Content related to computer security.
2
votes
1answer
88 views
Is it possible to specify groups in /etc/security/capability.conf?
I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to ...
1
vote
1answer
82 views
LAMP Server setup for personal development
I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
1
vote
1answer
44 views
How to retrieve information about locked accounts
Is it possible to retrieve info regarding to locked unix accouts?
I am interested in seeing information about what date and time the lockout happend and from what hostname (pc name). I would like to ...
2
votes
1answer
44 views
Nemo: Forget encryption password
I have mounted an encrypted disk by selecting it in Nemo (1.1.2), then typing a password. I can unmount the disk using Nemo, but now it can be remounted without requiring the password.
Probably ...
1
vote
0answers
83 views
How to add my own created certificate authority to system trusted repositories
I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf.
Yet I can't find anything similar on the ...
2
votes
1answer
123 views
How to “close” open ports?
A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1
Surprise, surprise, I have lots of active services listen to localhost:
$ nmap 127.0.0.1
...
16
votes
10answers
931 views
How to create strong passwords in Linux?
I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
3
votes
2answers
180 views
Can AIDE scan a directory inside a directory the user doesn't have read permissions for?
I would like to use AIDE to help me verify the integrity of my home directory on a shared Linux system. I am not an administrator of this system. I have built and installed AIDE in my home directory ...
2
votes
1answer
84 views
wpa_supplicant store password as hash (WPA-EAP with phase2=“auth=PAP”)
Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext?
By "password" I refer here to the password used for phase2 authentification. I do not ...
4
votes
3answers
146 views
Can someone execute a malware by just inserting a flash disk?
I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
2
votes
2answers
102 views
How to encrypt my system such that suspend to RAM works and is also encrypted
How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
2
votes
1answer
25 views
How can I use ForwardAgent with keychain, or detect a new login?
My scenario:
I have Server A at home, and Server B at my parents house. I also have Laptop A and Laptop B at home. I do all sorts of strange ssh hops - I might connect Laptop A -> Server A -> ...
2
votes
1answer
322 views
Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?
Compare the following:
mount -t proc none ./my_chroot/proc
and:
chroot ./mychroot mount -t proc none /proc
1
vote
3answers
5k views
vsftpd fails pam authentication
Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
2
votes
1answer
48 views
Sign a module after kernel compilation
I've built a kernel in tmpfs, then I rebooted.
Now I see a message when I compile the 3rd party module,
NO SIGN [M] XXXX.ko
How can I get it signed? The key pair generated during rpmbuild is lost ...
11
votes
4answers
2k views
What are the pros/cons of the various methods to block brute force SSH attacks?
There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example:
DenyHosts
Sshguard
fail2ban
What are the pros/cons ...
1
vote
3answers
90 views
Taking away a User's Read/Write/Execute Permission
So I have a user that is able to go in /etc and read files like httpd.conf.
I would like to deny that user access to any critical locations such as /etc, /var and so on.
What would be the best way ...
4
votes
1answer
744 views
Use wpa_supplicant without plain text passwords
I'm running gentoo on my laptop, and I'm currently using wpa_supplicant to handle wifi.
My configuration works and I can connect, but it is required to type in the plain text password into the ...
8
votes
4answers
132 views
What is Linux for SET FILE/ERASE_ON_DELETE?
In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment:
$ SET ...
19
votes
1answer
4k views
Mutt: how to safely store password?
My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt?
set imap_user = "username@gmail.com"
set ...
3
votes
3answers
2k views
Fork bomb on a Mac?
I just learned about a fork bomb, an interesting type of a denial of service attack. Wikipedia (and a few other places) suggest using :(){ :|:& };: on UNIX machines to fork the process an infine ...
24
votes
1answer
458 views
What would be the best way to work around this glibc problem?
I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc).
Infact, the only binary I have left is ...
6
votes
2answers
116 views
ssh-agent: don't forward authentication for the whole keyring
I have two private ssh keys :
one to access my personnal machines,
one to access servers at my job.
I add those two keys to my ssh-agent with ssh-add.
Now, when I do ssh -A root@jobsrv I ...
2
votes
1answer
165 views
Best way to encrypt my system on an ssd
I consider to buy an ssd for my laptop (something like Samsung 830 or 840) to make the system more responsive. I want my system (at least my home partition) to be encrypted. However I know about ...
10
votes
1answer
159 views
Can entropy consumption at program start be prevented?
I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program ...
