Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
2answers
156 views

Avoiding plain-text password in http_proxy

I am behind a corporate firewall, which brings lots of pains in the area of proxies. There are two main approaches I've found to work: Use Cntlm at the cost of not being able to connect (from the ...
2
votes
2answers
57 views

Would draining entropy make it easier to compromise a system? [duplicate]

Entropy is important for many security features like TCP sequence numbers and cryptographic key/parameter generation. My understanding is that the entropy pool is drained by an operation as simple as ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
0
votes
0answers
66 views

Does the following error indicate my system is compromised?

[FAILED] Failed to Verify Integrity of password and group files. See 'systemctl status shadow.service' for details. I get this message in T1 every time I start up the computer but I havn't noticed ...
1
vote
2answers
26 views

Are there sandboxing concepts for proprietary binary kernel modules in linux?

Quite a lot has been going on to advance inter-process security (UID the same) and priveledge dropping in userland, yet it is common that proprietary linux kernel components are used (it seems that ...
1
vote
0answers
135 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
1answer
73 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
0
votes
0answers
8 views

How to permanently set a password for ipaserver client accounts

I want to setup a password for RHEL/Centos ipaserver client accounts but it seems I have to keep manually resting it on the ipaserver host. Is there a way to persistently set it?
1
vote
1answer
60 views

How to write a file a file via ssh

I want to write a file in the Machine B under /home/test whose permissions are root:root and rwxr-xr-x. I have an account on the Machine B, named testUser. When logged to the Machine B with ...
1
vote
2answers
30 views

Whats the difference between adding scripts in the /etc/cron.daily/ or editing in your script in crontab(-e)?

There are multiple options - with cron - to start your script at a specific time, but, is one more secure over the other? My question is simple: Whats the difference between adding scripts in ...
3
votes
2answers
60 views

Why are privs required to setgid() to supplementary groups

The various set*gid() system calls require privileges to change groups except in a very few cases. Changing primary group to one of the processes' supplementary groups does not appear to be one of ...
0
votes
3answers
99 views

How to stop a user from seeing command line arguments?

We have a CI server application run as the build user. Any command with arguments run by the CI server is visible via ps. Although non-admin users do not have access to load a shell on the CI server, ...
3
votes
1answer
179 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
-2
votes
1answer
61 views

how to fix potentially infected binary files? [closed]

when I installed the updates on my computer (Ubuntu 14.04), I typed the password, thinking that it was asked for regular updating , but when I noticed some strange behavior and crash at this moment, I ...
1
vote
0answers
34 views

BeEf Famework Kali-2 configuration

I am running Kali-2(rolling 1 latest) in Vmware workstation 12. I have forwarded my ports and am using NAT. The beef framework links only seem to work within the local network. Any specific reason? ...
0
votes
1answer
51 views

pam_mount changes owner of mountpoint to root

On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image ...
8
votes
1answer
276 views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
2
votes
4answers
71 views

security issues from installing from source code as root

I had a question arise about how installing from source code in the root account is not a good idea because of security reasons. My stance on it is that it does not really matter if someone is in ...
1
vote
2answers
457 views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
2
votes
1answer
57 views

Information leaks out of encrypted file system

If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems like swap space files in /tmp ...
0
votes
1answer
37 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
1
vote
0answers
27 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
0
votes
0answers
45 views

How to set usb stick's ntfs filesystem's attribute to readonly in linux

I know how to set readonly attribute to ntfs filesystem of a usb device by using diskpart tool in windows. attributes disk set readonly but how to set readonly attribute to the same usb device ...
4
votes
1answer
36 views

LXC: Are downloaded templates verified?

Debian 8.3, LXC 1:1.0.6-6+deb8u2 When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the ...
1
vote
1answer
34 views

Creating Encrypted Tunnel Between 2 Lans

I have 2 LANs and one of them is connected to the internet and I need to connect them together. Normally, a single cat6 cable is enough for connection however, this cable is going through a public ...
31
votes
4answers
2k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
1
vote
1answer
61 views

Linux TOTP vs SSH Keys

I am in the middle of a security upgrade task and have been reading a lot of articles around SSH security. I have a question around what is the better method of securing SSH by using SSH Keys or TOTP? ...
4
votes
2answers
97 views

Debian Lenny Server Compromised - No Sign Of Intrusion Point?

