Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
73 views

How to install Software in redhat 7.2 using downloaded rpm?

Take MariaDB for an example. Package management tools like yum is good solution to install software and handle the dependencies issue for you. But in a primitive situation, without internet access, ...
3
votes
1answer
24 views

Where can users' personal data be?

I want to secure my data on a multi-user system, so ful-system encryption is not an option. I encrypted /home/me with ecryptfs, the swap with cryptsetup. But I read that the applications can ...
3
votes
1answer
22 views

White-list certain binaries and scripts inside a noexec/nosuid mount?

Just like the question. Is it possible to white-list certain executables from a noexec mounted FS? for instance, mine looks like this: /dev/vg/lv on /tmp type ext4 (rw,noexec,nosuid)
3
votes
1answer
34 views

How can I specify a system wide proxy without giving my password in plaintext?

I must use a proxy for all internet traffic, I currently have it specified like this in /etc/environment : http_proxy=http://jsj:plaintext_password_yikes@proxy.whereiwork.com:8080 https_proxy=http://...
3
votes
3answers
62 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
2
votes
2answers
74 views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ca_cert="/usr/share/...
68
votes
2answers
8k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
1
vote
1answer
43 views

dconf fails when running X application from alternate user

In an effort to protect my personal files in my home directory, I am trying to run certain applications as an alternate user, but under the same graphical environment. I have enabled X permissions by ...
3
votes
2answers
390 views

Does the stable version of Debian contain a vulnerable version of wpa_supplicant?

I'm on Debian jessie the stable release. I noticed that version of wpa_supplicant is vulnerable to DoS attacks according to CVE-2015-8041: Multiple integer overflows in the NDEF record parser in ...
2
votes
1answer
24 views

Can module loading be globally disabled on modern Linux kernels?

Once upon a time (before kernel 2.6.25), one could use /proc/sys/kernel/cap-bound to drop CAP_SYS_MODULE system-wide, and be assured that the set of code that was presently loaded into kernel space ...
1
vote
0answers
23 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
2answers
44 views

RAID1 vs rsync - security?

I'm setting up a NAS-Server using an Odroid XU4 and two 2TB HDDs. Which setup would be more secure (lower risk of losing data / easier recovery): setup a RAID1 with mdadm have two separate devices, ...
0
votes
0answers
53 views

Can we run apache on a non-root account?

Apache is started by the root user, then switches to the user defined by the User directive; is there any chance where we can change this default behavior? Apache should start using a non-root account ...
27
votes
3answers
3k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
5
votes
6answers
732 views

What is the threat of a user trying to sudo without permission?

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing ...
4
votes
1answer
60 views

Encrypt files (private key, etc.) in an embedded system

I am working on an embedded device running on Linux. This device communicates with a server and sends data to it using a certificate and a private key. When we distribute the device, I am afraid that ...
0
votes
2answers
41 views

Should I create should my own user with less privileges on a server (Digit. Ocean)?

I'm trying to deploy a website at Digital Ocean. I have the user root as the default. However, since it's root I believe I should create my own, normal user, shouldn't I? Nonetheless, in the ...
0
votes
0answers
49 views

How to add security (802-1x.eap) with nmcli

I've done nmcli con add type ethernet con-name SOMENAME ifname enp5 now how do I add security to it using nmcli(as if you had hit the on button in the gui.) so that I can than go and edit the ...
2
votes
1answer
39 views

Securing X window displays

I want to install X on a system I'm in charge of. I plan on running it with local connections only, e.g. with startx -- -nolisten tcp (which I understand is the default these days). Some relatively ...
-5
votes
2answers
65 views

How can I encrypt a file with dm-crypt? [closed]

I've never encrypted files in my Linux distribution. Now I need to do that. I'm on Arch. I went to the documentation, it says that support of TrueCrypt is discontinued and after examining other ...
0
votes
1answer
78 views

limit user to only a single command: “su -”

I have setup a web server that hosts a Play! Framework application, the server is an Amazon Linux EC2. If you are not familiar with Amazon Linux, by default there is a root user and an ec2-user with ...
1
vote
2answers
26 views

Is it bad practice to call scripts from a users home dir from root tasks (eg. dhcp hooks)? [closed]

I have some small script that run at startup and on other events (for example, one that updates a dynamic dns hostname based on the machines IP changing). I would like to keep everything in my home ...
0
votes
2answers
33 views

How to isolate my browser?

