Tagged Questions

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
1answer
41 views

What are the potential negatives of turning on process accounting (psacct package)?

I am looking into turning on process accounting on some EL6 servers. What are the potential pitfalls of turning this on? If you mitigate storage requirements with log rotation, any reason you would ...
0
votes
2answers
50 views

Accessing Linux server via VPN or Certificate based ssh?

My company has a fairly common security setup where you need to log in via VPN, when outside the company network in order to get access to the servers. The biome is mostly Windows machines. I'm ...
0
votes
0answers
31 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
3
votes
1answer
50 views

read only symlink or something similar? [duplicate]

I created myself a NAT for home use (Ubuntu+Samba+Greyhole+Apache+MySQL+other web server related stuff). 90% of files I store there are pictures that i really don't wanna loose (that's why Greyhole). ...
1
vote
1answer
62 views

Is the data transiting through a pipe confidential?

I read the following question (Shell Script mktemp, what's the best method to create temporary named pipe?) but I'm wondering whether it is preferable to use a temporary named pipe to transfer ...
0
votes
3answers
169 views

How to add a password to a specific command

I've been searching google on how to add additional security to a specific command without using sudo. Is it possible to add on a security feature without actually using sudo? For example: Whenever ...
1
vote
0answers
39 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
3
votes
1answer
63 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
24 views

What are these %(…)s strings in fail2ban's jail.conf file, and how do they work?

In setting up fail2ban there are what appear to be variables at the top of the jail.conf that look like this: mytime=300 . . . [ssh] bantime=%(mytime)s Or in this more complicated form like this: ...
1
vote
0answers
12 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
2
votes
1answer
210 views

Do I have thousands of attempts to breach my system in this log from logwatch?

I'm setting my systems up to send me reports by email. I'm posting one log report (see below). This log shows that there are thousands of attempted break-ins. Questions: I have denyhosts and ...
1
vote
2answers
66 views

How Does Whonix Keep The User Anonymous?

How does Whonix Linux keep a user secure? I am aware of how it works in terms of the Gateway which uses Tor, but how does the Whonix workstation ensure nothing is logged, or stored, on the OS and no ...
0
votes
1answer
33 views

Not to ask for grub password

I set a superuser and password for grub in Ubuntu and whenever I turn my machine on it asks for username and password... I want when I hit e on my keyboard just asks me for username and password... ...
9
votes
1answer
216 views

Why does the location of Enviroment Variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run ...
2
votes
1answer
42 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
0
votes
1answer
219 views

I stopped MiniSSDPD, will something bad happen?

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" ...
28
votes
5answers
2k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
1answer
34 views

how many password generators are there in debian and how to know which are good

I know of two password generators in Debian. The first one which I have used is apg and it seems to generate some good passwords. $ apg -m 15 -M SNCL RefGav:quedTut7 {Shtetmigdybig1 ...
0
votes
0answers
39 views

ubuntu linux - security between applications

When I run a Ubuntu Linux on my machine, and if using only 1 user account, most of the applications executed are using the same uid. I want to know what risks do applications face in this ...
2
votes
1answer
30 views

How to verify one file of a package, not the RPM itself

For instance, can I somehow use rpm to verify that /etc/pam.d/system-auth is unchanged since it was installed on the system? I know I can do this with an entire RPM, but I want to know if I can do ...
2
votes
0answers
30 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the ...
7
votes
4answers
206 views

Where can I “hide” easter eggs for students learning about Linux security? [closed]

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
4
votes
1answer
44 views

Preserve evidence of intrusion / deleted executable?

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, ...
3
votes
3answers
89 views

SSH - Is it possible for an SSH session to take complete control of the client? [duplicate]

When I open a SSH session on my terminal to a remote server, is this only a virtual terminal, or is it possible for the SSH server that I am connected to to "take control" of my terminal? For example, ...
1
vote
1answer
110 views

Chkrootkit found alot of suspicious files and directories, and /sbin/init INFECTED

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and ...
1
vote
1answer
58 views

SSH key-only remote login, is disabling password a good practice?

