Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

6
votes
1answer
2k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
6
votes
2answers
7k views

How do I disable remote root login via ssh?

How do I disable remote root login via ssh? I want to log into my server (I use keys on my main comp) then su into root instead of access root directly. I am using Debian. I follow guides online ...
5
votes
7answers
545 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
4
votes
0answers
39 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this ...
14
votes
1answer
4k views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
11
votes
5answers
1k views

Best way to do full disk encryption?

I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
9
votes
5answers
2k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
7
votes
2answers
6k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
6
votes
2answers
1k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
5
votes
3answers
1k views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
4
votes
2answers
804 views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
3
votes
1answer
178 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
2
votes
1answer
2k views

Encrypt files using gpg (and them symetric encrypting the key) - is it a normal thing to do in the *nix world?

I read a lot of articles about using gpg to encrypt email, but I would like to use it to encrypt some files - mainly a bunch of *.isos. I'm going to describe what I thought I would do, so you can ...
2
votes
1answer
360 views

What flags are used to compile debian stable packages?

Ubuntu wiki states that its packages are compiled with secure flags and secure kernel options. I cannot find this information about debian. See https://wiki.ubuntu.com/CompilerFlags
11
votes
2answers
13k views

Why does sshd requires an absolute path?

Why does sshd require an absolute path when restarting, e.g /usr/sbin/sshd rather than sshd Are there any security implications? P.S the error message: # sshd sshd re-exec requires execution with ...
5
votes
1answer
346 views

How can I find the Secure Attention Key (SAK) on my system and can I disable it?

In answer to My process was killed but I cannot understand the kernel notice, I was pointed to some documentation on the Secure Attention Key (SAK) on Linux. I have a embedded system generated using ...
5
votes
3answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
5
votes
3answers
388 views

Effectivity of shred on different file systems

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
4
votes
5answers
2k views

Protect folder from sudoers

Is there an ability to not allow sudoers view your folder (only you and root can access folder)?
4
votes
2answers
129 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
3
votes
4answers
3k views

Private VLAN's under Linux?

http://blog.ine.com/2008/07/14/private-vlans-revisited/ Has anyone tried private vlan's under Linux? Any experiences with them? My real question is does anybody have howtos regarding this?
2
votes
2answers
122 views

Avoiding plain-text password in http_proxy

I am behind a corporate firewall, which brings lots of pains in the area of proxies. There are two main approaches I've found to work: Use Cntlm at the cost of not being able to connect (from the ...
2
votes
3answers
1k views

How can I securely login remotely to my Linux box over the internet?

I'm pretty much a Linux beginner, but this question has been on my mind. What's the simplest, most secure way to connect to my computer at home from work or from the library, &c? I'm running Mint ...
1
vote
2answers
177 views

OpenVPN : protect your clients key/cert/conf from being stolen?

I have configured an OpenVPN install. Mode: multiclients 1server. Clients are raspberries. I note how easy it is to steal a rasp, and look in HDD to get key+cert+conf. Copy it on your laptop, and ...
1
vote
1answer
1k views

How to copy files as Jenkins “post build” action if i don't have privileges to destination directory

I have the following users "architecture" : root access is disabled. admin user have access only to its home directory. Apache runs as root service (root is the only one that have access to ...
1
vote
0answers
525 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the ...
0
votes
1answer
2k views

What is the default encryption type of the ssh-keygen?

When generating private/public keys with ssh-keygen what types of keys will it generate if I wont pass -t option followed with the encryption type like rsa?
10
votes
2answers
4k views

Should you run automatic updates

I'm running production Centos web servers. I want to know what is best practice for running updates. Should I automate this with yum-cron or yum-updatesd? Or is there a danger of updates breaking ...
10
votes
2answers
6k views

Use wpa_supplicant without plain text passwords

I'm running gentoo on my laptop, and I'm currently using wpa_supplicant to handle wifi. My configuration works and I can connect, but it is required to type in the plain text password into the ...
7
votes
1answer
1k views

Why root's default shell is configured differently with other normal user account's default shell?

As I know, root's default shell is configured csh and normal user's default shell is sh in FreeBSD. And in Ubuntu, root is dash, normal user is bash. (refer: What's the Ubuntu's default shell?) Why ...
6
votes
1answer
620 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
6
votes
7answers
413 views

File protection in Unix

Is there a way to protect a file in such a way that even root cannot delete it or rewrite it after creating it? I have a file which is created by root under /var/log/ and I want to restrict all users ...
6
votes
2answers
290 views

Lock some accounts during some time periods

Is it possible to lock some accounts in order to be accessible only during specific time periods? For instance the account joe should only be accessible during office hours.
5
votes
1answer
141 views

Why does visudo discourage other editors?

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables. It states that "There is no easy way to prevent a user from gaining a root shell if the editor ...
5
votes
3answers
1k views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
5
votes
1answer
392 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
4
votes
3answers
1k views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
4
votes
2answers
493 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
4
votes
4answers
13k views

What type of permissions should a user's home directory and files have?

I'm working with a fresh install of Ubuntu 12.04 and I've just added a new user: useradd -m testuser I thought that the -m flag to create a home directory for users was pretty standard, but now ...
4
votes
2answers
4k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
4
votes
1answer
2k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
3
votes
2answers
1k views

Store password as hash in wpa_supplicant.conf? [duplicate]

This question is very much related to this one. I want to log into a user and password protected wifi which uses PEAP and maybe MS-CHAPv2. My wpa_supplicant.conf has to contain an entry like this: ...
3
votes
2answers
755 views

If you SSH into another computer, how to access other X displays?

This is a query based on personal use. A troll in our local network had downloaded Crikey, the key-event simulator. He used it to simulate events on other computers, leading to unwanted things. For ...
3
votes
3answers
406 views

Setting execution right to whole directory - is it good or bad idea?

I have a zip file containing lot of files and directories for a certain application which should be running on Linux. Some files needs to be set as executable, but the zip file format afaik does not ...
3
votes
2answers
1k views

What directories/file permissions should i ensure are set?

I have a similar question about default software configuration. For this question i would like to ask What directories/file permissions should i ensure are set? Aprrently Is it normal to get ...
3
votes
1answer
217 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
3
votes
1answer
472 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
2
votes
2answers
57 views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ...
2
votes
1answer
192 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...