Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

64
votes
8answers
66k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
1
vote
1answer
32 views

Security - Runing Daemon, program as root or user vs sudo su

I have some questions about Linux security: Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user ...
1
vote
0answers
12 views

Need Help to Solve Screenlock Bypass Issue for Expired User Account

I have created a script that I deploy to my children's computers via Salt. The script implements allowed working hours and has worked well, but one of my children have found a way of bypassing this ...
0
votes
1answer
19 views

How does JetBrains PyCarm IDE put files into directories outside of ~/ despite being run without sudo?

PyCharm is a lovely Python IDE by JetBrains that can be downloaded here. I have downloaded the free community edition, extracted (with sudo) it into /opt/jetbrains/pycharm and run (without sudo) ...
1
vote
0answers
19 views

How to view WIFI devices names and signal strength [duplicate]

I want a cli utility or script that shows all the Wifi devices or hotspots or access points and their signal strength. I want to log this data using Python. I will write the logging script myself. ...
0
votes
1answer
52 views

How would pressing backspace 28 times break Grub2 [duplicate]

I just came across this article about how pressing backspace 28 times on the grub screen. Since most mainstream media just says this happens, I've been unable to find anything that explains how it ...
0
votes
1answer
31 views

Is there any concrete risk involved in using the same password for root, kde wallets and key rings?

To make it easier I decided to use the same password for root (su(do)), kde wallet (KDE desktop) and keyring(s). No one has access to this password in "real world" (given that the computer is ...
1
vote
1answer
37 views

How to track who added sudo privilege to a user

I have a LDAP user named "ciadmin" created on the Red Hat based system without sudo privlidges. Somehow this user now has sudo privileges and can basically become root on the system. I want to track ...
43
votes
5answers
39k views

What is the point of sshd “UseDNS” option?

I know what it does, but i don't know why. What attack(s) does it prevent ? Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
3
votes
1answer
22 views

Monitoring ports on ongoing connections

I have a vps server that is blocking me every hour via ip with its firewall. Looking the logs several messages like these where found: Dec 16 13:52:08 srv kernel: [17226167.610181] Firewall: ...
0
votes
2answers
47 views

set up secure connection over SSH

I'm setting up a server application which requires to establish a secure connection over SSH2, e.g. a client must open SSH2 connection to the server to reach specific application: % ssh -s -p5000 ...
1
vote
0answers
16 views

Benefit of using multiple checksums for a group in AIDE

What are the benefits to having all md checksum functions specified for a group when running AIDE? For example, what is the difference between defining the first line and the second line with less md ...
0
votes
0answers
46 views

Block IP Fragmentation attack using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
1answer
34 views

ARP Spoofing in Data Center

I have a dedicated root server. I noticed strange connections from 255.255.255.255 in iftop. Because of that i tried to investigate it. I runned the following command: tcpdump -i eth0 ether ...
0
votes
0answers
15 views

How can I encrypt disks in Mint-17 without destroying the data

I have a mint-17 machine with 2 disks managed through lvm. I would like to encrypt the disks. I need to keep the data/apps intact. Is there a way in mint if I could just encrypt the drives or ...
1
vote
2answers
46 views

Is UFW behind a firewall(ed) gateway router necessary

Is it really necessary to run UFW behind my Gateway Router which already has Firewall/Port rules? In this example, I am discussing running UFW on an Internet Accessible (Linux) Server that is behind ...
15
votes
4answers
5k views

How to detect and remove a Linux trojan?

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd) Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
116
votes
9answers
12k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
5
votes
1answer
134 views

How does the kernel prevent a malicious program from reading all of physical RAM?

If I write a program that tries to read memory at every possible address, and I run it on a "full" Unix, it will not be able to access all of the physical RAM. But how does the operating system ...
4
votes
0answers
51 views

How come I can login to another person's session over vnc just by changing the port number?

I have a user account on a server administered by someone else. I don't have root access. The server is CentOS 7. I couldn't connect over vnc on the usual port I use, so I ssh'd into the server and ...
0
votes
0answers
31 views

When have software mirrors been compromised before?

Stemming from this answer Mirrors can be compromised (this has happened in the past). It's easier to watch a single distribution point. If an attacker managed to upload a malicious package ...
0
votes
1answer
181 views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
14
votes
3answers
749 views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
1
vote
1answer
61 views

Connect to WiFi without storing password (Raspbian)

I notice WPA_GUI has saved my WiFi password to /etc/wpa_supplicant/wpa_supplicant.conf. The unit I'm trying to set up is a shared use system on enterprise WiFi that logs on with a user's account, so ...
0
votes
1answer
16 views

Value of nmap option

I've found in some docs of port knocking, that it is used the option --host-timeout I don't understand why is 201 assigned to it? e.g.: nmap -Pn --host-timeout 201 --max-retries 0 -p 7000 ...
1
vote
2answers
79 views

What kind of data is stored in the ext4 file system's journal?