I have a server, it's outdated running Debian Lenny, and yes I know that is probably half the problem. It also has PHPMyAdmin and ProFTPd. Again, I get it, all bad signs. But for the life of me, I ...
2
votes
0answers
46 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (...
1
vote
1answer
102 views

fail2ban ip blocked, yet still login attempts

everything seems ok, iptables shows its blocked, yet I still get auth attempts I have configured fail2ban # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1/8 bantime ...
0
votes
2answers
61 views

Need the sshd server be run in root privilege for a password-less login? [closed]

I mean: if the sshd is't being run in root account, then how can it let the remote ssh client run shell or other command in root account ? if sshd call the login command, then the user could login ...
4
votes
1answer
108 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
3
votes
4answers
225 views

Why does mknod require root privileges?

I noticed that the mknod command required root privileges when a creating a node other than a regular file, FIFO or a Unix socket. Why is that? How can a regular user harm a system or compromise ...
4
votes
1answer
109 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
3
votes
1answer
35 views

What are the drawbacks of using policy_any in openssl.cnf?

As given in this document, we may use policy_any to ignore most of the fields of subject in certificate request. There must be some drawbacks of ignoring such fields, would it may lead to some ...
0
votes
3answers
51 views

What additional privileges does the root user have over a standard user? [closed]

What additional privileges does the root user have over a standard user in Linux?
0
votes
1answer
30 views

Is sudo useful to protect my data from malwares?

I'm considering creating a separate account for browsing, and launching my browser with sudo -u browseraccount {firefox,chromium,etc}. I wonder if this can prevent a malware (especially ransomwares) ...
1
vote
2answers
98 views

Is it evil to link to a crontab?

I think about doing something like: sudo ln -s ~/myCustomCrontab /var/spool/cron/crontabs/username because I'd like to have all customized files in my home directory. Possible risks I can think of ...
56
votes
6answers
5k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
0
votes
1answer
56 views

What are the right permissions to set to make files unreadable unless it's my main user accessing them?

Basically I didn't encrypt my Linux (Debian) partition when installing it. However I found a way to encrypt at least home folder so in theory I could put everything there which I want to make sure it'...
1
vote
0answers
35 views

Is insecure to give users permissions to apps in /opt? [duplicate]

I'm working with some apps (the best example i can give is Firefox Developer Edition) that i put in the /opt folder. These apps work perfectly until they need to apply and update, and that's because /...
0
votes
0answers
69 views

Does running fcgiwrap with nginx give the same added security as creating a new php-fpm pool for every site by hand?

Here's the nginx + fcgiwrap configuration I'm talking about. I don't understand what the main differences are between this kind of a fcgiwrap configuration and a nginx + php-fpm configuration. They ...
0
votes
0answers
28 views

How to get informed about EVERY incoming ssh connection (e.g. with no remote command specified)

The case I'm used to set up automatic reverse ssh tunnels to remote computers via my server with cron. Usually I use the following entry: @reboot sleep 300 && ssh -MNf -R xxx22:host:22 user@...
0
votes
1answer
17 views

Hide/Encrypt application configuration

Is there any way to hide/crypt software config files (services such as Apache web server , Varnish and so on) from boss and others?
1
vote
0answers
54 views

dirmngr does not start with proper home directory unless it is restarted

I am trying to follow these guidelines for gpg best practices: https://help.riseup.net/en/security/message-security/openpgp/best-practices but I am having trouble with dirmngr, which handles all ...
0
votes
1answer
39 views

Can't access web sites when running iptables script!

I have wrote script for protecting my machine: #!/bin/bash ssh=1.1.1.1 http='1.1.1.1 2.2.2.2' # Clear any previous rules. iptables -F # Default drop policy. iptables -P INPUT DROP iptables -P ...
0
votes
1answer
52 views

How to protect from chrooting to its linux partition and how to chroot it after using the protection?

I am currently using archlinux, It is possible to boot on an archlinux installation iso for instance, to mount my current archlinux partition and my boot partition and then to use arch-chroot. Then I ...
1
vote
1answer
99 views

Managing iptables for specific ips and ports

I disable firewall like so: #!/bin/bash iptables -F iptables -X iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT Update I also enable my firewall: #!/bin/bash ssh=x....
1
vote
2answers
79 views

Storing application passwords in central location

Is there any secure local service that one should use for storing and retrieving organization wide application passwords? Most of the time we need authentication information in our scripts to run some ...
1
vote
0answers
15 views

Need Help to Solve Screenlock Bypass Issue for Expired User Account

I have created a script that I deploy to my children's computers via Salt. The script implements allowed working hours and has worked well, but one of my children have found a way of bypassing this ...