Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

5
votes
2answers
63 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
4
votes
3answers
131 views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
0
votes
3answers
53 views

Why does reading a device require admin permissions?

I'm trying to create a backup script that saves my thumbdrive as an image. I'm planning on having it automatic. I've always seen the thumbdrive listed as /dev/sdb, and created a script that will save ...
2
votes
2answers
89 views

Avoiding plain-text password in http_proxy

I am behind a corporate firewall, which brings lots of pains in the area of proxies. There are two main approaches I've found to work: Use Cntlm at the cost of not being able to connect (from the ...
2
votes
2answers
50 views

Would draining entropy make it easier to compromise a system? [duplicate]

Entropy is important for many security features like TCP sequence numbers and cryptographic key/parameter generation. My understanding is that the entropy pool is drained by an operation as simple as ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
0
votes
0answers
48 views

Does the following error indicate my system is compromised?

[FAILED] Failed to Verify Integrity of password and group files. See 'systemctl status shadow.service' for details. I get this message in T1 every time I start up the computer but I havn't noticed ...
1
vote
2answers
22 views

Are there sandboxing concepts for proprietary binary kernel modules in linux?

Quite a lot has been going on to advance inter-process security (UID the same) and priveledge dropping in userland, yet it is common that proprietary linux kernel components are used (it seems that ...
1
vote
0answers
127 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
1answer
45 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
0
votes
0answers
7 views

How to permanently set a password for ipaserver client accounts

I want to setup a password for RHEL/Centos ipaserver client accounts but it seems I have to keep manually resting it on the ipaserver host. Is there a way to persistently set it?
1
vote
1answer
50 views

How to write a file a file via ssh

I want to write a file in the Machine B under /home/test whose permissions are root:root and rwxr-xr-x. I have an account on the Machine B, named testUser. When logged to the Machine B with ...
1
vote
2answers
26 views

Whats the difference between adding scripts in the /etc/cron.daily/ or editing in your script in crontab(-e)?

There are multiple options - with cron - to start your script at a specific time, but, is one more secure over the other? My question is simple: Whats the difference between adding scripts in ...
3
votes
2answers
51 views

Why are privs required to setgid() to supplementary groups

The various set*gid() system calls require privileges to change groups except in a very few cases. Changing primary group to one of the processes' supplementary groups does not appear to be one of ...
0
votes
3answers
83 views

How to stop a user from seeing command line arguments?

We have a CI server application run as the build user. Any command with arguments run by the CI server is visible via ps. Although non-admin users do not have access to load a shell on the CI server, ...
3
votes
1answer
176 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
-2
votes
1answer
55 views

how to fix potentially infected binary files? [closed]

when I installed the updates on my computer (Ubuntu 14.04), I typed the password, thinking that it was asked for regular updating , but when I noticed some strange behavior and crash at this moment, I ...
0
votes
0answers
26 views

BeEf Famework Kali-2 configuration

I am running Kali-2(rolling 1 latest) in Vmware workstation 12. I have forwarded my ports and am using NAT. The beef framework links only seem to work within the local network. Any specific reason? ...
0
votes
1answer
37 views

pam_mount changes owner of mountpoint to root

On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image ...
7
votes
1answer
233 views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
2
votes
4answers
67 views

security issues from installing from source code as root

I had a question arise about how installing from source code in the root account is not a good idea because of security reasons. My stance on it is that it does not really matter if someone is in ...
1
vote
2answers
200 views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
2
votes
1answer
51 views

Information leaks out of encrypted file system

If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems like swap space files in /tmp ...
0
votes
1answer
35 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
1
vote
0answers
26 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
0
votes
0answers
39 views

How to set usb stick's ntfs filesystem's attribute to readonly in linux

I know how to set readonly attribute to ntfs filesystem of a usb device by using diskpart tool in windows. attributes disk set readonly but how to set readonly attribute to the same usb device ...
4
votes
1answer
33 views

LXC: Are downloaded templates verified?

Debian 8.3, LXC 1:1.0.6-6+deb8u2 When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the ...
1
vote
1answer
32 views

Creating Encrypted Tunnel Between 2 Lans

I have 2 LANs and one of them is connected to the internet and I need to connect them together. Normally, a single cat6 cable is enough for connection however, this cable is going through a public ...
31
votes
4answers
2k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
1
vote
1answer
45 views

Linux TOTP vs SSH Keys

I am in the middle of a security upgrade task and have been reading a lot of articles around SSH security. I have a question around what is the better method of securing SSH by using SSH Keys or TOTP? ...
4
votes
2answers
95 views

Debian Lenny Server Compromised - No Sign Of Intrusion Point?