I want to protect my data against a browser exploit, by forbidding Firefox to access any file beside : ~/.mozilla/ ~/Downloads/ I tried to create another user account with which I would run ...
0
votes
0answers
36 views

Only allow port 80 access to VPN users

I have setup a OpenVPN server thanks to Docker (and this tuto: https://www.digitalocean.com/community/tutorials/how-to-run-openvpn-in-a-docker-container-on-ubuntu-14-04). What I want now is to allow ...
1
vote
2answers
50 views

Is it safe to set a cron job for apt-get upgrade? [closed]

Is it a good idea to create a cron job for apt-get update; apt-get upgrade for my webserver? So not apt-get dist-upgrade.
10
votes
2answers
274 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
-1
votes
1answer
26 views

Distribution request (!) - Linux Mint [closed]

I need a slim, fast and very secure distribution. I need security for my work (encryption, anonymity, secure internet connection etc.). I love the Linux Mint design (Cinnamon) with the very nice green ...
16
votes
2answers
2k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
-2
votes
5answers
126 views

Why does superuser exist in Unix/Linux?

I know that some system tasks are permitted only to privileged users/processes, but still a super user (usually the root in Unix/Linux) or administrator can present so much problems in regards to ...
0
votes
0answers
40 views

Possible improvements to script that runs golismero security scan crash-safe?

I am trying to do it this way. Due to some issues with golismero that causes more crashes then I'd prefer, I use a workaround suggested by the dev team and saves all found items to the db - and if it ...
1
vote
1answer
21 views

Filebased SELinux booleans

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at ...
1
vote
1answer
53 views

linux + yum update - what this command covers?

I verified what are the missing security patches as the following: yum updateinfo list security available Loaded plugins: product-id, rhnplugin, security, subscription-manager This system is ...
1
vote
0answers
54 views

Automatically manage whitelisting (e.g. in tinyproxy) of dynamic IPs?

I have a VPS that runs tinyproxy for private use, and another that runs nginx for development. Is there a protocol/daemon that I can use to automate whitelisting for my dynamic IP? So that tinyproxy ...
-2
votes
3answers
69 views

Is a fresh install of linux equivalent to a honeypot? [closed]

Hello I was wondering whether a a fresh install of Debian connected to the internet without further protection (iptable or whatever) is safe or equivalent to a honeypot. Do we have some people that ...
4
votes
0answers
48 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this case,...
0
votes
0answers
98 views

OpenVas + Kali Rolling: The connection was reset

I am trying to get OpenVAS to work in the latest Kali release (rolling). It seems to be installed right, but when I try to access the web interface (127.0.0.1:9392), I get Connection was reset. ...
3
votes
1answer
65 views

Why is chroot(2) unavailable to unprivileged users?

Why is chroot(2) unavailable to unprivileged users? I don't understand existing answers on the Internet. For example this one https://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123....
1
vote
1answer
32 views

Block regular users from changing their passwords: only root should be able to [closed]

For security reasons, I want to make it so that only root can change user's passwords This can be achieved if I set /usr/bin/passwd to 700. Now, if password aging is enabled or first login is enabled, ...
0
votes
1answer
25 views

wget TLSv1 behaves the same as TLSv1_2

I used wireshark to compare curl --tlsv1.0 vs --tlsv1.2 The server handshake obediently uses TLSv1.0 for servers that support it (the point is to check to validate they don't): wget url --no-check-...
1
vote
0answers
34 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
1
vote
1answer
98 views

Restrict login via user group in access.conf

I have been working on getting /etc/security/access.conf to work as expected and so far every user can still login. Details are below. I added the following line to /etc/pam.d/login account ...
1
vote
1answer
35 views

Install ModSecurity Commercial Rules

We bought the ModSecurity commercial rules, but I am not having success installing them. I tried using the ModSecurity dashboard, but it seems that it is not working. Even though I get a message ...
1
vote
1answer
53 views

Is Evince a secure way to view malicious PDF?

I've seen that PDF's can contain malicious Javascript that operates in the background and can do bad things. This is primarily a problem for Adobe Acrobat. However, is this problem also for Evince? I ...
1
vote
1answer
75 views

Is there a way to resolve ALL PIA VPN IPs with a script?

I am looking for a way to get a complete list of all the current IP addresses for PrivateInternetAccess' servers. I need the complete list so that I can manually enter them into a killswitch for ...
3
votes
1answer
77 views

Brute force attack on vsftp server not showing failed authentication in log

My server is running Debian 8 with vsftpd version 3.0.2-17. Recently my vsftpd.log filled up with the following: vsftpd.log Mon Mar 7 18:13:44 2016 [pid 13499] CONNECT: Client "::ffff:xxx.xxx.xx.xx"...
0
votes
6answers
287 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
5
votes
2answers
73 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
4
votes
3answers
164 views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
0
votes
3answers
54 views

Why does reading a device require admin permissions?

I'm trying to create a backup script that saves my thumbdrive as an image. I'm planning on having it automatic. I've always seen the thumbdrive listed as /dev/sdb, and created a script that will save ...