Tagged Questions

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

28
votes
4answers
2k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
1answer
33 views

how many password generators are there in debian and how to know which are good

I know of two password generators in Debian. The first one which I have used is apg and it seems to generate some good passwords. $ apg -m 15 -M SNCL RefGav:quedTut7 {Shtetmigdybig1 ...
0
votes
0answers
39 views

ubuntu linux - security between applications

When I run a Ubuntu Linux on my machine, and if using only 1 user account, most of the applications executed are using the same uid. I want to know what risks do applications face in this ...
2
votes
1answer
28 views

How to verify one file of a package, not the RPM itself

For instance, can I somehow use rpm to verify that /etc/pam.d/system-auth is unchanged since it was installed on the system? I know I can do this with an entire RPM, but I want to know if I can do ...
2
votes
0answers
27 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the ...
7
votes
4answers
206 views

Where can I “hide” easter eggs for students learning about Linux security? [closed]

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
4
votes
1answer
39 views

Preserve evidence of intrusion / deleted executable?

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, ...
3
votes
3answers
83 views

SSH - Is it possible for an SSH session to take complete control of the client? [duplicate]

When I open a SSH session on my terminal to a remote server, is this only a virtual terminal, or is it possible for the SSH server that I am connected to to "take control" of my terminal? For example, ...
1
vote
1answer
93 views

Chkrootkit found alot of suspicious files and directories, and /sbin/init INFECTED

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and ...
1
vote
1answer
56 views

SSH key-only remote login, is disabling password a good practice?

I need a maintenance user which only requires a remote login. I'll preferably use only public keys to login into the account. I thought of just creating the user with useradd myuser, adding later the ...
0
votes
0answers
27 views

Why there are two different shadow files preset in /etc [duplicate]

I am running ubuntu 12.04 on rackspace cloud. Somehow it has two shadow files /etc/shadow /etc/shadow- I know about the first being used for password protection but where second came from ? Can it ...
6
votes
2answers
145 views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...
3
votes
1answer
91 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
2
votes
3answers
91 views

Are there network connections that don't use the WiFii card or the Ethernet port?

I see many connections like when I use netstat, are they all to the internet? Are there any connections to the internet or other things that aren't forthcoming? I guess what I'm asking is what does ...
2
votes
1answer
38 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
-1
votes
1answer
40 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
3
votes
3answers
64 views

downloading debian securely

I have a couple of questions on getting a genuine, unmolested version of Debian. MITM attacks are very real and many parties would love to hand you their own, backdoored version of software. I know ...
12
votes
5answers
794 views

How to Determine the IP Address of who logged into Root?

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.
6
votes
2answers
191 views

Is there any issue to put / as a home directory of root user from security point of view?

Is there any issue to put / as a home directory of root user from security point of view instead of /root
0
votes
0answers
43 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
0
votes
2answers
42 views

Debian system with encrypted data that can be decrypted only from a remote server

This question is about the design of a service I want to setup. Description My purpose is to provide a client box which connects to a server and provides some features. The client box is a small ...
1
vote
2answers
38 views

How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own

How would you assign read-only permissions to run ls -l /proc/{PID}/fd for PIDs (processes) you running as another user. Ideally, you wouldn't be able to do anything else and you would not have ...
4
votes
3answers
82 views

How to securely delete a directory without leaving a trace?

I already know that using shred will overwrite my files in such a way that leaves them unrecoverable. However shred can't be used to hide directories. Error Message: failed to open for writing: ...
2
votes
1answer
41 views

Pin Lock Screen

Is there a way to replace password lock screen in Linux (Mint Debian Edition) with a pin lock screen? Like the one found in Windows 8 for example. It's annoying/inconvenient to have to input 16 ...
1
vote
2answers
62 views

Secure the content of a hard disk

I have to prepare a computer to give away, and I do not know who is going to use it. The computer has Debian installed, and the HDD is entirely encrypted. All users have their storage on the server. I ...
2
votes
0answers
109 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
1
vote
2answers
50 views

How to set up a global interval between SSH log in attempts?

