Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

28
votes
5answers
3k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
2
votes
1answer
24 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
2
votes
2answers
104 views

How to disallow file modification time change for non root users

I don't want anybody to create a file then change the creation date to backward date(For example using touch or system call). In my Ubuntu hosting account I'm getting many hacked php code getting ...
3
votes
1answer
56 views

Scan ~/Downloads on new file creation

I want all new files added to ~/Downloads (and sub-folders) to be scanned with clamscan. When using Firefox on other OSes/Machines I've noticed that downloaded files sometimes get automatically ...
5
votes
1answer
48 views

Sterilize PDF files

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious ...
0
votes
1answer
171 views

Is my linux mint box vulnerable to Shell-Shock attacks? How might I remedy that? [closed]

Is it safe to use Linux Mint now, with ShellShock existing? If not, what can I do to use Mint safely?
1
vote
2answers
40 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
8
votes
3answers
249 views

Trap: can't su as root, can't change group to wheel, ssh as root prohibited

Is this a trap? I made these steps in FreeBSD 10: 1) ssh as root prohibited 2) logged as user 3) su as root 4) as root chsh changed name of user "user" to "luser" 5) exit from ...
-4
votes
1answer
33 views

Which Linux should I chose for penetration testing and networking [closed]

I am fairly new to networking and penetration testing, however, I'm really interested in the field and would like to know which distribution of Linux would be best to work with for security ...
1
vote
1answer
873 views

SSL handshake failure with Shibboleth [closed]

I am using Shibboleth for single user authentication and it needs a ssl configuration which facilitates the user authentication process. Before it was working fine but now I am facing a SSL handshake ...
2
votes
2answers
51 views

Secure Remote Backups Using Duplicity

The recent take-down of codespaces got me thinking about off-site backup processes (which I currently perform manually with password entry). I have been reading tutorials showing how to automate ...
2
votes
1answer
40 views

Remove ex-admin user account and grant privileges / permissions / ownership to another

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a ...
8
votes
2answers
14k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
14
votes
6answers
5k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
3
votes
2answers
45 views

Lock system after awake suspend (incl. forced-shutdowns system after countdown)?

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and ...
0
votes
0answers
21 views

Is there a solution for scanning webserver files for malicious code?

I have seen several times people move code into web servers now that had malicious code embedded into their HTML, php and other documents. These then get served up from the new server until they are ...
0
votes
3answers
57 views

last command only shows few days worth of logins

I often use thelast command to check my systems for unauthorized logins, this command: last -Fd gives me the logins where I have remote logins showing with ip. From man last: -F Print full ...
0
votes
2answers
36 views

If I install malicious software what may it do? [closed]

If I software in a deb file and I do sudo dpkg -i file.deb will it execute code from the package and possibly wreck my system? If I log in as testuser and execute the software (simply thebinary on ...
1
vote
0answers
45 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
8
votes
1answer
1k views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
91
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
2
votes
1answer
33 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability?

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
1
vote
1answer
40 views

Latest libxml2 port to RHEL4

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention ...
6
votes
2answers
3k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
5
votes
1answer
235 views

How can I find a Ubuntu package to use with Amazon EC2?

I'm looking to set up a new server on Amazon's EC2 and I wanted to use Ubuntu 11.04 is it is fairly new but not too new. I previously used 10.10 which I think is also very stable and time-tested. My ...
18
votes
3answers
5k views

Why does the 'bin' user need a login shell?

During an audit of /var/log/auth.log on one of my public webservers, I found this: Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
1
vote
0answers
50 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
-1
votes
1answer
122 views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
141 views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
18
votes
11answers
4k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
1
vote
3answers
108 views

Securely passing user input to command

I have a daemon daemon running in Server A. There, there's an argument based script to control the daemon daemon_adm.py (Server A). Through this script I can insert "messages" to daemon coming from ...
0
votes
2answers
58 views

ClamAV found virus, if I should delete this virus? [closed]

ClamAV has found two viruses on my server. Is this a virus? Should I delete it? /tmp/back: Perl.Shellbot-8 FOUND /var/tmp/back: Perl.Shellbot-8 FOUND
2
votes
2answers
44 views

What is best and secure way to save application settings?

Let's say I have an application which has plugins, daemons, etc. Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is ...
0
votes
0answers
52 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
6
votes
3answers
637 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
8
votes
2answers
8k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
7
votes
4answers
20k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
0
votes
0answers
88 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
8
votes
2answers
162 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
3
votes
1answer
33 views

How can I lock down a user account to the point that it can read/write/execute as little as possible?

I would like to lock down an Arch Linux user account to the maximum extent possible. The only functionality required for the account is to accept a non-terminal SSH session which allows the client to ...
0
votes
0answers
18 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
4
votes
1answer
25 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
1
vote
0answers
23 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
1
vote
2answers
196 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
2
votes
0answers
30 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
0
votes
0answers
63 views

Permission denied tmp dir on STIG RHEL

I am writing a program for a DISA STIG version of Red Hat Linux 6.5. I wrote a shell script to do self extracting on the program and when it self extracts put temporary files in the tmp directory that ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...