Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
1answer
40 views

Is it OK to copy /etc/sysconfig/iptables to another machine?

This is my original server with very loose security given that it does not block all ports via iptables. /etc/sysconfig/iptables contents: # Generated by iptables-save v1.4.7 on Mon Jun 16 ...
1
vote
1answer
59 views

How can I tell why I have permissions to read a file? [closed]

Here's what I just noticed on my CentOS SSH account: stat output $ stat /dev/kvm File: `/dev/kvm' Size: 0 Blocks: 0 IO Block: 4096 character special file Device: ...
1
vote
2answers
59 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
2
votes
1answer
26 views

setup sudoers to mount network shares and loop devices and misc

I would like to setup sudoers to grant users to mount all kind of network shares and loop devices to their home directory. Here is a try that I found and changed a bit on one old post in ...
3
votes
3answers
87 views

Monitor all login attempts

Few weeks ago I thought it would be a good idea to write a script to send me an email whenever some user logs in into my server. So I came with a perfectly working script notifyLogin.sh, then I ...
1
vote
0answers
49 views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at ...
1
vote
2answers
272 views

Shell Script - how to scp into remote server and download files and protect password

I have a remote server that I need to download Apache logs from. I can manually scp into the server and get the files, but I'd like to put this in crontab. The only way to automate it is to include ...
5
votes
2answers
155 views

Why ssh-agent group ownership is not root

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? ...
1
vote
1answer
59 views

SSH slow after configuring TCP Wrappers

We have SSH open on one of our production servers leaving it prone to various brute force attacks to break in. I reduced the attempts by changing the default port from 22. I want to further harden ...
2
votes
1answer
36 views

Why isn't 'nethogs' installed with the setuid bit set?

I've been using nethogs for a while now, having to sudo every time, while ping has the setuid bit set. Today I set it for nethogs and it works: $ ls -l $(which nethogs) $(which ping) -rwxr-xr-x 1 ...
3
votes
2answers
77 views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
4
votes
1answer
87 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
1answer
109 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
3
votes
1answer
46 views

Securing VPS against access by server company

I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them: Blocked all ports except those needed for my server with uncomplicated firewall Disabled ...
3
votes
3answers
595 views

What are the world writable directories by default?

In a standard Linux filesystem, which of these common directories are world-writable by default? /tmp /etc /var /proc /bin /boot /.... .... Why are they world-writable? Does that pose ...
1
vote
0answers
65 views

Limit program execution to a list of arguments

I would like that my Unix users can only run a specific command insecurecommand with a controlled list of arguments stored in a file. The only solution I have found at this time is to : Create a ...
5
votes
0answers
72 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
1
vote
2answers
56 views

Permissions under a 700 (rwx------) directory

If a directory /foo/bar/baz has 700 (rwx------) for its permissions, thereby making it inaccessible to all but its owner (and the superuser), does it matter what the "group" and "other" permissions ...
1
vote
1answer
41 views

apache mod_security and performance

I have a list of bots to block, so I was thinking that fail2ban could be a solution until I realized that mod_security would be more efficient in this kind of tasks. The number of bots is huge, so ...
1
vote
2answers
116 views

Why are custom programs always installed in /opt, /srv, /usr/local, etc. and not in ~/ (home) folder?

The LTS repo is pretty good, but for some reason I prefer the "build from source" method for some programs. One reason is that I get the preferred version (PHP on LTS is on 5.3, whereas I can compile ...
1
vote
1answer
69 views

Heartbleed Bug, which OpenSSL services are vulnerable to the leak?

I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL). Before I get started patching, I'd like to have a ...
3
votes
1answer
67 views

Monitoring filesystem activity

Say, I have a program, and I want to monitor its filesystem activity (what files/directories are created/modified/deleted etc.) This program may be capable of spawning further processes, and thus, I ...
1
vote
0answers
33 views

Secure Remote Backups Using Duplicity

The recent take-down of codespaces got me thinking about off-site backup processes (which I currently perform manually with password entry). I have been reading tutorials showing how to automate ...
0
votes
1answer
56 views

Is validation of CN/Hostname verification against SSL certificate required in openssl & why? [closed]

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement?
4
votes
1answer
146 views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...
1
vote
2answers
61 views

Is it bad to select remember me option in the browsers of a compromised machine?

