Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
2answers
53 views

Security risks of opening FTP

I have a client that wants FTP access to a certain file on one of my servers. The server runs CentOS 7. Root login is disabled. Password login is disabled (requires ssh key to login). SSH is on a ...
7
votes
2answers
83 views

How to completely remove the user subsystem from Linux?

Is it possible to completely remove the user subsystem from Linux. I'm NOT talking about preventing people from logging in. I'm talking about removing the parts of the system that even make it ...
-1
votes
1answer
39 views

How do I configure my server to stay hidden unless it receives correct password?

The server is supposed to silently ignore any requests (including ping) unless it receives correct credentials with initial request. Nobody else can tell that the host even exists. I am talking about ...
0
votes
1answer
84 views

Place tripwire's config files, keys and database on ext. media?

(Originally posted on SE's SuperUser. Wrong platform and I removed post from SU.) I configured Tripwire(TM) 2.4.2.2.2 on a Lx box (Ubuntu trusty), using default folder and file locations. I relied on ...
8
votes
2answers
223 views

What is most secure and simplest way to have a user-typed password on bash become part of stdin to a program?

I'm looking for the (1) most secure and (2) simplest way to have a user type a password on a bash shell prompt and to have that password become part of stdin to a program. This is what the stdin ...
0
votes
1answer
69 views

Write data/bytes in a file, out of content and metadata?

Using Unix & Linux FS, I aim to write data like: 10011010 11101001 01011011 10110110 01100011 01111110 00010001 11100101 10011101 01110000 11111110 11111111 10000001 10011100 11011100 10011111 ...
2
votes
1answer
115 views

How can I tell if someone has connected to my machine remotely?

One thing I have found very disappointing in computing is the lack of notification when someone connects to your computer. I do a lot of remote work and when I connect to anothers machine they get no ...
2
votes
1answer
72 views

Wine and Linux Security

I'm trying to understand what are the security implications/consequences of installing Wine. Does installing wine means that my Linux OS will be prone to "Windows" type of viruses and malware as well? ...
1
vote
2answers
65 views

Is it safe to run these instructions as a root user?

I have CentOS and I want install scala by: Installing scala on CentOS. I want to ask if it's safe installing this as root user? The commands are: wget ...
1
vote
1answer
27 views

Permissions and user for yum download

When I run yum install X, where X can be tomcat or any other package, whats the user and the permission on the packages it downloads ?
0
votes
1answer
27 views

Permission check on profile file in home directory: should it be done?

Say I'm implementing a programming language which has an interactive mode, and that interactive mode reads some ~/.foo_rc file in the user's home directory. The file contains code in that language ...
0
votes
1answer
164 views

Breaking out of a docker container

Are there any security risks with allowing users to run docker and mount files he has access to? We have shared network mount where all users home directories reside and we basically don't want ...
0
votes
0answers
30 views

SSL/Secure MySQL access with Postfix/Dovecot Mail Server

I have two MySQL servers setup, one in each data center in the US. The east coast db is the master and replicates to the west coast slave db over SSL. When I try to connect my mail server to the ...
6
votes
1answer
51 views

Can someone give an example as to why I'd want to induce a kernel panic using auditd?

We recently implemented some auditd rules in response to an external security audit. My colleague offered some input on them and suggested adding -f 2 to /etc/audit.rules. I can't think of an instance ...
13
votes
5answers
795 views

How to tell if console login is genuine?

On Windows one can enforce pressing Ctrl+Alt+Del to fire an interrupt that brings up the login window. When logging onto a console of a Linux computer: How can I tell if this login is a real one or a ...
2
votes
2answers
64 views

Is there any standard on the permissions for system directories?

The /root directory on CentOS 6 has permissions 0550 but on Debian 7 it is 0700. The Filesystem Hierarchy Standard (FHS) tells about directory organization but remains silent about permissions. Do ...
2
votes
2answers
79 views

Does it make sense to use SELinux inside a chroot jail?

Does it make sense to use SELinux inside a chroot jail? I am thinking that since in the chroot jail there should only be the bare minimum, not much else could be compromised. Is there still a benefit ...
1
vote
2answers
23 views

Pureftpd as user,is possible?

I want to run pure-ftpd in chroot as user,not as root,i've set server to non privileged port 5050,but i don't know how to run as user instead of root,someone know the option?
2
votes
2answers
100 views

What are the strengths and weaknesses of the ssh-keygen algorithms and is one of them the most secure?

