Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
30 views

user-level guide to maintaining Debian package update security? [closed]

Recently I listened to an interview with Kim Zetter (audio download here) on cybercrime/warfare, particularly Stuxnet and Flame. While listening to the discussion of how Flame exploited Windows ...
1
vote
1answer
41 views

rkhunter reports /sbin/ip has changed

I am using rkhunter 1.4.2 on CentOS 6.5. A message, in /var/log/rkhunter.log is Warning: The file properties have changed: [09:40:35] File: /sbin/ip [09:40:35] Current size: 247396 ...
1
vote
1answer
71 views

IP Camera with embedded Linux

I have purchased an IP Camera from Ebay (http://www.ebay.com/itm/151349669865). When I read the description of the camera, it said it has an embedded linux in it. I though that I will be able to ...
4
votes
2answers
195 views

Why rejection of password is much slower than acceptance of it? [duplicate]

In both my Linux and OSX machines when I type in the password to login, a correct password is accepted immediately. However, if I type a wrong password, checking process takes much longer. How is ...
5
votes
2answers
60 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
2
votes
1answer
22 views

Parentals Controls? [closed]

How do we implement parental controls? We have a customer with multiple retail locations and one computer at each. They switched to Ubuntu to lock down the computers, but many of the employees are ...
0
votes
0answers
28 views

How do I force a command to be run on local login?

I was wondering how do I force a command on login of a linux system? (debian 7). This is for a 2FA authentication command. I am asking for a local login.. not ssh.
2
votes
1answer
27 views

Security of capabilities vs setuid (LD_PRELOAD, etc)

I know that if a process is run setuid that it's protected against various things that could subvert the process, like LD_PRELOAD and ptrace (debugging). But I haven't been able to find anything on ...
3
votes
1answer
63 views

Scan ~/Downloads on new file creation

I want all new files added to ~/Downloads (and sub-folders) to be scanned with clamscan. When using Firefox on other OSes/Machines I've noticed that downloaded files sometimes get automatically ...
5
votes
1answer
62 views

Sterilize PDF files

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious ...
1
vote
2answers
46 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it is of no help: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing ...
0
votes
1answer
205 views

Is my linux mint box vulnerable to Shell-Shock attacks? How might I remedy that? [closed]

Is it safe to use Linux Mint now, with ShellShock existing? If not, what can I do to use Mint safely?
-4
votes
1answer
35 views

Which Linux should I chose for penetration testing and networking [closed]

I am fairly new to networking and penetration testing, however, I'm really interested in the field and would like to know which distribution of Linux would be best to work with for security ...
4
votes
1answer
32 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
2
votes
1answer
45 views

Remove ex-admin user account and grant privileges / permissions / ownership to another

I would like to find the simplest way to remove the old system admin's user and group from a Gentoo server and put them all under my name instead. He no longer works here and it would appear that a ...
2
votes
2answers
114 views

How to disallow file modification time change for non root users

I don't want anybody to create a file then change the creation date to backward date(For example using touch or system call). In my Ubuntu hosting account I'm getting many hacked php code getting ...
0
votes
0answers
25 views

Is there a solution for scanning webserver files for malicious code?

I have seen several times people move code into web servers now that had malicious code embedded into their HTML, php and other documents. These then get served up from the new server until they are ...
0
votes
2answers
36 views

If I install malicious software what may it do? [closed]

If I software in a deb file and I do sudo dpkg -i file.deb will it execute code from the package and possibly wreck my system? If I log in as testuser and execute the software (simply thebinary on ...
3
votes
2answers
56 views

Lock system after awake suspend (incl. forced-shutdowns system after countdown)?

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and ...
1
vote
0answers
56 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
2
votes
1answer
43 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability?

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
1
vote
1answer
41 views

Latest libxml2 port to RHEL4

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention ...
0
votes
1answer
132 views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
148 views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
0
votes
2answers
59 views

ClamAV found virus, if I should delete this virus? [closed]

ClamAV has found two viruses on my server. Is this a virus? Should I delete it? /tmp/back: Perl.Shellbot-8 FOUND /var/tmp/back: Perl.Shellbot-8 FOUND
0
votes
3answers
63 views

last command only shows few days worth of logins

I often use thelast command to check my systems for unauthorized logins, this command: last -Fd gives me the logins where I have remote logins showing with ip. From man last: -F Print full ...
1
vote
3answers
137 views

Securely passing user input to command

I have a daemon daemon running in Server A. There, there's an argument based script to control the daemon daemon_adm.py (Server A). Through this script I can insert "messages" to daemon coming from ...
2
votes
2answers
47 views

What is best and secure way to save application settings?

Let's say I have an application which has plugins, daemons, etc. Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is ...
1
vote
0answers
54 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
6
votes
3answers
639 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
0
votes
0answers
69 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
0
votes
0answers
123 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
0
votes
0answers
19 views

DEBUG_RODATA option in the linux kernel

I am wondering what exactely the use of DEBUG_RODATA is in the linux kernel. The help says: CONFIG_DEBUG_RODATA: Mark the kernel read-only data as write-protected in the pagetables, in order to ...
3
votes
1answer
42 views

How can I lock down a user account to the point that it can read/write/execute as little as possible?

I would like to lock down an Arch Linux user account to the maximum extent possible. The only functionality required for the account is to accept a non-terminal SSH session which allows the client to ...
8
votes
2answers
165 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
4
votes
1answer
26 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
1
vote
2answers
200 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
8
votes
2answers
8k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
2
votes
0answers
30 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
0
votes
0answers
89 views

Permission denied tmp dir on STIG RHEL

I am writing a program for a DISA STIG version of Red Hat Linux 6.5. I wrote a shell script to do self extracting on the program and when it self extracts put temporary files in the tmp directory that ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
7
votes
4answers
21k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
1
vote
0answers
23 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
93
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
0
votes
1answer
71 views

What are the potential negatives of turning on process accounting (psacct package)?

I am looking into turning on process accounting on some EL6 servers. What are the potential pitfalls of turning this on? If you mitigate storage requirements with log rotation, any reason you would ...
0
votes
2answers
92 views

Accessing Linux server via VPN or Certificate based ssh?

My company has a fairly common security setup where you need to log in via VPN, when outside the company network in order to get access to the servers. The biome is mostly Windows machines. I'm ...
1
vote
0answers
53 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
4
votes
1answer
139 views

read only symlink or something similar? [duplicate]

I created myself a NAT for home use (Ubuntu+Samba+Greyhole+Apache+MySQL+other web server related stuff). 90% of files I store there are pictures that i really don't wanna loose (that's why Greyhole). ...