Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
2answers
58 views

ClamAV found virus, if I should delete this virus? [closed]

ClamAV has found two viruses on my server. Is this a virus? Should I delete it? /tmp/back: Perl.Shellbot-8 FOUND /var/tmp/back: Perl.Shellbot-8 FOUND
0
votes
3answers
56 views

last command only shows few days worth of logins

I often use thelast command to check my systems for unauthorized logins, this command: last -Fd gives me the logins where I have remote logins showing with ip. From man last: -F Print full ...
1
vote
3answers
106 views

Securely passing user input to command

I have a daemon daemon running in Server A. There, there's an argument based script to control the daemon daemon_adm.py (Server A). Through this script I can insert "messages" to daemon coming from ...
2
votes
2answers
44 views

What is best and secure way to save application settings?

Let's say I have an application which has plugins, daemons, etc. Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is ...
1
vote
0answers
50 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
6
votes
3answers
637 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
0
votes
0answers
50 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
0
votes
0answers
86 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
0
votes
0answers
18 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
3
votes
1answer
33 views

How can I lock down a user account to the point that it can read/write/execute as little as possible?

I would like to lock down an Arch Linux user account to the maximum extent possible. The only functionality required for the account is to accept a non-terminal SSH session which allows the client to ...
8
votes
2answers
162 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
4
votes
1answer
25 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
1
vote
2answers
196 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
8
votes
2answers
8k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
2
votes
0answers
30 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
0
votes
0answers
62 views

Permission denied tmp dir on STIG RHEL

I am writing a program for a DISA STIG version of Red Hat Linux 6.5. I wrote a shell script to do self extracting on the program and when it self extracts put temporary files in the tmp directory that ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
7
votes
4answers
20k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
1
vote
0answers
23 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
91
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
0
votes
1answer
55 views

What are the potential negatives of turning on process accounting (psacct package)?

I am looking into turning on process accounting on some EL6 servers. What are the potential pitfalls of turning this on? If you mitigate storage requirements with log rotation, any reason you would ...
0
votes
2answers
66 views

Accessing Linux server via VPN or Certificate based ssh?

My company has a fairly common security setup where you need to log in via VPN, when outside the company network in order to get access to the servers. The biome is mostly Windows machines. I'm ...
0
votes
0answers
35 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
3
votes
1answer
70 views

read only symlink or something similar? [duplicate]

I created myself a NAT for home use (Ubuntu+Samba+Greyhole+Apache+MySQL+other web server related stuff). 90% of files I store there are pictures that i really don't wanna loose (that's why Greyhole). ...
1
vote
1answer
71 views

Is the data transiting through a pipe confidential?

I read the following question (Shell Script mktemp, what's the best method to create temporary named pipe?) but I'm wondering whether it is preferable to use a temporary named pipe to transfer ...
0
votes
3answers
171 views

How to add a password to a specific command

I've been searching google on how to add additional security to a specific command without using sudo. Is it possible to add on a security feature without actually using sudo? For example: Whenever ...
1
vote
0answers
46 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
3
votes
1answer
75 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
1
vote
1answer
29 views

What are these %(…)s strings in fail2ban's jail.conf file, and how do they work?

In setting up fail2ban there are what appear to be variables at the top of the jail.conf that look like this: mytime=300 . . . [ssh] bantime=%(mytime)s Or in this more complicated form like this: ...
1
vote
0answers
13 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
2
votes
1answer
298 views

Do I have thousands of attempts to breach my system in this log from logwatch?

I'm setting my systems up to send me reports by email. I'm posting one log report (see below). This log shows that there are thousands of attempted break-ins. Questions: I have denyhosts and ...
1
vote
2answers
71 views

How Does Whonix Keep The User Anonymous?

How does Whonix Linux keep a user secure? I am aware of how it works in terms of the Gateway which uses Tor, but how does the Whonix workstation ensure nothing is logged, or stored, on the OS and no ...
0
votes
1answer
36 views

Not to ask for grub password

I set a superuser and password for grub in Ubuntu and whenever I turn my machine on it asks for username and password... I want when I hit e on my keyboard just asks me for username and password... ...
9
votes
1answer
220 views

Why does the location of Enviroment Variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run ...
2
votes
1answer
45 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
0
votes
1answer
351 views

I stopped MiniSSDPD, will something bad happen?

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" ...
28
votes
5answers
3k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
0
votes
1answer
34 views

how many password generators are there in debian and how to know which are good

I know of two password generators in Debian. The first one which I have used is apg and it seems to generate some good passwords. $ apg -m 15 -M SNCL RefGav:quedTut7 {Shtetmigdybig1 ...
0
votes
0answers
40 views

ubuntu linux - security between applications

When I run a Ubuntu Linux on my machine, and if using only 1 user account, most of the applications executed are using the same uid. I want to know what risks do applications face in this ...
2
votes
1answer
32 views

How to verify one file of a package, not the RPM itself

For instance, can I somehow use rpm to verify that /etc/pam.d/system-auth is unchanged since it was installed on the system? I know I can do this with an entire RPM, but I want to know if I can do ...
2
votes
0answers
37 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the ...
7
votes
4answers
211 views

Where can I “hide” easter eggs for students learning about Linux security? [closed]

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
4
votes
1answer
47 views

Preserve evidence of intrusion / deleted executable?

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, ...
3
votes
3answers
95 views

SSH - Is it possible for an SSH session to take complete control of the client? [duplicate]

When I open a SSH session on my terminal to a remote server, is this only a virtual terminal, or is it possible for the SSH server that I am connected to to "take control" of my terminal? For example, ...
1
vote
1answer
122 views

Chkrootkit found alot of suspicious files and directories, and /sbin/init INFECTED

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and ...
1
vote
1answer
60 views

SSH key-only remote login, is disabling password a good practice?

I need a maintenance user which only requires a remote login. I'll preferably use only public keys to login into the account. I thought of just creating the user with useradd myuser, adding later the ...
0
votes
0answers
27 views

Why there are two different shadow files preset in /etc [duplicate]

I am running ubuntu 12.04 on rackspace cloud. Somehow it has two shadow files /etc/shadow /etc/shadow- I know about the first being used for password protection but where second came from ? Can it ...
6
votes
2answers
174 views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...