Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
2answers
30 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
0
votes
0answers
33 views

Only allow port 80 access to VPN users

I have setup a OpenVPN server thanks to Docker (and this tuto: https://www.digitalocean.com/community/tutorials/how-to-run-openvpn-in-a-docker-container-on-ubuntu-14-04). What I want now is to allow ...
1
vote
2answers
47 views

Is it safe to set a cron job for apt-get upgrade? [closed]

Is it a good idea to create a cron job for apt-get update; apt-get upgrade for my webserver? So not apt-get dist-upgrade.
10
votes
2answers
271 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
-1
votes
1answer
25 views

Distribution request (!) - Linux Mint [closed]

I need a slim, fast and very secure distribution. I need security for my work (encryption, anonymity, secure internet connection etc.). I love the Linux Mint design (Cinnamon) with the very nice green ...
16
votes
2answers
2k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
-2
votes
5answers
121 views

Why does superuser exist in Unix/Linux?

I know that some system tasks are permitted only to privileged users/processes, but still a super user (usually the root in Unix/Linux) or administrator can present so much problems in regards to ...
0
votes
0answers
32 views

Possible improvements to script that runs golismero security scan crash-safe?

I am trying to do it this way. Due to some issues with golismero that causes more crashes then I'd prefer, I use a workaround suggested by the dev team and saves all found items to the db - and if it ...
1
vote
1answer
18 views

Filebased SELinux booleans

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at ...
1
vote
1answer
49 views

linux + yum update - what this command covers?

I verified what are the missing security patches as the following: yum updateinfo list security available Loaded plugins: product-id, rhnplugin, security, subscription-manager This system is ...
1
vote
0answers
41 views

Automatically manage whitelisting (e.g. in tinyproxy) of dynamic IPs?

I have a VPS that runs tinyproxy for private use, and another that runs nginx for development. Is there a protocol/daemon that I can use to automate whitelisting for my dynamic IP? So that tinyproxy ...
-2
votes
3answers
67 views

Is a fresh install of linux equivalent to a honeypot? [closed]

Hello I was wondering whether a a fresh install of Debian connected to the internet without further protection (iptable or whatever) is safe or equivalent to a honeypot. Do we have some people that ...
4
votes
0answers
38 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this ...
0
votes
0answers
80 views

OpenVas + Kali Rolling: The connection was reset

I am trying to get OpenVAS to work in the latest Kali release (rolling). It seems to be installed right, but when I try to access the web interface (127.0.0.1:9392), I get Connection was reset. ...
3
votes
1answer
61 views

Why is chroot(2) unavailable to unprivileged users?

Why is chroot(2) unavailable to unprivileged users? I don't understand existing answers on the Internet. For example this one ...
1
vote
1answer
29 views

Block regular users from changing their passwords: only root should be able to [closed]

For security reasons, I want to make it so that only root can change user's passwords This can be achieved if I set /usr/bin/passwd to 700. Now, if password aging is enabled or first login is enabled, ...
0
votes
1answer
18 views

wget TLSv1 behaves the same as TLSv1_2

I used wireshark to compare curl --tlsv1.0 vs --tlsv1.2 The server handshake obediently uses TLSv1.0 for servers that support it (the point is to check to validate they don't): wget url ...
1
vote
0answers
28 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
1
vote
1answer
60 views

Restrict login via user group in access.conf

I have been working on getting /etc/security/access.conf to work as expected and so far every user can still login. Details are below. I added the following line to /etc/pam.d/login account ...
1
vote
1answer
31 views

Install ModSecurity Commercial Rules

We bought the ModSecurity commercial rules, but I am not having success installing them. I tried using the ModSecurity dashboard, but it seems that it is not working. Even though I get a message ...
1
vote
1answer
47 views

Is Evince a secure way to view malicious PDF?

I've seen that PDF's can contain malicious Javascript that operates in the background and can do bad things. This is primarily a problem for Adobe Acrobat. However, is this problem also for Evince? I ...
1
vote
1answer
59 views

Is there a way to resolve ALL PIA VPN IPs with a script?

