Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
2answers
33 views

History -c, where all the erased histories have been saved and in which directories though?

Usually, when i used (root@example ~ # history )and it displayed a lot of commands which had been entered before. So, my question is : when i enter "history -c" is to delete all the history at the ...
6
votes
1answer
13k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
1
vote
0answers
23 views

How to prevent the latest ImageMagick vulnerability? [migrated]

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
-1
votes
1answer
37 views

AIX : /etc/security/limits file Parameters [closed]

Can anybody please explain about following parameters found /etc/security/limits file default: fsize = 2097151 core = 2097151 cpu = -1 data = 262144 rss = 65536 stack = 65536 ...
3
votes
4answers
6k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
0
votes
1answer
40 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
3
votes
1answer
21 views

Where can users' personal data be?

I want to secure my data on a multi-user system, so ful-system encryption is not an option. I encrypted /home/me with ecryptfs, the swap with cryptsetup. But I read that the applications can ...
1
vote
1answer
41 views

How to install Software in redhat 7.2 using downloaded rpm?

Take MariaDB for an example. Package management tools like yum is good solution to install software and handle the dependencies issue for you. But in a primitive situation, without internet access, ...
3
votes
1answer
30 views

How can I specify a system wide proxy without giving my password in plaintext?

I must use a proxy for all internet traffic, I currently have it specified like this in /etc/environment : http_proxy=http://jsj:plaintext_password_yikes@proxy.whereiwork.com:8080 ...
3
votes
1answer
21 views

White-list certain binaries and scripts inside a noexec/nosuid mount?

Just like the question. Is it possible to white-list certain executables from a noexec mounted FS? for instance, mine looks like this: /dev/vg/lv on /tmp type ext4 (rw,noexec,nosuid)
3
votes
3answers
58 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
1
vote
2answers
1k views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
0
votes
2answers
506 views

Trying to use TLS SMTP against Exim, getting Security Error back; what's wrong?

OS: FreeBSD9 64 Bit MTA: EXIM4 with TLS with Self Signed Certificate. I am using telnet myserver.com 25 EHLO dummy@dummy.com STARTTLS It says TLS go ahead And then I issue MSG FROM: ...
2
votes
1answer
152 views

How to scan a directory with a space in its name with maldet

I'm trying to scan some directories with Linux Malware Detect (command-line command maldet): maldet -a /SOMETHING\ 1/ But I get: maldet(13857): {scan} invalid path /SOMETHING 1/ I've tried ...
11
votes
4answers
6k views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA revelations and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I ...
1
vote
1answer
851 views

Using Metasploit with 3G USB modem

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host ...
70
votes
8answers
77k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
67
votes
2answers
8k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
0
votes
0answers
33 views

Only allow port 80 access to VPN users

I have setup a OpenVPN server thanks to Docker (and this tuto: https://www.digitalocean.com/community/tutorials/how-to-run-openvpn-in-a-docker-container-on-ubuntu-14-04). What I want now is to allow ...
2
votes
2answers
54 views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ...
1
vote
1answer
58 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
1
vote
1answer
28 views

dconf fails when running X application from alternate user

In an effort to protect my personal files in my home directory, I am trying to run certain applications as an alternate user, but under the same graphical environment. I have enabled X permissions by ...
3
votes
2answers
383 views

Does the stable version of Debian contain a vulnerable version of wpa_supplicant?

I'm on Debian jessie the stable release. I noticed that version of wpa_supplicant is vulnerable to DoS attacks according to CVE-2015-8041: Multiple integer overflows in the NDEF record parser in ...
2
votes
1answer
22 views

Can module loading be globally disabled on modern Linux kernels?

Once upon a time (before kernel 2.6.25), one could use /proc/sys/kernel/cap-bound to drop CAP_SYS_MODULE system-wide, and be assured that the set of code that was presently loaded into kernel space ...
21
votes
5answers
13k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
1
vote
0answers
19 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
2answers
29 views

RAID1 vs rsync - security?

