Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

7
votes
4answers
366 views

Which data should be excluded from log files , error messages etc. if posted online?

What data should one erase from log files, error messages etc., if posting them as a screenshot so as not to expose sensitive information? As I have little knowledge about this topic, I can vividly ...
0
votes
0answers
144 views

Installing Ossec on an existing centos 6.4 machine

I have an existing machine running centos 6.4. Is it ok to install now the Ossec or it's not worth any more as the machine is already running for few months. Which is the best mechanism to install ...
2
votes
1answer
2k views

Encrypt files using gpg (and them symetric encrypting the key) - is it a normal thing to do in the *nix world?

I read a lot of articles about using gpg to encrypt email, but I would like to use it to encrypt some files - mainly a bunch of *.isos. I'm going to describe what I thought I would do, so you can ...
3
votes
1answer
2k views

Benchmarking Apache using ab

I was doing some performance testing for Apache using ab. Apache in our case is only working as a load balancer balancing load between two Liferay servers. Initially, I did the testing for 1000 ...
-3
votes
1answer
185 views

Priviledge separation for Firefox (aka: how to secure webbrowsing)

I do this on Scientific Linux 6.3 (to implement it, it requires a minimal Linux knowledge): Shared directory for downloads Remember you can only copy from or to this directory, never "move" files ...
10
votes
3answers
6k views

How to make a folder private?

I'm using Ubuntu with several users and I want to make folders viewable just for a specific user. Any idea how to do it?
6
votes
1answer
273 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
2
votes
5answers
4k views

How to securely automate running commands as root with “sudo su -”?

hint (on client side, how to encrypt files/pwd's): # encrypt pwd with ssh key: openssl rsa -in ~/.ssh/id_rsa -outform pem > ~/.ssh/TEMP-id_rsa.pem 2>/dev/null openssl rsa -in ~/.ssh/id_rsa -...
0
votes
1answer
416 views

How to generate 4 WEP keys with linux commands?

I have a sagem router. this router is able to generate 4 WEP keys from a given passphrase. Example: Passphrase: "hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha" key1: ...
-1
votes
3answers
543 views

Is there a way to 'authorize' a command typed in by a user?

is there a way we can authorize a command typed by a user before it takes effect? For example, when a user types cp file1 file2, the command will not be executed and a root / root-equivalent user ...
3
votes
2answers
412 views

How to make sure the shell builtin echo is invoked so that its not visible in process list?

Is this going to be visible in the process listing if the below line is executed from a command line or a shell script bash -c "echo $password" or i just need to do echo $password from within ...
2
votes
1answer
759 views

Is it possible to specify groups in /etc/security/capability.conf?

I've been inspired to start playing around with Linux capabilities again, my pet project is to replace the setuid on a lot of the binaries and provide access to additional privileged utilities to non-...
1
vote
1answer
522 views

How to retrieve information about locked accounts

Is it possible to retrieve info regarding to locked unix accouts? I am interested in seeing information about what date and time the lockout happend and from what hostname (pc name). I would like to ...
1
vote
0answers
536 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the web....
2
votes
1answer
1k views

wpa_supplicant store password as hash (WPA-EAP with phase2=“auth=PAP”)

Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext? By "password" I refer here to the password used for phase2 authentification. I do not ...
4
votes
3answers
242 views

Can someone execute a malware by just inserting a flash disk?

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
4
votes
2answers
916 views

How to encrypt my system such that suspend to RAM works and is also encrypted

How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
2
votes
1answer
139 views

How can I use ForwardAgent with keychain, or detect a new login?

My scenario: I have Server A at home, and Server B at my parents house. I also have Laptop A and Laptop B at home. I do all sorts of strange ssh hops - I might connect Laptop A -> Server A -> ...
3
votes
1answer
484 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
20
votes
3answers
5k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons ...
14
votes
4answers
201 views

What is Linux for SET FILE/ERASE_ON_DELETE?

In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment: $ SET FILE/...
26
votes
1answer
768 views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
8
votes
2answers
1k views

ssh-agent: don't forward authentication for the whole keyring

I have two private ssh keys : one to access my personnal machines, one to access servers at my job. I add those two keys to my ssh-agent with ssh-add. Now, when I do ssh -A root@jobsrv I ...
0
votes
2answers
891 views

How do I make PHP securely load files from the server root home folder on CentOS?

