Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
1answer
41 views

Where do my keypresses go ?

Scenario (Ubuntu 14.04.2) : I wake Ubuntu from suspend. I know (from past experience) that it only takes 2 or 3 seconds for the lock screen to become available. My monitor, however, takes longer - ...
1
vote
1answer
115 views

Firefox in Docker, failed in isolation

While experimenting with docker, I realized I can run a browser in a container for improved security. I managed to start with a clean Docker Fedora, in which I installed the openssh-daemon package. ...
4
votes
1answer
154 views

SSH server listening on multiple ports with passwordless access not allowing connections to second port

I have my Synology NAS running an SSH server listening on the default port 22 and I set up passwordless authentication with a public/private key and a passphrase: From sshd_config: ...
1
vote
0answers
88 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...
1
vote
1answer
71 views

Is it possible to mount a file with different ownership/permissions?

I have been experimenting with privilege escalation using the mount command and would like to know if it is possible to create a suid file owned by root without having access to any external device. ...
0
votes
1answer
115 views

FreeBSD 10: Do I need jails?

I'm in the process of setting up a FreeBSD 10 server with just some services on a KVM server: NGINX webserver w PHP-FPM 2 domains, 3 subdomains Mailserver 3 Email addresses MySQL (or other) ...
0
votes
2answers
66 views

FreeBSD 10 and ZFS: Methods for encrypting files

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver. I'm really new to FreeBSD in general (coming from Debian Linux). I installed the system choosing ZFS with encrypted root volume ...
1
vote
0answers
162 views

md5 password hash

I'm looking to create a md5 hash to use in /etc/shadow. Someone suggested using grub-crypt. Every time I put the same password in I get a different hash. [root@endpoint ~]# grub-crypt --md5 Password: ...
2
votes
4answers
74 views

can a super user steal passwords from other users with keylogging?

First, before I get answers containing information that I already know, yes, I'm aware that the superuser can reset passwords, and yes, I know that the superuser can log in as other users without ...
0
votes
2answers
44 views

Is this an argument that Linux security is not impenetrable?

From what I understand, the biggest and probably only line of defense against unauthorized software (viruses and worms) from being installed on the system is to simply not allow it unless an admin ...
-1
votes
3answers
67 views

Is linux secure? [duplicate]

Is linux free from almost all security vulnerabilities when compared with windows? If there are so, can i install any patches to fix them? Thanks in advance.
5
votes
1answer
455 views

Linux Server Hacked

I received e-mails from Google saying that my websites are hacked. This is the e-mail. Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently ...
0
votes
1answer
27 views

Can I use the sudoers function without enabling the suid bit?

I mounted all my FS with nosuid option and removed the suid/sgid bit from all my files. The question: It looks like I breaked sudo. It doesn't work anymore, no matter what I try to set in ...
2
votes
1answer
239 views

Why is “nodev” in /etc/fstab so important? How can character devices be used for hacking?

I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous. If I have a USB stick with a bash executable that has setuid ...
14
votes
3answers
536 views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
2
votes
2answers
97 views

Chroot user exit jail [duplicate]

I am using OpenSSH chrootdirectory feature to give access to a user via ssh. Can this user exit the jail and return to the normal OS environment? Maybe with su?
0
votes
1answer
119 views

CRON session entries in logs

I'm having this in my RaspberryPi /var/log file Feb 26 21:17:01 raspberrypi CRON[15182]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 26 21:17:01 raspberrypi CRON[15182]: ...
0
votes
2answers
206 views

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
1
vote
1answer
52 views

Different password for login and sudo - security concerns

I'm planning to follow the steps described in this answer to have a different password to log in and sudo. The reason is that I want a high security password to access my account or unblock the ...
1
vote
1answer
71 views

Throttle accounts after failed SSH login attempts

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
2
votes
1answer
99 views

How to set up users, ownership and permissions across local and remote servers?

I've been learning the Linux OS over the last year or so and I am still very confused on how permissions vary from different configurations. I am trying to set up my local development environment and ...
0
votes
2answers
39 views

Protected archive (7z, RAR, Zip) open at a specific time

Are there any compression tools that are unopenable or password-protected until a specific time, at when the security is then lifted? Literally an enforced: "Do not open until --/--/----"
1
vote
3answers
115 views

how to set up permissions of “download” dir to prevent execution of exploit program

There is a host with a local service that receives data from a remote location (via e.g. http) and saves it locally under /var/log/data/ in some mydir. $ ls -al /var/log/data drwxr-sr-x+ 4 root ...
2
votes
1answer
77 views

Is it possible to access any file or dir within a non-accessible directory? [duplicate]

Say I set my home /home/john directory as not readable for any other user. But I've forgotten to do so with some files within that directory, say ./.bashrc or ./Downloads/Presentation.ppt. Now, if ...
31
votes
7answers
6k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
2
votes
1answer
47 views

How to update all Debian packages from source code?

