Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

8
votes
4answers
5k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
7
votes
2answers
528 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
4
votes
1answer
72 views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...
1
vote
2answers
59 views

Is it bad to select remember me option in the browsers of a compromised machine?

I was reading an article on how to sniff network packets. (of course for knowledge purposes only). I came across these particular lines. For instance, say I was sniffing traffic on the network, ...
1
vote
1answer
30 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting ...
4
votes
3answers
365 views

Something like pwgen-win for linux?

Is there some kind of pwd generator for Linux that has a nice GUI and options like this one for Windows? I know that there is pwgen, but as far as I know it does not support mouse/keyboard entropy and ...
8
votes
2answers
7k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
13
votes
4answers
398 views

Books/Guides for Securing a Server [closed]

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). The problem is that I'm ...
0
votes
2answers
72 views

how to nsupdate remotely?

I have BIND as a DNS server, what I want is to let this server to allow me to add or remove records to a zone without manually editing the zone file and I want to do this remotely. Is this updating ...
0
votes
0answers
23 views

hydra verification before stopping

I am getting false positives when I try a penetration test on my local service with hydra: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post ...
1
vote
2answers
59 views

Secure wipe (scrub) filesystem of VPS from VPS itself

I have a VPS I'm planning to delete. This particular cloud provider makes no guarantee that the data on the drive will be wiped before giving the disk to the next person. What's a best effort attempt ...
1
vote
2answers
162 views

gvfs-mount auto password

I would like to make shortcuts for gvfs mounts (I prefer to mount from the shell). For this, it is quite necessary/convenient not to have to enter the password for the ftp:// and sftp:// connections . ...
0
votes
1answer
33 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
1
vote
2answers
33 views

List of files accessed by application

I want to install propertiary AMD driver but I would also like to know which files were created/changed by installer. Is there some application which can observe (probably by inotify) which files were ...
1
vote
2answers
2k views

Postfix, Amavis-new, ClamAV: Permission denied. ERROR

Error lines in /var/log/maillog Sep 22 12:08:20 sun amavis[4493]: (04493-09) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/spool/amavisd/tmp/amavis-20130922T052321-04493-crApLkq5/parts: ...
3
votes
1answer
82 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
2answers
59 views

/etc/init.d permissions issue

We are trying to harden our Linux Redhat 5 servers and one of the findings is for the /etc/init.d. The security finding is requiring that we chmod it to 700 or more restrictive. Please see the ...
1
vote
0answers
12 views

backupninja: password outside config file

I would like to use a dup rule in backupninja to make an encrypted remote backup. The configuration file format includes entries for the encryption and ftp password. I would like to move them out of ...
0
votes
1answer
84 views

How do you encrypt a USB drive partition with the Twofish cipher and SHA-512 hash without using TrueCrypt? [closed]

I've been trying to string together the right flags in cryptsetup: cryptsetup -y -h sha512 -c twofish-xts-plain64 -s 512 luksFormat /dev/sdx But it hasn't been working. When I enter the command ...
4
votes
2answers
315 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
1
vote
1answer
217 views

cleaning up an hacked ubuntu server

They have hacked my VPS and changed the root passowrd. Fortunately my provider has reset it for me and now I got control back again. The thing is that now I would like to make sure the don't have ...
11
votes
2answers
2k views

How to avoid escape sequence attacks in terminals?

Reading the details of CVE-2009-4487 (which is about the danger of escape sequences in log files) I am a bit surprised. To quote CVE-2009-4487: nginx 0.7.64 writes data to a log file without ...
0
votes
1answer
43 views

Execute scripts without decrypting them

I have a set of scripts (bash, ruby, python) and want to put everything into a container like file so I can deploy this container on a lot of servers. This scripts need to protect from accessing other ...
1
vote
2answers
112 views

ssh to remote server without password

I have a remote server. i planed to use public keys to connect over ssh without typing the password but the remote system rejects public key key authentication. So what is the best way to do it? What ...
0
votes
2answers
119 views

Unable to telnet public ip on port 80

We are facing a communication problem between the public and our private network. We have a Linux based web server behind a firewall and an internet router. As part of some integration, our web portal ...
43
votes
2answers
11k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
2
votes
1answer
382 views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
6
votes
4answers
2k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
1
vote
0answers
59 views

What information is sent from client to the server when a SSH connection is established?