0
votes
2answers
257 views
How do I make PHP securely load files from the server root home folder on CentOS?
So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
1
vote
1answer
43 views
Having the 'id_rsa.pub' file in my dotfiles public repo securely
So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo?
I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my ...
1
vote
2answers
127 views
setuid programs don't seem to run setuid in TinyCore Linux
I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file ...
3
votes
2answers
71 views
Fully seperate two accounts without installing seperate operating systems?
Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
2
votes
3answers
230 views
Check outgoing network traffic
In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to?
I am not paranoid about security, ...
7
votes
1answer
127 views
How to use /etc/fbtab in OpenBSD to secure X11?
OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X."
How might one do this? What lines when added to /etc/fbtab would ...
1
vote
1answer
343 views
add members of wheel group, sudo access
On Fedora15, following this wiki, I added a user to wheel group, which is already in the sudoer config file.
but still I get not-a-sudoer error prompt. Should I specifically name every member of a ...
3
votes
1answer
151 views
How are loaded SSH keys referenced by name?
I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel)
It seems strange to me that it uses a name to reference the keypair - ...
4
votes
3answers
301 views
Restrict ssh login from LDAP to users who have a /home directory
I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
5
votes
1answer
138 views
What does the Chromium option `--no-sandbox` mean?
I'm running Chromium like so : chromium --no-sandbox
I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work.
Though I keep reading ...
0
votes
1answer
30 views
How to identify which application is trying to access the unixbuild server?
The error message I am seeing is:
Failed publickey for raj from 10.*.*.** port 34355 ssh2
Mar 18 05:22:34
unixbuild sshd[16956]: [ID 1000034 auth.info] Failed password for raj from 10.*.*.* port ...
3
votes
1answer
87 views
How does having /dev/fd make running shell scripts under sudo safe?
At the end of the man page for sudo, there's the following remark:
Running shell scripts via sudo can expose the same kernel bugs that
make setuid shell scripts unsafe on some operating systems ...
2
votes
1answer
60 views
Configure SSH keys for production and DR server
Here is the case, we have successfully configured SSH keys (and hence password-less SFTP connection) between ProdServer-A to ProdServer-B. It works, or so I thought still yesterday. Yesterday ...
5
votes
1answer
197 views
Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?
I've been looking for this for quite a while now but couldn't find a satisfying answer.
My scenario:
I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
1
vote
1answer
127 views
Securely reading and parsing a string from a parameter or file in bash
I've been writing a number of bash scripts lately which get variables from a parameter or from a file. Some of the scripts run as root (using sudo)
This is on my notebook, so there aren't any other ...
1
vote
5answers
157 views
How do I disable copy permissions?
Can we set permissions, on a Linux box OR for a particular directory (Scientific Linux in my case) that, one can read files but cannot copy, move or delete them?
Update: My Scenario is,
We developed ...
6
votes
4answers
2k views
How to best encrypt and decrypt a directory via the command line or script?
I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line.
Ideally, ...
5
votes
9answers
291 views
How to prevent a process from writing files
I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
31
votes
2answers
10k views
Why is there a big delay after entering a wrong password?
I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
2
votes
2answers
295 views
Disable stack protection on Ubuntu for buffer overflow without C compiler flags
I'd like to try some shell codes and I want to disable linux protections.
I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
1
vote
1answer
79 views
Ping from Outside: How do I make my system invisible?
I just did a test that told me my gateway (debian squeeze) responds when being pinged from outside.
It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes ...
2
votes
2answers
103 views
Do I need to remove all “java|jre” packages from my system to be secure from java vulnerabilities?
Currently I have these installed on my Scientific Linux 6.3:
[root@localhost ~]# rpm -qa | egrep -i 'java|jre'
java-1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3.x86_64
...
0
votes
1answer
73 views
How to Install, Configure and Use LSAT
I saw a tool LSAT that is used for Security auditing of Linux Servers. But found not much material for LSAT. Can someone please provide help of how to
Setup
Configure
Use Lsat
2
votes
1answer
85 views
Is running programs as another user useful?
After watching a talk by Douglas Crockford on security where he talks about how browsers got the right answer to the question "Who's interest does the program represent?", I wondered if it was ...
3
votes
2answers
108 views
Shredding everything: files/folders and corresponding filenames
Using find, it is easy to shred a directory's contents recursively (as discussed in this question). However, sometimes the filenames on their own carry sensitive information already. Is there a way to ...
