Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
0answers
30 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
3
votes
1answer
58 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
8
votes
2answers
9k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
1
vote
2answers
62 views

How Does Whonix Keep The User Anonymous?

How does Whonix Linux keep a user secure? I am aware of how it works in terms of the Gateway which uses Tor, but how does the Whonix workstation ensure nothing is logged, or stored, on the OS and no ...
1
vote
1answer
19 views

What are these %(…)s strings in fail2ban's jail.conf file, and how do they work?

In setting up fail2ban there are what appear to be variables at the top of the jail.conf that look like this: mytime=300 . . . [ssh] bantime=%(mytime)s Or in this more complicated form like this: ...
1
vote
0answers
11 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
28
votes
4answers
1k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
2
votes
1answer
148 views

Do I have thousands of attempts to breach my system in this log from logwatch?

I'm setting my systems up to send me reports by email. I'm posting one log report (see below). This log shows that there are thousands of attempted break-ins. Questions: I have denyhosts and ...
2
votes
1answer
36 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
32
votes
4answers
4k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
0
votes
1answer
29 views

Not to ask for grub password

I set a superuser and password for grub in Ubuntu and whenever I turn my machine on it asks for username and password... I want when I hit e on my keyboard just asks me for username and password... ...
9
votes
1answer
215 views

Why does the location of Enviroment Variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run ...
1
vote
1answer
51 views

apache mod_security and performance

I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks. The number of bots is huge, so ...
0
votes
1answer
91 views

I stopped MiniSSDPD, will something bad happen?

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" ...
0
votes
1answer
32 views

how many password generators are there in debian and how to know which are good

I know of two password generators in Debian. The first one which I have used is apg and it seems to generate some good passwords. $ apg -m 15 -M SNCL RefGav:quedTut7 {Shtetmigdybig1 ...
10
votes
2answers
1k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
0
votes
0answers
38 views

ubuntu linux - security between applications

When I run a Ubuntu Linux on my machine, and if using only 1 user account, most of the applications executed are using the same uid. I want to know what risks do applications face in this ...
-1
votes
1answer
39 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
2
votes
0answers
24 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the ...
2
votes
1answer
28 views

How to verify one file of a package, not the RPM itself

For instance, can I somehow use rpm to verify that /etc/pam.d/system-auth is unchanged since it was installed on the system? I know I can do this with an entire RPM, but I want to know if I can do ...
0
votes
2answers
42 views

Debian system with encrypted data that can be decrypted only from a remote server

This question is about the design of a service I want to setup. Description My purpose is to provide a client box which connects to a server and provides some features. The client box is a small ...
7
votes
4answers
205 views

Where can I “hide” easter eggs for students learning about Linux security? [closed]

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
4
votes
1answer
34 views

Preserve evidence of intrusion / deleted executable?

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, ...
3
votes
3answers
81 views

SSH - Is it possible for an SSH session to take complete control of the client? [duplicate]

When I open a SSH session on my terminal to a remote server, is this only a virtual terminal, or is it possible for the SSH server that I am connected to to "take control" of my terminal? For example, ...
1
vote
1answer
88 views

Chkrootkit found alot of suspicious files and directories, and /sbin/init INFECTED

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and ...
1
vote
1answer
53 views

SSH key-only remote login, is disabling password a good practice?

I need a maintenance user which only requires a remote login. I'll preferably use only public keys to login into the account. I thought of just creating the user with useradd myuser, adding later the ...
6
votes
9answers
11k views

How do I write a test for system login?

I've written a Python CGI script that invokes bash commands, and it needs to test for a successful login on the host. How do I write a test for that? For example, could I create a bash script that ...
0
votes
0answers
27 views

Why there are two different shadow files preset in /etc [duplicate]

I am running ubuntu 12.04 on rackspace cloud. Somehow it has two shadow files /etc/shadow /etc/shadow- I know about the first being used for password protection but where second came from ? Can it ...
6
votes
2answers
136 views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...
3
votes
1answer
79 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
2
votes
3answers
88 views

Are there network connections that don't use the WiFii card or the Ethernet port?

I see many connections like when I use netstat, are they all to the internet? Are there any connections to the internet or other things that aren't forthcoming? I guess what I'm asking is what does ...
9
votes
4answers
6k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
12
votes
5answers
784 views

How to Determine the IP Address of who logged into Root?

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.
0
votes
1answer
74 views

What to make of system scans reported by psad

My system logs show that psad detects scans like this every minute. psad: scan detected: 192.168.1.10 -> 192.168.1.1 udp: [53] udp pkts: 2 DL: 2 If the first address is mine, and the second ...
2
votes
1answer
35 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
3
votes
3answers
64 views

downloading debian securely

I have a couple of questions on getting a genuine, unmolested version of Debian. MITM attacks are very real and many parties would love to hand you their own, backdoored version of software. I know ...
21
votes
4answers
945 views

Is there any way attacker could use mkdir to compromise a system?

I'm setting up a restricted user account for user ricardo, a troublesome user on my system. I want to grant him the right to make directories using sudo, which he sometimes needs to do. I'm ...
6
votes
2answers
190 views

Is there any issue to put / as a home directory of root user from security point of view?

Is there any issue to put / as a home directory of root user from security point of view instead of /root
1
vote
2answers
60 views

Secure the content of a hard disk

I have to prepare a computer to give away, and I do not know who is going to use it. The computer has Debian installed, and the HDD is entirely encrypted. All users have their storage on the server. I ...
0
votes
0answers
41 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
16
votes
7answers
14k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
1
vote
2answers
108 views

Game server hosting and security

I'm working on a small controlpanel for a hobby project of mine, which is supposed to set up game servers. But I have some concerns regarding security that I would like some input on. My first idea ...
1
vote
3answers
5k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
1
vote
2answers
37 views

How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own

How would you assign read-only permissions to run ls -l /proc/{PID}/fd for PIDs (processes) you running as another user. Ideally, you wouldn't be able to do anything else and you would not have ...
11
votes
2answers
2k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
9
votes
2answers
2k views

Automatic security updates on Debian squeeze server

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
6
votes
3answers
2k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...
2
votes
3answers
1k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
6
votes
1answer
106 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
4
votes
3answers
81 views

How to securely delete a directory without leaving a trace?

I already know that using shred will overwrite my files in such a way that leaves them unrecoverable. However shred can't be used to hide directories. Error Message: failed to open for writing: ...