Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
114 views

mount other encrypted volume on wrong password entry

I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine. The problem A possible attacker will ...
5
votes
7answers
556 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
1
vote
1answer
73 views

How do I isolate my file system data from another system root?

I have a linux machine(kubuntu 13.04) A my friend asked me give him an account with being able to use sudo. So, I made an account for him and put the account in /etc/group for him to use sudo I don't ...
-3
votes
1answer
316 views

Break write permission for non root user?

Can non root user edit files he/she doesn't have access to or create new a file in a directory he/she doesn't own? Is there a way to do that? P.S : I know if root user or file owner gives him write ...
9
votes
0answers
5k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
3
votes
1answer
428 views

Is it a bad idea to add myself to the sudo group?

Members of the sudo group in my Debian install can execute anything without entering a password. This is convenient, but seems like a bad idea. NOTE: My computer is an ordinary desktop, not a server ...
5
votes
1answer
363 views

How can I find the Secure Attention Key (SAK) on my system and can I disable it?

In answer to My process was killed but I cannot understand the kernel notice, I was pointed to some documentation on the Secure Attention Key (SAK) on Linux. I have a embedded system generated using ...
2
votes
3answers
668 views

denyhosts is blocking existing users from logging in from unknown (new) IP addresses

I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict. I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config ...
0
votes
1answer
62 views

Random file accesses to server's ip

[Sat Jun 22 13:07:06 2013] [error] [client 208.80.194.26] File does not exist: /[removed]/...
1
vote
0answers
256 views

Reverse ssh-agent forwarding and unlocking remote keys with your local keys

So the following two things should both be possible to do with ssh the question is just how difficult they would be and I'm hoping someone can give me an easy answer. 1) Suppose I have several ...
4
votes
2answers
11k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
0
votes
1answer
163 views

Is there any tools which can be used to make ports available from any firewall network?

I have been testing my application which has TCP/UDP ports for peer to peer with the help of server signalling commands for making communication, that works when I have Public IP or Lan IP and not ...
2
votes
1answer
4k views

How to execute php file as different user securely?

I want to confirm that my thoughts are correct as this is about security matter. We have web based application which is using db2 database. db2 runs under the db2inst1 user. Now we want users of the ...
1
vote
1answer
33 views

Do live (versions of) unix distributions ever automatically pick up config info from a OS already installed on the machine?

Maybe this is a silly question, the answer is probably no; but I gotta ask. For example, if I have an Ubuntu Live USB running on a machine with Ubuntu already installed, might the Live OS ever look ...
1
vote
1answer
165 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...
4
votes
5answers
2k views

Protect folder from sudoers

Is there an ability to not allow sudoers view your folder (only you and root can access folder)?
6
votes
2answers
1k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
1
vote
1answer
115 views

Ninja privilege escalation problem

I have a problem with ninja. I think I have configured it correctly. However, when I type in su test to login as test and then run sudo -i the log shows that test is in the ninja group when in reality ...
4
votes
3answers
1k views

Securely feeding a program with a password

After understanding the problem with using a password in the command line, I need to find a way of feeding a program with a password without it being a problem (without the password being recorded ...
29
votes
3answers
3k views

Why shouldn't someone use passwords in the command line?

Why do people fear writing passwords in the command line? The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
2
votes
2answers
560 views

Does PHP exec() store the executed command anywhere?

Suppose I have the following code in a PHP web application. $encrypt ? $password = generatePassword($passwordstrength): $password=""; $estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo"; if($...
5
votes
2answers
13k views

Allow a specific user or group root access without password to /bin/date

As the title would suggest, I'd like to give a user or group full root access to the /bin/date command, including any manner of arguments as defined in the man pages. I understand /etc/sudoers ...
2
votes
3answers
761 views

I have installed Linux distribution. Do I need to set root account or the user account is enough?

I have these credentials that I am using for logging in with my Linux distribution (Ubuntu 13.04) when starting the computer: james myawesomepassword123 I type the password on the login screen and ...
4
votes
2answers
515 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
3
votes
1answer
530 views

ufw firewall rules for security.debian.org

What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)? My understanding is ...
0
votes
1answer
4k views

fopen: $JOHN/dynamic.conf: No such file or directory

I have an unshadowed db.txt file: [root@SERVER ~]# rpm -qa | grep -i john john-1.7.9-1.el6.rf.x86_64 [root@SERVER ~]# head -1 /etc/issue Scientific Linux release 6.3 (Carbon) [root@SERVER ~]# cat db....
0
votes
1answer
72 views

Let pam module use hostname -s

Our hostname command gives back the servername.domain. This is in conflict with our authentication mechanism with our Active Directory. Is it possible to let the pam module use hostname -s (the ...
0
votes
2answers
119 views

are daemon tmpfs executables copied unencrypted to memory upon execution? (prevent if so?)