So let's say I'm on machine A and connect to machine B, and then from there I connect to machine C (with three different usernames). So the SSH connections are: A (john) --> B (eli) --> C(bill) ...
1
vote
3answers
143 views

Moving /var, /home to seperate partition

I am in attempts to move some folders such as /var, /home to a separate partition after reading the guide 3.2.1 Choose an intelligent partition scheme I was able to move one folder successfully ...
27
votes
5answers
1k views

Execution of possibly harmful program on Linux

I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it. I was thinking ...
1
vote
2answers
47 views

Is it secure to connect remotly to Mysql using shell?

I have created a shell script to connect to a DB and do some queries: #/!bin/bash ... ... mysql -h remote -u root --password='pw' MatchingDB some SQL queries My question is : Is this connection ...
1
vote
1answer
70 views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
1
vote
1answer
33 views

Meaning of entries in /etc/securetty?

I've been given a set of entries to apply to /etc/securetty, what does each of them mean? console tty1cd / tty2 tty3 tty4 tty5 tty6 ttyS0 ttyS1 I'm especially interested in the "tty1cd /" entry. I ...
5
votes
4answers
156 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
5
votes
1answer
71 views

Why does visudo discourage other editors?

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables. It states that "There is no easy way to prevent a user from gaining a root shell if the editor ...
1
vote
0answers
14 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
9
votes
2answers
1k views

How does ps know to hide passwords?

Witness: $ ps f PID TTY STAT TIME COMMAND 31509 pts/3 Ss 0:01 -bash 27266 pts/3 S+ 0:00 \_ mysql -uroot -p 25210 pts/10 Ss+ 0:00 /bin/bash 24444 pts/4 Ss 0:00 ...
6
votes
3answers
1k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...
1
vote
2answers
3k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
1
vote
0answers
76 views

What keys are generated during Debian 7.4 (Wheezy) installation?

We are concerned lest /dev/random (or /dev/urandom) be hit too early in the installation process for adequate entropy to be developed. In a basic Debian 7.4 installation (SSH Server and basic ...
1
vote
1answer
152 views

How to copy files as Jenkins “post build” action if i don't have privileges to destination directory

I have the following users "architecture" : root access is disabled. admin user have access only to its home directory. Apache runs as root service (root is the only one that have access to ...
1
vote
0answers
26 views

I'm wondering about CUPS security. What can I do?

I run Debian Wheezy on a old Acer Aspire One ZG5 model netbook as a server. I have a printer shared to all my other systems and I'm worried about security. On the server I have IPtables set up to ...
1
vote
2answers
46 views

if an exploit is affecting MS office does it affect also LibreOffice? [closed]

This question is really annoying me a lot and I want a reasonable, certain, logical... response for it
1
vote
1answer
31 views

Limiting readers on a pipe

I want to use a pipe to pass some security credential information from "process1" to another script. I only want authorized reader processes to be permitted to read the pipe. I am thinking I will ...
1
vote
4answers
200 views

How do I search for all the folders that begin with a dot ( . )?

My server had been infected and the attacker spread a bunch of .5randomletters folders around my file system, with malicious code inside of them. I want to search for all the folders that begin with a ...
59
votes
19answers
8k views

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a ...
3
votes
2answers
91 views

In Gnome, how do I decide whether to accept a PackageKit software source?

When I try to install software in the Gnome environment of Linux (mine is openSUSE) from a repository that I have not used before, PackageKit asks me to respond "Yes" or "Cancel" to a dialog "Software ...
1
vote
6answers
426 views

Program a file to self-destruct at a given time

Does anyone know whether there is a command in linux that can set attributes to file so that the file can disappear after certain time. For example, if I set one attribute to file as "1/1/2015", so ...
1
vote
2answers
113 views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...