Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

4
votes
2answers
109 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
0
votes
1answer
46 views

UNIX Account management

Would like to know if there's some opensource solution aimed to manage and administer system authentication and RSA keys for staff, contractors and clients across the organization. My systems to ...
2
votes
1answer
57 views

How to scan a directory with a space in its name with maldet

I'm trying to scan some directories with Linux Malware Detect (command-line command maldet): maldet -a /SOMETHING\ 1/ But I get: maldet(13857): {scan} invalid path /SOMETHING 1/ I've tried ...
1
vote
1answer
831 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
3
votes
3answers
122 views

Remove passphrase from private key and set specific file mode

If I set a passphrase on my private key like so: openssl rsa -des -in insecure.key -out secure.key and I remove the passphrase like so: openssl rsa -in secure.key -out insecure.key then my ...
1
vote
1answer
55 views

wheel groups and permissions

I'm new to a lot of things Linux, so this might be basic stuff. We're thinking about setting up a wheel group and removing permissions from root. Not even sure that's possible. We are having a ...
1
vote
1answer
412 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
0
votes
1answer
26 views

Sanitise bash arguments

I have a script which takes user input and does a lot of things. One thing which I am worried about is it takes a file name and removes that file. e.g. rm -rf $arg1. A user could technically input / ...
6
votes
1answer
150 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
4
votes
1answer
108 views

SSH server listening on multiple ports with passwordless access not allowing connections to second port

I have my Synology NAS running an SSH server listening on the default port 22 and I set up passwordless authentication with a public/private key and a passphrase: From sshd_config: ...
5
votes
2answers
454 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
0
votes
1answer
198 views

How to import the official Tor GPG keys?

I am trying to install the latest Tor Browser Bundle on Arch Linux: $ makepkg --syncdeps --install [...] ==> Verifying source file signatures with gpg... tor-browser-linux64-4.0.8_en-US.tar.xz ...
1
vote
1answer
47 views

LDAP Force Password Change Through HTTPS

We have a "master" server running Suse Enterprise with LDAP that controls user's access to our systems. We want to implement a 90 day expiration policy, but the issue is that most of our servers are ...
0
votes
0answers
28 views

Bro-IDS CSV conversion

I have Bro-IDS currently operating under Centos 7. I need to convert the output to CSV format. The documentation that I have seen on this is not clear to me. Has anyone done this successfully? I have ...
1
vote
2answers
27 views

How do I install programs in /usr/local if they shouldn't be compiled by root?

Somewhere in the back of my brain is the memory of reading a cautionary internet voice warning against compiling (i.e. running make) as the root user. Perhaps it's something like this story ...
1
vote
1answer
70 views

Dubious entry in logwatch

Today I found the following in the daily logwatch of my debian server: --------------------- Connections (secure-log) Begin ------------------------ **Unmatched Entries** sg: user 'root' (login ...
0
votes
0answers
22 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
0answers
14 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...
0
votes
2answers
46 views

FreeBSD 10 and ZFS: Methods for encrypting files

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver. I'm really new to FreeBSD in general (coming from Debian Linux). I installed the system choosing ZFS with encrypted root volume ...
4
votes
2answers
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
8
votes
3answers
12k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
2
votes
1answer
34 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
3
votes
1answer
142 views

CUPS and printer security

I would like some help on securing a networked printer. Specifically, I'm interested in the following: Preventing unauthorized access to the printer: I would like only certain laptops that connect ...
2
votes
2answers
52 views

Encrypted FileSystem in VirtualBox

I'm looking for any information regarding how secure an encrypted Linux file system is when contained in a VirtualBox virtual drive on a Windows host? Specifically I'm looking for answers to the ...
2
votes
0answers
10 views

Tails OS:Network Filtering Syntax to Allow I2PBrowser to listen at localhost:6666, Then Allow TorBrowser User to Connect to it