So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be ...
4
votes
1answer
777 views

Having the 'id_rsa.pub' file in my dotfiles public repo securely

So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo? I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my ...
4
votes
2answers
130 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
6
votes
3answers
12k views

Check outgoing network traffic

In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to? I am not paranoid about security, ...
8
votes
1answer
254 views

How to use /etc/fbtab in OpenBSD to secure X11?

OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X." How might one do this? What lines when added to /etc/fbtab would ...
1
vote
1answer
1k views

add members of wheel group, sudo access

On Fedora15, following this wiki, I added a user to wheel group, which is already in the sudoer config file. but still I get not-a-sudoer error prompt. Should I specifically name every member of a ...
4
votes
1answer
207 views

How are loaded SSH keys referenced by name?

I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel) It seems strange to me that it uses a name to reference the keypair - ...
5
votes
3answers
3k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
0
votes
1answer
39 views

How to identify which application is trying to access the unixbuild server?

The error message I am seeing is: Failed publickey for raj from 10.*.*.** port 34355 ssh2 Mar 18 05:22:34 unixbuild sshd[16956]: [ID 1000034 auth.info] Failed password for raj from 10.*.*.* port ...
6
votes
1answer
421 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
2
votes
1answer
228 views

Configure SSH keys for production and DR server

Here is the case, we have successfully configured SSH keys (and hence password-less SFTP connection) between ProdServer-A to ProdServer-B. It works, or so I thought still yesterday. Yesterday ...
5
votes
1answer
827 views

Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?

I've been looking for this for quite a while now but couldn't find a satisfying answer. My scenario: I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
2
votes
1answer
623 views

Securely reading and parsing a string from a parameter or file in bash

I've been writing a number of bash scripts lately which get variables from a parameter or from a file. Some of the scripts run as root (using sudo) This is on my notebook, so there aren't any other ...
2
votes
5answers
3k views

How do I disable copy permissions?

Can we set permissions, on a Linux box OR for a particular directory (Scientific Linux in my case) that, one can read files but cannot copy, move or delete them? Update: My Scenario is, We developed ...
8
votes
4answers
3k views

How to best encrypt and decrypt a directory via the command line or script?

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line. Ideally, ...
9
votes
9answers
2k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
4
votes
2answers
9k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
1
vote
1answer
260 views

Ping from Outside: How do I make my system invisible?

I just did a test that told me my gateway (debian squeeze) responds when being pinged from outside. It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes ...
2
votes
2answers
185 views

Do I need to remove all “java|jre” packages from my system to be secure from java vulnerabilities?

Currently I have these installed on my Scientific Linux 6.3: [root@localhost ~]# rpm -qa | egrep -i 'java|jre' java-1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3.x86_64 java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8....
4
votes
1answer
367 views

Is running programs as another user useful?

After watching a talk by Douglas Crockford on security where he talks about how browsers got the right answer to the question "Who's interest does the program represent?", I wondered if it was ...
4
votes
3answers
1k views

Is a command's stdout to the terminal being logged?

I am interested in learning whether a command's output to the terminal is logged somewhere. Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
2
votes
1answer
251 views

Port 110 visible to the outside world - necessary or a bad idea?

I just did [a test][1] that told me my gateway's (debian squeeze) port 110 is visible from outside. It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes ...
17
votes
1answer
30k views

Is it okay to disable requiretty?

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: ...
3
votes
1answer
79 views

Change order of Private Keys passed via SSH login

ssh -i ~/.ssh/username username@xx.xx.xx.xxx -v Server is set to accept only 3 log on tries. The ssh system is trying 3 identity files before attempting the correct identity file. debug2: key: /...
2
votes
1answer
584 views

Setting the root password vs. sudo -i

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize): sudo -i eliminates the need for a password. Isn't that a problem for ...
1
vote
2answers
149 views

understanding how to run script securely as limited user

I'm a long time dev but linux newbie. I've been building this (http://tryperl.com) to learn linux. So, my question is just about some *nix stuff I don't fully grok. One of the things I want to do is ...
2
votes
1answer
861 views

Properly Set Permission to /home/user folder for webserver

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, ...