For building packages from source code, there is apt-get source --compile pkg-name. But for it to work, one has to run apt-get build-dep pkg-name beforehand, which downloads binary packages. Is it ...
4
votes
1answer
77 views

How can I test whether Chromium is running inside sandbox

I am using Chromium browser on Debian Wheezy. I read that Chromium is using sandbox to isolate its processes from the rest of the system and thus to increase security. How can I verify that Chromium ...
11
votes
2answers
258 views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
0
votes
0answers
18 views

Returning from a sleep the desktop displays shortly (before entering password), privacy issue

OS: Linux mint 17.1 Cinnamon 64-bit Cinnamon version 2.4.6 Intel Celeron: 900 @ 2.20Ghzx1 Memory 2 Gb Graphics Card: Intel Mobile 4 series integrated When I return to my computer after it has been ...
-1
votes
2answers
183 views

How to prevent the messages about REMOTE HOST IDENTIFICATION HAS CHANGED

Is it possible to prevent the following message about: ( REMOTE HOST IDENTIFICATION HAS CHANGED ) When using only this connection syntax ssh xxx.xxx.xxx.xxx example of warning message: ssh ...
2
votes
1answer
200 views

How to force rpm and yum to fail if a GPG signature is missing or cannot otherwise be verified?

How can I force rpm and yum to fail if a GPG signature is missing from a package or otherwise cannot be verified due to a missing key? For the example below, assume the RPM has been signed but the key ...
1
vote
1answer
269 views

Reason why ssh RSA key would change?

Today I went to connect t my Centos 7 box via ssh and my sftp client and both indicated that the server RSA key finger print had changed. I've checked all my logs for suspicious activity but don't ...
2
votes
2answers
935 views

Ghost Vulnerability On Linux

It came to our notice that glibc needs to be upgraded from 2.2 to the latest version as per the release 5/6/7. My Question is that do I need to reboot the system, because we are having more then ...
1
vote
3answers
327 views

how to record all who that login to my linux machines and records them

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine yum install audit kit installation from: ...
1
vote
1answer
169 views

GUFW or Firestarter in Fedora

Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
1
vote
1answer
97 views

Can I update eglibc to a non-vulnerable version using Debian Squeeze 6 on x86_64 architecture?

I'm currently attempting to update eglibc on Debian Squeeze 6 on x86_64 architecture from version 2.11.3-4, which is vulnerable to the GHOST exploit, to version 2.11.3-4+deb6u4, which isn't vulnerable ...
1
vote
0answers
16 views

Finding out the script causing MySQL failed connections

I see lot of lines in mysql.log Connect Access denied for user 'M'@'localhost' (using password: NO) I am sure I don't have such a user on my system. I need to figure out what script is ...
4
votes
3answers
758 views

Any disk encryption that locks itself for some time after a number of failed attempts?

Is there any way to have your disk/partition/file encrypted (in Linux or as a hardware encryption; no Windows here) in such way that it locks itself for say 10 minutes after say 3 failed unlock ...
12
votes
1answer
6k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
1
vote
1answer
482 views

GHOST: glibc gethostbyname buffer overflow

https://rhn.redhat.com/errata/RHSA-2015-0092.html I can see md5sums of the packages, but cannot download them and my package manager says I'm up-to-date. [root@notebook log]# grep glibc-2 yum.log | ...
11
votes
3answers
754 views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
3
votes
2answers
38 views

How is the visibility of a file-system mount limited?

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
1
vote
1answer
76 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
0
votes
1answer
23 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
6
votes
1answer
254 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
6
votes
2answers
182 views

Run Ubuntu Security Updates every Saturday only

A clients wants to enable automatic security updates on their 12.04 box, but it has to be once per week, on saturday only. (Why I don't know) When I do dpkg-reconfigure -plow unattended-upgrades it's ...
2
votes
1answer
88 views

NIS and /etc/passwd

Shadow passwords are to be avoided in a NIS server, as suggested in this guide at paragraph 7.6. So: in a NIS server (a Unix or Unix-like system), should all the users be migrated to /etc/passwd from ...
22
votes
1answer
1k views

Can another program on X capture my root password while I type it in a virtual terminal?

Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account ...
0
votes
1answer
16 views

How to restrict restrict remopte administration software to one domain name?

I currently have a server hosting a number of website on a debian server. I understand that all my domain names share the same IP so any of them will grant me access through SSH, but i was wondering ...
0
votes
1answer
140 views

How to run unattended-upgrades not daily but every few hours

By default unattended-upgrades runs with cron.daily, that is at most on a daily basis. This can be a lot of time for attackers. I'd like to run it every 4 hours, how can I do this?