Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
0answers
529 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the web....
2
votes
1answer
1k views

wpa_supplicant store password as hash (WPA-EAP with phase2=“auth=PAP”)

Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext? By "password" I refer here to the password used for phase2 authentification. I do not ...
4
votes
3answers
242 views

Can someone execute a malware by just inserting a flash disk?

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
4
votes
2answers
880 views

How to encrypt my system such that suspend to RAM works and is also encrypted

How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
2
votes
1answer
139 views

How can I use ForwardAgent with keychain, or detect a new login?

My scenario: I have Server A at home, and Server B at my parents house. I also have Laptop A and Laptop B at home. I do all sorts of strange ssh hops - I might connect Laptop A -> Server A -> ...
3
votes
1answer
476 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
20
votes
3answers
5k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons ...
14
votes
4answers
201 views

What is Linux for SET FILE/ERASE_ON_DELETE?

In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment: $ SET FILE/...
26
votes
1answer
762 views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
8
votes
2answers
1k views

ssh-agent: don't forward authentication for the whole keyring

I have two private ssh keys : one to access my personnal machines, one to access servers at my job. I add those two keys to my ssh-agent with ssh-add. Now, when I do ssh -A root@jobsrv I ...
0
votes
2answers
878 views

How do I make PHP securely load files from the server root home folder on CentOS?

So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
3
votes
1answer
756 views

Having the 'id_rsa.pub' file in my dotfiles public repo securely

So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo? I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my ...
4
votes
2answers
130 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
6
votes
3answers
12k views

Check outgoing network traffic

In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to? I am not paranoid about security, ...
8
votes
1answer
254 views

How to use /etc/fbtab in OpenBSD to secure X11?

OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X." How might one do this? What lines when added to /etc/fbtab would ...
1
vote
1answer
1k views

add members of wheel group, sudo access

On Fedora15, following this wiki, I added a user to wheel group, which is already in the sudoer config file. but still I get not-a-sudoer error prompt. Should I specifically name every member of a ...
4
votes
1answer
206 views

How are loaded SSH keys referenced by name?

I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel) It seems strange to me that it uses a name to reference the keypair - ...
5
votes
3answers
3k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
0
votes
1answer
39 views

How to identify which application is trying to access the unixbuild server?

The error message I am seeing is: Failed publickey for raj from 10.*.*.** port 34355 ssh2 Mar 18 05:22:34 unixbuild sshd[16956]: [ID 1000034 auth.info] Failed password for raj from 10.*.*.* port ...
5
votes
1answer
405 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
2
votes
1answer
226 views

Configure SSH keys for production and DR server

Here is the case, we have successfully configured SSH keys (and hence password-less SFTP connection) between ProdServer-A to ProdServer-B. It works, or so I thought still yesterday. Yesterday ...
5
votes
1answer
817 views

Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?

I've been looking for this for quite a while now but couldn't find a satisfying answer. My scenario: I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
2
votes
1answer
606 views

Securely reading and parsing a string from a parameter or file in bash

I've been writing a number of bash scripts lately which get variables from a parameter or from a file. Some of the scripts run as root (using sudo) This is on my notebook, so there aren't any other ...
2
votes
5answers
3k views

How do I disable copy permissions?

Can we set permissions, on a Linux box OR for a particular directory (Scientific Linux in my case) that, one can read files but cannot copy, move or delete them? Update: My Scenario is, We developed ...
8
votes
4answers
3k views

How to best encrypt and decrypt a directory via the command line or script?

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line. Ideally, ...
9
votes
9answers
2k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
3
votes
2answers
9k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
1
vote
1answer
255 views

Ping from Outside: How do I make my system invisible?

I just did a test that told me my gateway (debian squeeze) responds when being pinged from outside. It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes ...
2
votes
2answers
183 views

Do I need to remove all “java|jre” packages from my system to be secure from java vulnerabilities?

Currently I have these installed on my Scientific Linux 6.3: [root@localhost ~]# rpm -qa | egrep -i 'java|jre' java-1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3.x86_64 java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8....
3
votes
1answer
358 views

Is running programs as another user useful?

After watching a talk by Douglas Crockford on security where he talks about how browsers got the right answer to the question "Who's interest does the program represent?", I wondered if it was ...
4
votes
3answers
1k views

Is a command's stdout to the terminal being logged?

I am interested in learning whether a command's output to the terminal is logged somewhere. Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
2
votes
1answer
248 views

Port 110 visible to the outside world - necessary or a bad idea?

I just did [a test][1] that told me my gateway's (debian squeeze) port 110 is visible from outside. It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes ...
17
votes
1answer
29k views

Is it okay to disable requiretty?

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: ...
3
votes
1answer
77 views

Change order of Private Keys passed via SSH login

ssh -i ~/.ssh/username username@xx.xx.xx.xxx -v Server is set to accept only 3 log on tries. The ssh system is trying 3 identity files before attempting the correct identity file. debug2: key: /...
2
votes
1answer
577 views

Setting the root password vs. sudo -i

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize): sudo -i eliminates the need for a password. Isn't that a problem for ...
1
vote
2answers
149 views

understanding how to run script securely as limited user

I'm a long time dev but linux newbie. I've been building this (http://tryperl.com) to learn linux. So, my question is just about some *nix stuff I don't fully grok. One of the things I want to do is ...
2
votes
1answer
839 views

Properly Set Permission to /home/user folder for webserver

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, ...
13
votes
6answers
997 views

Which linux distro's package repositories are secure and which are not?

Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure ...
1
vote
2answers
95 views

how to require sudo to view files?

I have a ssh server. I allow people to connect to it if they want. I do my programming homework on it. I am in trouble with my teacher because people were cheating off it. I need to know how to ...
3
votes
1answer
3k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
1
vote
3answers
443 views

Can a mounted encrypted filesystem be safe from root?

I have access to a shared remote computer from which I would like to run some code I have written which uses an interpreter (not a compiled code). I would like to protect this source code from other ...
1
vote
2answers
5k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
2answers
76 views

What permissions should I set if I'm the only user?

I'm the only user on a OS X machine and am wondering what the best practice is for setting permissions on my sensitive files. Specifically, are there reasons to prefer one of the following -rw------- ...
2
votes
0answers
133 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude me,...
3
votes
3answers
3k views

How secure is Ubuntu in Virtualbox on Windows host?

I have the most recent version of Ubuntu in Virtualbox on Windows 7 host. How secure will that be? I mean if I get malware on windows how will that affect the Ubuntu system I am working on?
4
votes
2answers
643 views

How to lock a directory?

I want to block any kind of access to a certain directory unless a password is provided. It could be my root or account password. The directory is residing on an NTFS partition, and this method needs ...
5
votes
3answers
316 views

Creating linux distro for use during exam

I'm thinking about creating a liveCD having some linux on it. The distro (let's call it Exam OS) is meant to be used by students during an exam and should be, at least, unpleasent to bypass. Let's ...
19
votes
3answers
2k views

Securely delete files on btrfs filesystem

Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk. ...
5
votes
2answers
128 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
9
votes
5answers
2k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...