When a daemon is executed, is the executable copied to memory? If so, can it be copied encrypted? If not, is there a way to prevent the executable from being copied to memory? The executable is ...
2
votes
0answers
146 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
3
votes
3answers
3k views

Encrypting loopback images without using a loopback device

I'm trying to design a firmware update system for an embedded Linux system. My plan is to send an image that can be mounted on the target system, so I don't need to unpack the entire file. I also want ...
4
votes
2answers
2k views

Disadvantages to having www-data able to log in

I run a tiny web server basically just for hosting small data projects and files. This server has a public IP address. I would like to be able to FTP in and upload files directly to /var/www/*, and ...
0
votes
1answer
226 views

Iptable rule to ssh over the internet

I've a server abc.example.com and a remote desktop zzz.example.com. I'm using SSH over a custom port, say, 6789. Whenever my firewall is off, I'm able to connect to the server successfully. But, as ...
3
votes
3answers
1k views

Privilege escalation detection?

I am not a linux/unix expert but everytime when I read about some local privilege escalation exploit (e.g. this), I wonder if an OS can detect that there is someone logging in as root (or new root ...
4
votes
4answers
13k views

What type of permissions should a user's home directory and files have?

I'm working with a fresh install of Ubuntu 12.04 and I've just added a new user: useradd -m testuser I thought that the -m flag to create a home directory for users was pretty standard, but now ...
1
vote
0answers
59 views

ufw in laptop running Ubuntu

I installed ufw and enabled it. The status is: Status: active Logging: on (low) Default: deny (incoming), deny (outgoing) New profiles: skip But, I am able to navigate the web, get emails and ...
3
votes
1answer
470 views

How to lock-down input on a Linux machine?

We need to put out a web browser to a public place to show informations. I need to lock down all the input interfaces via software methods. So ex.: if someone plugs a USB keyboard to the machine it ...
0
votes
0answers
144 views

Installing Ossec on an existing centos 6.4 machine

I have an existing machine running centos 6.4. Is it ok to install now the Ossec or it's not worth any more as the machine is already running for few months. Which is the best mechanism to install ...
3
votes
1answer
2k views

Benchmarking Apache using ab

I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers. Initially, I did the testing for 1000 ...
6
votes
1answer
274 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
0
votes
1answer
417 views

How to generate 4 WEP keys with linux commands?

I have a sagem router. this router is able to generate 4 WEP keys from a given passphrase. Example: Passphrase: "hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha" key1: ...
5
votes
1answer
2k views

Which home directory should 'nobody' have?

I'm messing around with Tiger security audits on my CentOS box, ensuring the server is fit for being online, well as close as it can get anyway. I noticed a warning about the user nobody having / as ...
3
votes
3answers
805 views

files in /proc/$PID (e.g. ssh-agent, Chrome) are not owned by user but by root

I am just answering another question here :-) and thus had a look – wanted to have a look at /proc/$PID/fd of ssh-agent in order to find out which socket it uses. But I can't. I am quite surprised to ...
1
vote
1answer
391 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
-1
votes
3answers
543 views

Is there a way to 'authorize' a command typed in by a user?

is there a way we can authorize a command typed by a user before it takes effect? For example, when a user types cp file1 file2, the command will not be executed and a root / root-equivalent user ...
3
votes
2answers
413 views

How to make sure the shell builtin echo is invoked so that its not visible in process list?

Is this going to be visible in the process listing if the below line is executed from a command line or a shell script bash -c "echo $password" or i just need to do echo $password from within ...
1
vote
4answers
3k views

Is it possible to “hide” an account from /etc/passwd?

A typical Linux system has not only accounts for the actual user(s) of the system, but also various system accounts. Is there any file like /etc/passwd for daemons, or other means resources where an ...
2
votes
1answer
417 views

Nemo: Forget encryption password

I have mounted an encrypted disk by selecting it in Nemo (1.1.2), then typing a password. I can unmount the disk using Nemo, but now it can be remounted without requiring the password. Probably ...
1
vote
1answer
522 views

How to retrieve information about locked accounts

Is it possible to retrieve info regarding to locked unix accouts? I am interested in seeing information about what date and time the lockout happend and from what hostname (pc name). I would like to ...
1
vote
0answers
536 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the web....
11
votes
3answers
35k views

How to “close” open ports?

A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1 Surprise, surprise, I have lots of active services listen to localhost: $ nmap 127.0.0.1 ...