Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

17
votes
1answer
28k views

Is it okay to disable requiretty?

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: ...
3
votes
1answer
77 views

Change order of Private Keys passed via SSH login

ssh -i ~/.ssh/username username@xx.xx.xx.xxx -v Server is set to accept only 3 log on tries. The ssh system is trying 3 identity files before attempting the correct identity file. debug2: key: ...
2
votes
1answer
572 views

Setting the root password vs. sudo -i

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize): sudo -i eliminates the need for a password. Isn't that a problem for ...
1
vote
2answers
148 views

understanding how to run script securely as limited user

I'm a long time dev but linux newbie. I've been building this (http://tryperl.com) to learn linux. So, my question is just about some *nix stuff I don't fully grok. One of the things I want to do is ...
2
votes
1answer
830 views

Properly Set Permission to /home/user folder for webserver

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, ...
13
votes
6answers
980 views

Which linux distro's package repositories are secure and which are not?

Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure ...
1
vote
2answers
94 views

how to require sudo to view files?

I have a ssh server. I allow people to connect to it if they want. I do my programming homework on it. I am in trouble with my teacher because people were cheating off it. I need to know how to ...
3
votes
1answer
3k views

Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This ...
1
vote
3answers
437 views

Can a mounted encrypted filesystem be safe from root?

I have access to a shared remote computer from which I would like to run some code I have written which uses an interpreter (not a compiled code). I would like to protect this source code from other ...
1
vote
2answers
5k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
2answers
76 views

What permissions should I set if I'm the only user?

I'm the only user on a OS X machine and am wondering what the best practice is for setting permissions on my sensitive files. Specifically, are there reasons to prefer one of the following -rw------- ...
1
vote
0answers
130 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude ...
5
votes
3answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
3
votes
3answers
3k views

How secure is Ubuntu in Virtualbox on Windows host?

I have the most recent version of Ubuntu in Virtualbox on Windows 7 host. How secure will that be? I mean if I get malware on windows how will that affect the Ubuntu system I am working on?
4
votes
2answers
626 views

How to lock a directory?

I want to block any kind of access to a certain directory unless a password is provided. It could be my root or account password. The directory is residing on an NTFS partition, and this method needs ...
5
votes
3answers
312 views

Creating linux distro for use during exam

I'm thinking about creating a liveCD having some linux on it. The distro (let's call it Exam OS) is meant to be used by students during an exam and should be, at least, unpleasent to bypass. Let's ...
19
votes
3answers
2k views

Securely delete files on btrfs filesystem

Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk. ...
5
votes
2answers
127 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
9
votes
5answers
2k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
10
votes
1answer
3k views

How to stop users from Switching to Root user

I have disabled the root user login from Sshd.conf file so now no one can login using root user even if they know the password SOMEHOW. Now I have 3 users in server ROOT,EMERG and ORACLE. I want to ...
0
votes
1answer
225 views

Intruder nature detection by opensource tools like tripwire

I want to use different kind of intrusion detection tools like OpenSource Tripwire. Please suggest me some tools which can provide me some additional information to that provided by tripwire? ...
5
votes
1answer
780 views

What should I check after an unauthorized access?

I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one ...
2
votes
2answers
691 views

Install from RPM, then files change. How can I see the differences?

This is a RedHat Enterprise 5.5 system. I ran a verification check against an RPM, and it looks like two files have changed: # rpm --verify shadow-utils S.5....T c /etc/default/useradd S.5....T c ...
2
votes
1answer
528 views

Running a local port scan and found open ports but, don't know what they're used for?

I wrote a very basic python script to port scan my system. I'm running linux-mint lisa: open_ports = [] for port in xrange(65536): conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ...
1
vote
3answers
64 views

execute file in server more safely?

We have a application which takes a C++, C, or Java file as input, executes it, and displays the output to the client. What are the best measures that can be taken so that no security related issues ...
2
votes
2answers
1k views

A command to check file access permission for another user

I need to know how to check the effective file access permissions for a given user, but it takes long to do this manually starting from / up to the target file or directory, checking group, ...etc.
5
votes
3answers
726 views

Why does time/ident/daytime/comsat run after an OpenBSD 5.2 install?