I would like to make it impossible to make more than a single remote log-in attempt in a number of seconds regardless the client IP address (except some trusted white-listed addresses perhaps). So ...
2
votes
2answers
109 views

Random named file in home directory, possibly hacked?

I am running Fedora 20, and today I found a file that looks highly suspicious in my home directory. The name of the file appears to be a base64 encoded string, but doesn't decode to anything ...
1
vote
3answers
135 views

Possible corrupt passwd file

I did a recovery of the server and reset the root password to a new one because for some reason, the original was not being recognised. It still is refusing to accept the password in ssh for root. ...
10
votes
2answers
2k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
0
votes
1answer
99 views

Faillog - unsuccessful login count in Motd

I wish to include a count of failed login attempts whenever a user logs in. I've created: /usr/local/bin/dynmotd which contains #!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG " and ...
0
votes
1answer
137 views

Create ssh root password

For some reason, after a plesk update, I can no longer login to ssh as root using my old password. I have tried to create a user with: /bin/bash & /bin/bash (chrooted) in plesk Which lets me ...
2
votes
0answers
191 views

Cannot connect to ssh server

I am having trouble connecting to my ssh server. It responds with a lengthy error message about no network etc. but it is the last message that concerns me: Sometimes, such troubles can be caused ...
8
votes
1answer
566 views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
0
votes
0answers
11 views

Ubuntu Firewall Configuration Just for Browsing and E-Mailing [duplicate]

Is it possible to configure UFW just for browsing using firefox, e-mailing using thunderbird and updating the system? How should I proceed? I would like to use the UFW directly without any GUI.
0
votes
1answer
48 views

Is it OK to copy /etc/sysconfig/iptables to another machine?

This is my original server with very loose security given that it does not block all ports via iptables. /etc/sysconfig/iptables contents: # Generated by iptables-save v1.4.7 on Mon Jun 16 ...
1
vote
1answer
87 views

How can I tell why I have permissions to read a file? [closed]

Here's what I just noticed on my CentOS SSH account: stat output $ stat /dev/kvm File: `/dev/kvm' Size: 0 Blocks: 0 IO Block: 4096 character special file Device: ...
1
vote
2answers
74 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
2
votes
1answer
31 views

setup sudoers to mount network shares and loop devices and misc

I would like to setup sudoers to grant users to mount all kind of network shares and loop devices to their home directory. Here is a try that I found and changed a bit on one old post in ...
3
votes
3answers
154 views

Monitor all login attempts

Few weeks ago I thought it would be a good idea to write a script to send me an email whenever some user logs in into my server. So I came with a perfectly working script notifyLogin.sh, then I ...
1
vote
0answers
79 views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at ...
1
vote
2answers
505 views

Shell Script - how to scp into remote server and download files and protect password

I have a remote server that I need to download Apache logs from. I can manually scp into the server and get the files, but I'd like to put this in crontab. The only way to automate it is to include ...
5
votes
2answers
181 views

Why ssh-agent group ownership is not root

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? ...
1
vote
1answer
72 views

SSH slow after configuring TCP Wrappers

We have SSH open on one of our production servers leaving it prone to various brute force attacks to break in. I reduced the attempts by changing the default port from 22. I want to further harden ...
2
votes
1answer
44 views

Why isn't 'nethogs' installed with the setuid bit set?

I've been using nethogs for a while now, having to sudo every time, while ping has the setuid bit set. Today I set it for nethogs and it works: $ ls -l $(which nethogs) $(which ping) -rwxr-xr-x 1 ...
3
votes
2answers
111 views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
4
votes
1answer
127 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
1answer
120 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
3
votes
1answer
57 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
3
votes
3answers
1k views

What are the world writable directories by default?

In a standard Linux filesystem, which of these common directories are world-writable by default? /tmp /etc /var /proc /bin /boot /.... .... Why are they world-writable? Does that pose ...