I have a server, it's outdated running Debian Lenny, and yes I know that is probably half the problem. It also has PHPMyAdmin and ProFTPd. Again, I get it, all bad signs. But for the life of me, I ...
2
votes
0answers
41 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing ...
0
votes
1answer
66 views

fail2ban ip blocked, yet still login attempts

everything seems ok, iptables shows its blocked, yet I still get auth attempts I have configured fail2ban # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1/8 bantime ...
-1
votes
2answers
54 views

Need the sshd server be run in root privilege for a password-less login? [closed]

I mean: if the sshd is't being run in root account, then how can it let the remote ssh client run shell or other command in root account ? if sshd call the login command, then the user could login ...
4
votes
1answer
96 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
3
votes
4answers
168 views

Why does mknod require root privileges?

I noticed that the mknod command required root privileges when a creating a node other than a regular file, FIFO or a Unix socket. Why is that? How can a regular user harm a system or compromise ...
4
votes
1answer
81 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
3
votes
1answer
33 views

What are the drawbacks of using policy_any in openssl.cnf?

As given in this document, we may use policy_any to ignore most of the fields of subject in certificate request. There must be some drawbacks of ignoring such fields, would it may lead to some ...
0
votes
3answers
50 views

What additional privileges does the root user have over a standard user? [closed]

What additional privileges does the root user have over a standard user in Linux?
0
votes
1answer
28 views

Is sudo useful to protect my data from malwares?

I'm considering creating a separate account for browsing, and launching my browser with sudo -u browseraccount {firefox,chromium,etc}. I wonder if this can prevent a malware (especially ransomwares) ...
1
vote
2answers
82 views

Is it evil to link to a crontab?

I think about doing something like: sudo ln -s ~/myCustomCrontab /var/spool/cron/crontabs/username because I'd like to have all customized files in my home directory. Possible risks I can think of ...
54
votes
6answers
5k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
0
votes
1answer
56 views

What are the right permissions to set to make files unreadable unless it's my main user accessing them?

Basically I didn't encrypt my Linux (Debian) partition when installing it. However I found a way to encrypt at least home folder so in theory I could put everything there which I want to make sure ...
1
vote
0answers
35 views

Is insecure to give users permissions to apps in /opt? [duplicate]

I'm working with some apps (the best example i can give is Firefox Developer Edition) that i put in the /opt folder. These apps work perfectly until they need to apply and update, and that's because ...
0
votes
0answers
64 views

Does running fcgiwrap with nginx give the same added security as creating a new php-fpm pool for every site by hand?

Here's the nginx + fcgiwrap configuration I'm talking about. I don't understand what the main differences are between this kind of a fcgiwrap configuration and a nginx + php-fpm configuration. They ...
0
votes
0answers
27 views

How to get informed about EVERY incoming ssh connection (e.g. with no remote command specified)

The case I'm used to set up automatic reverse ssh tunnels to remote computers via my server with cron. Usually I use the following entry: @reboot sleep 300 && ssh -MNf -R xxx22:host:22 ...
0
votes
1answer
17 views

Hide/Encrypt application configuration

Is there any way to hide/crypt software config files (services such as Apache web server , Varnish and so on) from boss and others?
1
vote
0answers
40 views

dirmngr does not start with proper home directory unless it is restarted

I am trying to follow these guidelines for gpg best practices: https://help.riseup.net/en/security/message-security/openpgp/best-practices but I am having trouble with dirmngr, which handles all ...
0
votes
1answer
32 views

Can't access web sites when running iptables script!

I have wrote script for protecting my machine: #!/bin/bash ssh=1.1.1.1 http='1.1.1.1 2.2.2.2' # Clear any previous rules. iptables -F # Default drop policy. iptables -P INPUT DROP iptables -P ...
0
votes
1answer
44 views

How to protect from chrooting to its linux partition and how to chroot it after using the protection?

I am currently using archlinux, It is possible to boot on an archlinux installation iso for instance, to mount my current archlinux partition and my boot partition and then to use arch-chroot. Then I ...