I need a maintenance user which only requires a remote login. I'll preferably use only public keys to login into the account. I thought of just creating the user with useradd myuser, adding later the ...
0
votes
0answers
27 views

Why there are two different shadow files preset in /etc [duplicate]

I am running ubuntu 12.04 on rackspace cloud. Somehow it has two shadow files /etc/shadow /etc/shadow- I know about the first being used for password protection but where second came from ? Can it ...
6
votes
2answers
157 views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...
3
votes
1answer
119 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
2
votes
3answers
94 views

Are there network connections that don't use the WiFii card or the Ethernet port?

I see many connections like when I use netstat, are they all to the internet? Are there any connections to the internet or other things that aren't forthcoming? I guess what I'm asking is what does ...
2
votes
1answer
41 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
-1
votes
1answer
47 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
3
votes
3answers
66 views

downloading debian securely

I have a couple of questions on getting a genuine, unmolested version of Debian. MITM attacks are very real and many parties would love to hand you their own, backdoored version of software. I know ...
12
votes
5answers
824 views

How to Determine the IP Address of who logged into Root?

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.
6
votes
2answers
194 views

Is there any issue to put / as a home directory of root user from security point of view?

Is there any issue to put / as a home directory of root user from security point of view instead of /root
0
votes
0answers
45 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
0
votes
2answers
45 views

Debian system with encrypted data that can be decrypted only from a remote server

This question is about the design of a service I want to setup. Description My purpose is to provide a client box which connects to a server and provides some features. The client box is a small ...
1
vote
2answers
39 views

How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own

How would you assign read-only permissions to run ls -l /proc/{PID}/fd for PIDs (processes) you running as another user. Ideally, you wouldn't be able to do anything else and you would not have ...
4
votes
3answers
88 views

How to securely delete a directory without leaving a trace?

I already know that using shred will overwrite my files in such a way that leaves them unrecoverable. However shred can't be used to hide directories. Error Message: failed to open for writing: ...
2
votes
1answer
50 views

Pin Lock Screen

Is there a way to replace password lock screen in Linux (Mint Debian Edition) with a pin lock screen? Like the one found in Windows 8 for example. It's annoying/inconvenient to have to input 16 ...
1
vote
2answers
64 views

Secure the content of a hard disk

I have to prepare a computer to give away, and I do not know who is going to use it. The computer has Debian installed, and the HDD is entirely encrypted. All users have their storage on the server. I ...
2
votes
0answers
118 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
1
vote
2answers
55 views

How to set up a global interval between SSH log in attempts?

I would like to make it impossible to make more than a single remote log-in attempt in a number of seconds regardless the client IP address (except some trusted white-listed addresses perhaps). So ...
2
votes
2answers
120 views

Random named file in home directory, possibly hacked?

I am running Fedora 20, and today I found a file that looks highly suspicious in my home directory. The name of the file appears to be a base64 encoded string, but doesn't decode to anything ...
1
vote
3answers
178 views

Possible corrupt passwd file

I did a recovery of the server and reset the root password to a new one because for some reason, the original was not being recognised. It still is refusing to accept the password in ssh for root. ...
9
votes
2answers
3k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
0
votes
1answer
115 views

Faillog - unsuccessful login count in Motd

I wish to include a count of failed login attempts whenever a user logs in. I've created: /usr/local/bin/dynmotd which contains #!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG " and ...
0
votes
1answer
175 views

Create ssh root password

For some reason, after a plesk update, I can no longer login to ssh as root using my old password. I have tried to create a user with: /bin/bash & /bin/bash (chrooted) in plesk Which lets me ...
2
votes
0answers
201 views

Cannot connect to ssh server

I am having trouble connecting to my ssh server. It responds with a lengthy error message about no network etc. but it is the last message that concerns me: Sometimes, such troubles can be caused ...
8
votes
1answer
776 views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...