I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd". After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output: Why does so ...
2
votes
1answer
476 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
9
votes
1answer
1k views

How can I limit ssh *remote* port forwarding?

I need to limit which ports can be remotely 'ssh -R' forwarded by an user. I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding ...
4
votes
3answers
2k views

Is it impossible to run as `root` if the machine isn't rooted?

By default, the user of the device does not have access to certain root objects (e.g. the /data directory). Even though these objects are off-limits, however, it would seem to me that these objects ...
11
votes
5answers
1k views

Best way to do full disk encryption?

I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
0
votes
0answers
56 views

Ossec Installation Error

While installing Ossec Hids 2.6 on Redhat 5.5 installed on Virtual Machine, I got this error message. Whats wrong here.
1
vote
1answer
114 views

keeping keys on an auxiliary removable drive

It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any ...
1
vote
1answer
152 views

Accounts attacked

I have run two commands below. I find some of the accounts attack as below. I do not have the account test,teste,oracle and admin in my home directory. As there system account. How to know which are ...
2
votes
3answers
1k views

How can I securely login remotely to my Linux box over the internet?

I'm pretty much a Linux beginner, but this question has been on my mind. What's the simplest, most secure way to connect to my computer at home from work or from the library, &c? I'm running Mint ...
9
votes
4answers
12k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
2
votes
2answers
1k views

Moving a root directory to a separate partition

I'd like to create a new partition and move the contents of the /var directory to it for the security reason of having /var/www and other subdirectories "mounted" with nosuid, noexec, and nodev ...
16
votes
5answers
9k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I have an idea, I'm sure it would work, but I would really like an expert opinion. I prefer things to be as ...
4
votes
3answers
1k views

rsync server/daemon security

I have a NAS (Netgear Readynas NV+) at home and a linux (Arch) box at work that is always on. The linux box is already running an ssh server/daemon and the NAS is already running an rsync ...
5
votes
3answers
3k views

How to clear terminal after logging out?

Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?
0
votes
4answers
916 views

securing SSH and disabling direct root

In these instructions below what appears on my terminal is different so not sure what I should change. After port 22 mine says #AddressFamily any and further down for protocol it has longer line ...
-2
votes
1answer
127 views

What software(s) should I install on new system(with Linux as a OS) to prevent it from getting hacked? [closed]

I am switching to new system with a OS using Linux.I will be using another system which has windows ultimate which is hacked.I am being cyber bullied. I have given a reference to this as a question on ...
0
votes
0answers
87 views

Usage of stunnel for configuring secure services as a default?

Ok, I am aware nothing will beat manual security configuration through your standard daemon config files, but is it bad practice to configure stunnel for all services on say, a production ...
10
votes
2answers
750 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
2
votes
0answers
3k views

How can I connect to a wireless network with hidden SSID using the terminal? [closed]

I'm starting to learn about wireless pentesting with BackTrack, and while learning how to find out the hidden SSID I wondered how could I connect to the wireless network after I discover the SSID. The ...
3
votes
1answer
80 views

How is the inherited file descritor vulnerability dealt with in Unices?

Ulrich Drepper describes a vulnerability in programs that have open file descriptors then they fork() and execve() without lots of very careful locking in place. He also talks about new kernel ...
1
vote
1answer
392 views

How to export a private PGP email key

I have made a keypair for my email address using gnupg. I thought that I should probably keep a backup of it so that if I lose my desktop computer I can continue using the same key. Is this the ...
3
votes
2answers
376 views

Recommended way to login to root?

After I found out hundreds of hacking attempts are made in a day I decided I want to disable logging in to root remotely via a password. But then I found I can't switch users in WinSCP so I can't ...
1
vote
2answers
468 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
3
votes
1answer
2k views

How to replace setuid with file-system capabilities

Inspired by this question here is the follow-up: As some of you may know setuid-binaries are dangerous, since some exploits use these to escalate their rights up to root. Now it seems that there has ...