The ext4 file system has a feature called has_journal. In the dumpe2fs output, we can see something like this: # dumpe2fs /dev/sda2 | grep -i journal Journal inode: 8 Journal backup: ...
14
votes
1answer
299 views

Why does ArchLinux keep some users/groups after package uninstallation?

I've noticed that after uninstalling the postgresql package in ArchLinux the postgres user and group are not removed automatically. The same is true for some other packages. Investigating this ...
5
votes
1answer
995 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
13
votes
2answers
509 views

How can I be sure that a directory or file is actually deleted?

I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later. How can I ensure that a directory I had deleted will actually be removed from the disk? Are ...
20
votes
6answers
27k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
8
votes
5answers
1k views

how do I wipe a server that I don't have physical access to?

I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
14
votes
7answers
9k views

What's the best way to format a HDD in Linux in order to leave no trace?

I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
3
votes
2answers
88 views

Can users in a group access a file that is in another user's home directory?

I have 3 users A,B and C inside a group 'admin'. I have another user 'D' in whose home directory, there is a project folder. I have made D as the owner of that folder and assigned 'admin' as the group ...
1
vote
2answers
40 views

Symbolic link in the form of user@hostname.6912:144780xxxx

I just noticed a symbolic link named .#tmp.tmp# in my home directory (not created by me) and it pointed to user@hostname.6912:177780xxxx where the x's are additional numbers. A google search revealed ...
0
votes
0answers
11 views

Folder Permission on Storage Mounted by User [duplicate]

I'm having trouble with an external hdd. Let us say there're two users; user, guest. Let the external storage be called hdde. User has automagically mounted hdde in Ubuntu (for some reason it's ...
0
votes
1answer
35 views

How do I bind webmin to the 127.0.0.1 address?

How do I bind webmin to the localhost address? I'd like to be able to do this so that I can secure all the admin services on my TurnKey Linux machine by binding all of them to the localhost address ...
1
vote
0answers
56 views

UPDATED:Replace Firewalld with system-config-firewall-tui on CentOS 7

Hey All I have a question regarding firewall config on CentOS 7. What I have done Disabled firewalld with systemctl stop firewalld.service Installed and configured system-config-firewall-tui ...
1
vote
2answers
24 views

How is OpenSSH sftp jail/chroot working?

This question is actually too broad... What I really want to know is whether or not it actually chroots and, if so, how a SSH user deamon[1] can be launched in that jail in spite of the obvious lack ...
14
votes
1answer
737 views

Why can I list other users process without root permission?

Using ps -aux or top, I can list other users running process, but i'm neither running as root or making use of sudo, why ?
3
votes
1answer
131 views

OS X FileVault 2 duress password

I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after ...
2
votes
1answer
74 views

Is it possible somehow to tell if a laptop is moved in a bash or python script?

I'm trying to figure out if there's a way to use a bash or python script to tell if my laptop gets moved. I had the idea of using wifi signal strength to do it, but the problem with that is that you ...
0
votes
2answers
43 views

How block all request as ServerIP:Port by iptables

I see many http ddos requests to my server as serverIP:80. Its possible to block all incoming requests to myServerIP:Port?
3
votes
1answer
77 views

How to import OTR key into Pidgin?

How can I import an existing OTR key (i.e. from another Pidgin instance) into Pidgin (here version 2.10.9) with installed pidgin-otr plugin? I tried just copying ~/.purple/otr.private_key and ...
2
votes
0answers
33 views

Microkernel (e.g. GNU Hurd) more secure than monolithic kernel (Linux)? [duplicate]

I would like to understand (in relatively layman's terms) if and how a microkernel such as the Mach-based GNU Hurd is more secure than a monolithic kernel such a Linux. Additionally, does a ...
3
votes
0answers
35 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
1
vote
2answers
48 views

Audit simultaneous logins in AIX

We are in a banking enviornment and our core system is based on AIX. Multiple users are logging in with the same userID at the same time using SSH. I know I can see who SSHed into the system from ...
2
votes
1answer
31 views

Should I generate the SSH key pair to give temp access to someone, or accept their public key?

I want to give an external user temporary SSH access.. Should I generate the key-pair and securely give them the private key. Or should I accept their public key. ? Advantages of the first ...
2
votes
3answers
15k views

OpenVPN - Socket bind failed on local address [AF_INET] IP:1194: Cannot assign requested address

How get it resolved? I am trying to start the openVPN server so that i can login remotely using username: demo and password: demo, but openVPN server is failing to start. What am i doing wrong, how ...
1
vote
2answers
60 views

reset system file permissions, owners and groups

Mac has a utility that checks permissions of files installed on your system to make sure they have the correct permissions as per an installation. Is there something like that with LinuxMint. I am not ...
0
votes
1answer
54 views

Procedure to analyse if a process is hacked/cracked

By a pure casualty, I discovered that a process is taking 100% of one core sometimes when I am away of my computer: When using the CPU, it is below 1%, but when the computer is IDL, meaning the screen ...