I am looking for a way to get a complete list of all the current IP addresses for PrivateInternetAccess' servers. I need the complete list so that I can manually enter them into a killswitch for ...
3
votes
1answer
53 views

Brute force attack on vsftp server not showing failed authentication in log

My server is running Debian 8 with vsftpd version 3.0.2-17. Recently my vsftpd.log filled up with the following: vsftpd.log Mon Mar 7 18:13:44 2016 [pid 13499] CONNECT: Client ...
0
votes
6answers
239 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
5
votes
2answers
63 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
4
votes
3answers
148 views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
0
votes
3answers
53 views

Why does reading a device require admin permissions?

I'm trying to create a backup script that saves my thumbdrive as an image. I'm planning on having it automatic. I've always seen the thumbdrive listed as /dev/sdb, and created a script that will save ...
2
votes
2answers
120 views

Avoiding plain-text password in http_proxy

I am behind a corporate firewall, which brings lots of pains in the area of proxies. There are two main approaches I've found to work: Use Cntlm at the cost of not being able to connect (from the ...
2
votes
2answers
53 views

Would draining entropy make it easier to compromise a system? [duplicate]

Entropy is important for many security features like TCP sequence numbers and cryptographic key/parameter generation. My understanding is that the entropy pool is drained by an operation as simple as ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
0
votes
0answers
53 views

Does the following error indicate my system is compromised?

[FAILED] Failed to Verify Integrity of password and group files. See 'systemctl status shadow.service' for details. I get this message in T1 every time I start up the computer but I havn't noticed ...
1
vote
2answers
24 views

Are there sandboxing concepts for proprietary binary kernel modules in linux?

Quite a lot has been going on to advance inter-process security (UID the same) and priveledge dropping in userland, yet it is common that proprietary linux kernel components are used (it seems that ...
1
vote
0answers
132 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
1answer
58 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
0
votes
0answers
8 views

How to permanently set a password for ipaserver client accounts

I want to setup a password for RHEL/Centos ipaserver client accounts but it seems I have to keep manually resting it on the ipaserver host. Is there a way to persistently set it?
1
vote
1answer
54 views

How to write a file a file via ssh

I want to write a file in the Machine B under /home/test whose permissions are root:root and rwxr-xr-x. I have an account on the Machine B, named testUser. When logged to the Machine B with ...
1
vote
2answers
28 views

Whats the difference between adding scripts in the /etc/cron.daily/ or editing in your script in crontab(-e)?

There are multiple options - with cron - to start your script at a specific time, but, is one more secure over the other? My question is simple: Whats the difference between adding scripts in ...
3
votes
2answers
55 views

Why are privs required to setgid() to supplementary groups

The various set*gid() system calls require privileges to change groups except in a very few cases. Changing primary group to one of the processes' supplementary groups does not appear to be one of ...
0
votes
3answers
87 views

How to stop a user from seeing command line arguments?

We have a CI server application run as the build user. Any command with arguments run by the CI server is visible via ps. Although non-admin users do not have access to load a shell on the CI server, ...
3
votes
1answer
178 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
-2
votes
1answer
58 views

how to fix potentially infected binary files? [closed]

when I installed the updates on my computer (Ubuntu 14.04), I typed the password, thinking that it was asked for regular updating , but when I noticed some strange behavior and crash at this moment, I ...
0
votes
0answers
29 views

BeEf Famework Kali-2 configuration

I am running Kali-2(rolling 1 latest) in Vmware workstation 12. I have forwarded my ports and am using NAT. The beef framework links only seem to work within the local network. Any specific reason? ...
0
votes
1answer
43 views

pam_mount changes owner of mountpoint to root

On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image ...
7
votes
1answer
248 views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
2
votes
4answers
70 views

security issues from installing from source code as root

I had a question arise about how installing from source code in the root account is not a good idea because of security reasons. My stance on it is that it does not really matter if someone is in ...
1
vote
2answers
311 views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
2
votes
1answer
57 views

Information leaks out of encrypted file system

If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems like swap space files in /tmp ...
0
votes
1answer
35 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
1
vote
0answers
27 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...