuPG key after reinstall?

I know that GnuPG is all about security, thus it's not giving many chance of retrieve private keys (otherwise anyone could do it) but I've got a private key, and my own rev.asc file. I had to ...
13
votes
3answers
3k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons ...
4
votes
1answer
232 views

What's the best way to configure shared filesystem directories? (beyond standard unix perms)

I have multiple users on my system. I'd like to have shared directories like music, video. pictures etc. The problems is that I want users to be able to write any new files to any directory, but not ...
15
votes
3answers
1k views

Why change default ssh port?

I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
2
votes
2answers
447 views

Install from RPM, then files change. How can I see the differences?

This is a RedHat Enterprise 5.5 system. I ran a verification check against an RPM, and it looks like two files have changed: # rpm --verify shadow-utils S.5....T c /etc/default/useradd S.5....T c ...
6
votes
4answers
4k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...
5
votes
4answers
320 views

Is it possible to use pendrive as key for Linux system

I want to give high security for my linux box. So i planed to use my pen drive as key for my linux box. How can i do it ?
4
votes
3answers
248 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...
46
votes
2answers
11k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
2
votes
1answer
674 views

Start X as a user other than root

I know some distro's (Moblin? ) have X starting as a user other than root already... What is required to do this? What steps need to be taken? I don't think it matters but I think X is started by KDM ...
5
votes
2answers
470 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
17
votes
5answers
2k views

Does installing and using Wine open up your Linux platform to windows virus'?

Just wondering if installing wine might open up a fairly solid linux desktop to the world of windows virus'. Any confirmed reports about that? Would you then install a windows antivirus product ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
7
votes
4answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
6
votes
2answers
251 views

Lock some accounts during some time periods

Is it possible to lock some accounts in order to be accessible only during specific time periods? For instance the account joe should only be accessible during office hours.
2
votes
1answer
449 views

How to update gnome keyring password?

Last weak I updated my password on my laptop. Then every time when I logged in, it would prompt for my old password to open the keyring for network manager. To fix this in a terminal I use rm ...
13
votes
11answers
1k views

Concern about logging in as root overrated?

For personal linux on my personal notebooks, I've usually set my environment to autologin as root even under X or lower runlevels. I've found my workflow is very pleasant and fast, without any ...
2
votes
8answers
2k views

How to give a normal user permission to change root password

Please do not ask why, but is it possible to do it? p/s: I know it's not a good thing, let's just say someone from the top management who is computer illiterate want some sort of control over the ...
13
votes
4answers
444 views

Books/Guides for Securing a Server [closed]

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). The problem is that I'm ...
4
votes
3answers
389 views

Something like pwgen-win for linux?

Is there some kind of pwd generator for Linux that has a nice GUI and options like this one for Windows? I know that there is pwgen, but as far as I know it does not support mouse/keyboard entropy and ...
7
votes
4answers
2k views

How to best encrypt and decrypt a directory via the command line or script?

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line. Ideally, ...
10
votes
5answers
1k views

Best way to do full disk encryption?

I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
8
votes
3answers
4k views

How to make a folder private?

I'm using Ubuntu with several users and I want to make folders viewable just for a specific user. Any idea how to do it?
11
votes
8answers
4k views

What are some common tools for intrusion detection? [closed]

Please give a brief description for each tool.
3
votes
1answer
330 views

Learning about iptables: Is this Slicehost example any good?

In preparation to eventually launch my first website, I've been playing with Ubuntu Lucid Server in a VM on my WinXP machine. I've been alternating between the Linode and Slicehost tutorials/articles ...
15
votes
2answers
6k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
18
votes
11answers
4k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
62
votes
5answers
37k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
5
votes
2answers
2k views

Use wpa_supplicant without plain text passwords

I'm running gentoo on my laptop, and I'm currently using wpa_supplicant to handle wifi. My configuration works and I can connect, but it is required to type in the plain text password into the ...
23
votes
1answer
7k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
10
votes
4answers
173 views

What is Linux for SET FILE/ERASE_ON_DELETE?

In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment: $ SET ...