I was wondering about the different types of keys you can create with ssh-keygen -t (dsa | ecdsa | ed25519 | rsa | rsa1). Since different types are offered I assume that each has a specific advantage ...
1
vote
2answers
108 views

MySQLdump via crontab - Pass --password=/hashed/password/file so I can use via crontab w/o using plain text password

So I'm setting up a WordPress backup guide/making a backup schedule for myself for real. I want to do MySQL dumps daily, but the command either requires -p then user input or ...
4
votes
2answers
440 views

How to check a Linux Distro is secure and has no malicious code? [closed]

I am new to Linux and I love it. However, while I have been playing around with several flavours of Linux, only one question comes into my mind as a new user to the Linux systems: how can I ensure a ...
6
votes
6answers
335 views

Allow regular users to SSH using a private key they cannot read

Let's say I have a set of machines (called here the customers' machines) that only a small list of people (called the support staff) is allowed to SSH into, using only one account by machine (the ...
1
vote
2answers
24 views

How to assure that NIS home directories are private?

I am wondering what options are for using centralized authentication and access to user home directories from any Linux machine while keeping the privacy of the home directories. Now I am facing a ...
1
vote
1answer
77 views

OSX: Delete all matching certificates by command-line

Using shell script to delete all matching certificates. I found a list of certificates using: security find-certificate -c "certificatename" -a -Z|grep SHA-1|awk '{ print $NF }' Output is like ...
2
votes
0answers
29 views

Is information security less hard in an open source system? [closed]

In the excellent article Why Information Security is Hard - An Economic Perspective, Ross Anderson poses that: ... you can make the security critical part of the system small enough that the bugs ...
1
vote
2answers
50 views

Security of zone transfers for bind

When having two public DNS servers that provide NS, A, MX, and CNAME records for your domain (website), is it necessary to encrypt the zone transfer data or is it fine to have the master-to-slave sent ...
0
votes
1answer
28 views

Is it safe to run GPG tools in x11?

Given the relative (anyone with my present user permissions can swipe scancodes) ease of keylogging in an x11 environment, should I run GPG tools only in the TTY?
2
votes
0answers
32 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
3answers
194 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
2
votes
0answers
40 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
1
vote
0answers
91 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
4
votes
1answer
64 views

Is it possible to add a password to moving or copying specific files on Linux?

I have a directory setup very nicely(i.e organized with READMEs and easy navigation etc.). I would like people to be able to access the files in this directory maybe even copy them to their own ...
2
votes
1answer
38 views

Wipe a Solaris Disk

Looking for something similar to Eraser for Solaris 9-10-11 Anything?
2
votes
1answer
173 views

How to use network interface as non-root user on Android? [closed]

I want to communicate between my Android device and my Linux box over IP through the USB network interface mode. I have connected my Android device to my Linux box with and put the Android device ...
0
votes
0answers
19 views

Error while building libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] ...
1
vote
0answers
43 views

What are some basic indicators that your unit (Unix/Linux system) is hacked? What are specific, basic, preventive measures that need to be made? [closed]

This question is separated for three separate systems (Unix/Linux, Windows, Mac/Apple). A link will be posted to redirect here for other systems if this question/post is deemed valid or ...
1
vote
0answers
33 views

Libgcrypt warning: MD5 used - FIPS mode inactivated

Last week I enabled the openSSH FIPS 140-2 module on Server "A", and that system works flawlessly (including tsql queries to a SQL Server instance). I recently enabled the openSSH FIPS 140-2 module ...
2
votes
1answer
67 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
2
votes
0answers
100 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
2
votes
1answer
66 views

Restrict user script execution

I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players. A player write a bot in Python Upon validation, the code is sent to the server A ...
1
vote
1answer
83 views

How can I lock my screen automatically if internet connection is lost?

I will sometimes remote into my work computer from home using TeamViewer. Obviously I have to unlock the screensaver to use the GUI. When I'm done, I'll lock the screen either from the desktop or via ...
3
votes
1answer
104 views

Same salt/hash value in /etc/shadow

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password). How could the system end up like this? Does this mean the password was not ...
1
vote
2answers
33 views

User verification

Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that ...
-2
votes
1answer
73 views

Bash Code Injection Vulnerability On Linux

Found a new bug in Linux System, a bash code injection vulnerability. The solution to this is the update the bash package. yum update bash My Question is "do I need to reboot the system"? ...
2
votes
0answers
30 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
2
votes
2answers
38 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
3
votes
2answers
120 views

How to defend against a Live USB computer hack

A Linux installation can be simply hacked by using a live USB/CD, gaining root access on the live distro, chrooting to the target filesystem and running passwd root. One can use grub too. There may be ...
-1
votes
2answers
59 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
201 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...
2
votes
0answers
25 views

how to prevent procmail listening to the world [closed]

This is part of a larger effort to try and ensure my server is not infected and spamming the internet with spam emails I had a friend take a look at the server and he said "Your procmail is open to ...