I was reading an article on how to sniff network packets. (of course for knowledge purposes only). I came across these particular lines. For instance, say I was sniffing traffic on the network, ...
1
vote
1answer
50 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting ...
2
votes
1answer
24 views

Credential in PPD file: Is there a way to hide it?

We have a copying machine that can be used as a printer. In order to do that, I have to provide a credential in plain in the Xerox.ppd file. Problem: Any user on the system can grep credential ...
6
votes
3answers
338 views

Force Firefox to remember passwords on particular sites

Usually, when I log into a website with username and password, Firefox asks whether it should remember the login details. When I click yes, next time I visit the website, the username and password ...
0
votes
0answers
31 views

hydra verification before stopping

I am getting false positives when I try a penetration test on my local service with hydra: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post ...
1
vote
2answers
113 views

Secure wipe (scrub) filesystem of VPS from VPS itself

I have a VPS I'm planning to delete. This particular cloud provider makes no guarantee that the data on the drive will be wiped before giving the disk to the next person. What's a best effort attempt ...
3
votes
1answer
87 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
2answers
125 views

/etc/init.d permissions issue

We are trying to harden our Linux Redhat 5 servers and one of the findings is for the /etc/init.d. The security finding is requiring that we chmod it to 700 or more restrictive. Please see the ...
1
vote
0answers
13 views

backupninja: password outside config file

I would like to use a dup rule in backupninja to make an encrypted remote backup. The configuration file format includes entries for the encryption and ftp password. I would like to move them out of ...
0
votes
1answer
111 views

How do you encrypt a USB drive partition with the Twofish cipher and SHA-512 hash without using TrueCrypt? [closed]

I've been trying to string together the right flags in cryptsetup: cryptsetup -y -h sha512 -c twofish-xts-plain64 -s 512 luksFormat /dev/sdx But it hasn't been working. When I enter the command ...
1
vote
1answer
338 views

cleaning up an hacked ubuntu server

They have hacked my VPS and changed the root passowrd. Fortunately my provider has reset it for me and now I got control back again. The thing is that now I would like to make sure the don't have ...
1
vote
2answers
35 views

List of files accessed by application

I want to install propertiary AMD driver but I would also like to know which files were created/changed by installer. Is there some application which can observe (probably by inotify) which files were ...
1
vote
2answers
187 views

How can I ssh to a remote server with an automated password and no key?

I have a remote server. I planned to use public keys to connect over ssh without typing the password but the remote system rejects public key authentication. So what is the best way to do it? What ...
0
votes
1answer
49 views

Execute scripts without decrypting them

I have a set of scripts (bash, ruby, python) and want to put everything into a container like file so I can deploy this container on a lot of servers. This scripts need to protect from accessing other ...
0
votes
2answers
202 views

Unable to telnet public ip on port 80

We are facing a communication problem between the public and our private network. We have a Linux based web server behind a firewall and an internet router. As part of some integration, our web portal ...
2
votes
1answer
1k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
1
vote
2answers
89 views

how to nsupdate remotely?

I have BIND as a DNS server, what I want is to let this server to allow me to add or remove records to a zone without manually editing the zone file and I want to do this remotely. Is this updating ...
1
vote
0answers
59 views

What information is sent from client to the server when a SSH connection is established?

So let's say I'm on machine A and connect to machine B, and then from there I connect to machine C (with three different usernames). So the SSH connections are: A (john) --> B (eli) --> C(bill) ...
2
votes
3answers
586 views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
2
votes
2answers
54 views

Is it secure to connect remotly to Mysql using shell?

I have created a shell script to connect to a DB and do some queries: #/!bin/bash ... ... mysql -h remote -u root --password='pw' MatchingDB some SQL queries My question is : Is this connection ...
1
vote
1answer
155 views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
1
vote
1answer
53 views

Meaning of entries in /etc/securetty?

I've been given a set of entries to apply to /etc/securetty, what does each of them mean? console tty1cd / tty2 tty3 tty4 tty5 tty6 ttyS0 ttyS1 I'm especially interested in the "tty1cd /" entry. I ...
5
votes
1answer
76 views

Why does visudo discourage other editors?

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables. It states that "There is no easy way to prevent a user from gaining a root shell if the editor ...
1
vote
0answers
15 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
6
votes
3answers
2k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...