I'm setting up a NAS-Server using an Odroid XU4 and two 2TB HDDs. Which setup would be more secure (lower risk of losing data / easier recovery): setup a RAID1 with mdadm have two separate devices, ...
5
votes
6answers
721 views

What is the threat of a user trying to sudo without permission?

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing ...
27
votes
3answers
2k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
2
votes
1answer
269 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
4
votes
1answer
49 views

Encrypt files (private key, etc.) in an embedded system

I am working on an embedded device running on Linux. This device communicates with a server and sends data to it using a certificate and a private key. When we distribute the device, I am afraid that ...
5
votes
2answers
63 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
0
votes
2answers
41 views

Should I create should my own user with less privileges on a server (Digit. Ocean)?

I'm trying to deploy a website at Digital Ocean. I have the user root as the default. However, since it's root I believe I should create my own, normal user, shouldn't I? Nonetheless, in the ...
5
votes
3answers
7k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
0
votes
0answers
46 views

How to add security (802-1x.eap) with nmcli

I've done nmcli con add type ethernet con-name SOMENAME ifname enp5 now how do I add security to it using nmcli(as if you had hit the on button in the gui.) so that I can than go and edit the ...
2
votes
1answer
36 views

Securing X window displays

I want to install X on a system I'm in charge of. I plan on running it with local connections only, e.g. with startx -- -nolisten tcp (which I understand is the default these days). Some relatively ...
-5
votes
2answers
56 views

How can I encrypt a file with dm-crypt? [closed]

I've never encrypted files in my Linux distribution. Now I need to do that. I'm on Arch. I went to the documentation, it says that support of TrueCrypt is discontinued and after examining other ...
2
votes
1answer
95 views

Replace Firewalld with system-config-firewall-tui on CentOS 7

I have a question regarding firewall config on CentOS 7. What I have done Disabled firewalld with systemctl stop firewalld.service Installed and configured system-config-firewall-tui Tested my ...
0
votes
1answer
64 views

limit user to only a single command: “su -”

I have setup a web server that hosts a Play! Framework application, the server is an Amazon Linux EC2. If you are not familiar with Amazon Linux, by default there is a root user and an ec2-user with ...
1
vote
2answers
26 views

Is it bad practice to call scripts from a users home dir from root tasks (eg. dhcp hooks)? [closed]

I have some small script that run at startup and on other events (for example, one that updates a dynamic dns hostname based on the machines IP changing). I would like to keep everything in my home ...
0
votes
2answers
30 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
51
votes
5answers
44k views

What is the point of sshd “UseDNS” option?

I know what it does, but i don't know why. What attack(s) does it prevent ? Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
21
votes
3answers
64k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
1
vote
2answers
47 views

Is it safe to set a cron job for apt-get upgrade? [closed]

Is it a good idea to create a cron job for apt-get update; apt-get upgrade for my webserver? So not apt-get dist-upgrade.
10
votes
2answers
271 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
-1
votes
1answer
25 views

Distribution request (!) - Linux Mint [closed]

I need a slim, fast and very secure distribution. I need security for my work (encryption, anonymity, secure internet connection etc.). I love the Linux Mint design (Cinnamon) with the very nice green ...
3
votes
1answer
70 views

How come I can login to another person's session over vnc just by changing the port number?

I have a user account on a server administered by someone else. I don't have root access. The server is CentOS 7. I couldn't connect over vnc on the usual port I use, so I ssh'd into the server and ...
3
votes
2answers
1k views

How can I install Linux on a UEFI system with Secure boot?

My motherboard is a Gigabyte 990XA-UD3 (CPU 1), it's a UEFI -Dual boot, and when I try installing Linux Mint 16 Cinnamon or Ubuntu 13.10 it always bring this error (initramfs) Unable to find a medium ...
16
votes
2answers
2k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
6
votes
3answers
6k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...