I've had a bit of experience in Linux, but I'm still learning and brand new. I've been able to proxy Tor right into I2P on a normal Debian Wheezy installation successfully. My process involves ...
0
votes
1answer
87 views

Is my server being used as a proxy or malicious requests?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and am unfamiliar with the security and server side of my project. This is my first time ...
0
votes
1answer
47 views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
17
votes
3answers
8k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
2
votes
1answer
33 views

NOEXEC and RESTRICT in sudoers

I understand the script below has a serious problem, and NOEXEC and RESTRICT are not enough as a solution to this. user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf However, I still have some ...
0
votes
0answers
67 views

Is my webcam driver being used to hack my computer?

I'm seeing this in the journal: Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (II) Using input driver 'evdev' for 'TOSHIBA Web Camera' Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (**) TOSHIBA Web Camera: ...
5
votes
2answers
428 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
2
votes
2answers
531 views

RHEL 7 (CentOS 7) security / ssh / sshd_config advise requested

I am not a sysadmin and try to create a more or less secure web server (LAMP based CentOS 7). I read several tutorials about setup an initial CentOS 7 droplet and got everything running fine. ...
6
votes
1answer
3k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
1
vote
1answer
44 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...
2
votes
2answers
77 views

Per user tmpfs directories

Using the shared /tmp directory is known to have lead to many security vulnerabilities when predictable filenames have been used. And randomly generated names aren't really nice looking. I am ...
0
votes
0answers
13 views

Is user/filesystem access separation of services enough to have well secured data of services?

I'm about to publish some of my projects. So, I'm gonna to re-install my VPS and do it properly. I'll have running on it Apache server(websites are made using Ruby and Python), databases. I'll also ...
1
vote
1answer
46 views

How do I run a program without network access? [duplicate]

I am making a program that scrapes information from some web services. I want to test how my program reacts when it can't reach the web service, like if the web service is down or if the local ...
0
votes
1answer
42 views

unknown command “vftovp” in linux command history [ Is my linux box compromised? ]

I have Slackware linux system configured with ssh remote access. While observing the command history, I discovered that there is one unknown command executed from my linux box "vftovp". I certainly ...
9
votes
2answers
226 views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
0
votes
0answers
23 views

why do we have same chains in different tables of “iptables firewall” in linux?

why do we have same chains in different tables of "iptables firewall"? Like for example: we have "output" chain in filter table, nat table & mangle table.
3
votes
0answers
70 views

Is there a technical reason why ssh-agent lacks a sudo-like inactivity/idle timeout feature?

There are some brief discussions about the existing ssh-agent -t feature at [1], and there was a post as far back as 2001 on debian-devel [2] wishing for an inactivity timeout feature. There's a ...
11
votes
6answers
49k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
1
vote
4answers
49 views

Can administrating task of 'root' be divided to the several of “more powerful” users?

Unlike root (which is able to do everything) is it possible to have multiple administrators assigned to manage only part of a system? For example, one system could have 3 administrators: ...
0
votes
1answer
28 views

Compare Linux configuration with default

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version? My current system is Debian, ...
5
votes
1answer
40 views

Find out which kernel source files were used when kernel was compiled

I am compiling the Linux kernel for my specific hardware and I only select the drivers/options which I really need. This is in contrast to a typical distribution kernel, where they compile almost ...
13
votes
4answers
1k views

How to retrieve IP addresses of possible ssh attackers?

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records. However, there are two possible record types - for valid / invalid user. It complicates my ...
1
vote
2answers
68 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
-4
votes
1answer
46 views

How to know su password

You already know my question. I don't have su authority. So I want to know su password. I really(x100) don't know how to find it. I tried change direction(/etc/pam.d/su) and tried to delete auth ...
1
vote
1answer
27 views

Is it possible to scan a website for repeated images?

Is it possible to determine how many times a website is using an image (specifically one that is hosted on the domain), and on what pages? Is there a command line tool, for example, that scans every ...
1
vote
0answers
57 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...