Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
1answer
30 views

wget TLSv1 behaves the same as TLSv1_2

I used wireshark to compare curl --tlsv1.0 vs --tlsv1.2 The server handshake obediently uses TLSv1.0 for servers that support it (the point is to check to validate they don't): wget url --no-check-...
1
vote
0answers
39 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
1
vote
1answer
125 views

Restrict login via user group in access.conf

I have been working on getting /etc/security/access.conf to work as expected and so far every user can still login. Details are below. I added the following line to /etc/pam.d/login account ...
1
vote
1answer
39 views

Install ModSecurity Commercial Rules

We bought the ModSecurity commercial rules, but I am not having success installing them. I tried using the ModSecurity dashboard, but it seems that it is not working. Even though I get a message ...
1
vote
1answer
59 views

Is Evince a secure way to view malicious PDF?

I've seen that PDF's can contain malicious Javascript that operates in the background and can do bad things. This is primarily a problem for Adobe Acrobat. However, is this problem also for Evince? I ...
1
vote
1answer
84 views

Is there a way to resolve ALL PIA VPN IPs with a script?

I am looking for a way to get a complete list of all the current IP addresses for PrivateInternetAccess' servers. I need the complete list so that I can manually enter them into a killswitch for ...
3
votes
1answer
85 views

Brute force attack on vsftp server not showing failed authentication in log

My server is running Debian 8 with vsftpd version 3.0.2-17. Recently my vsftpd.log filled up with the following: vsftpd.log Mon Mar 7 18:13:44 2016 [pid 13499] CONNECT: Client "::ffff:xxx.xxx.xx.xx"...
0
votes
6answers
333 views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
0
votes
0answers
19 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
5
votes
2answers
77 views

Why is it safer to give sudo rights to a non root user?

I have recently installed Amazon Linux on EC2 to run NodeJS applications. It is recommended to run them as a non root user. This user will still be me so there is no concern that someone else will ...
4
votes
3answers
185 views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
0
votes
3answers
56 views

Why does reading a device require admin permissions?

I'm trying to create a backup script that saves my thumbdrive as an image. I'm planning on having it automatic. I've always seen the thumbdrive listed as /dev/sdb, and created a script that will save ...
2
votes
2answers
199 views

Avoiding plain-text password in http_proxy

I am behind a corporate firewall, which brings lots of pains in the area of proxies. There are two main approaches I've found to work: Use Cntlm at the cost of not being able to connect (from the ...
2
votes
2answers
61 views

Would draining entropy make it easier to compromise a system? [duplicate]

Entropy is important for many security features like TCP sequence numbers and cryptographic key/parameter generation. My understanding is that the entropy pool is drained by an operation as simple as ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
0
votes
0answers
77 views

Does the following error indicate my system is compromised?

[FAILED] Failed to Verify Integrity of password and group files. See 'systemctl status shadow.service' for details. I get this message in T1 every time I start up the computer but I havn't noticed ...
1
vote
2answers
31 views

Are there sandboxing concepts for proprietary binary kernel modules in linux?

Quite a lot has been going on to advance inter-process security (UID the same) and priveledge dropping in userland, yet it is common that proprietary linux kernel components are used (it seems that ...
1
vote
0answers
137 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
1answer
96 views

Set sudo umask apart from the user calling it

The problem: I set my umask for my user to be 0077. Now I use sudo instead of su when I need super-user access, and the problem is that whenever I execute a software installation using sudo with ...
0
votes
0answers
9 views

How to permanently set a password for ipaserver client accounts

I want to setup a password for RHEL/Centos ipaserver client accounts but it seems I have to keep manually resting it on the ipaserver host. Is there a way to persistently set it?
1
vote
1answer
79 views

How to write a file a file via ssh

I want to write a file in the Machine B under /home/test whose permissions are root:root and rwxr-xr-x. I have an account on the Machine B, named testUser. When logged to the Machine B with ...
1
vote
2answers
33 views

Whats the difference between adding scripts in the /etc/cron.daily/ or editing in your script in crontab(-e)?

There are multiple options - with cron - to start your script at a specific time, but, is one more secure over the other? My question is simple: Whats the difference between adding scripts in ...
3
votes
2answers
63 views

Why are privs required to setgid() to supplementary groups

The various set*gid() system calls require privileges to change groups except in a very few cases. Changing primary group to one of the processes' supplementary groups does not appear to be one of ...
0
votes
3answers
110 views

How to stop a user from seeing command line arguments?

We have a CI server application run as the build user. Any command with arguments run by the CI server is visible via ps. Although non-admin users do not have access to load a shell on the CI server, ...
3
votes
1answer
180 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
-2
votes
1answer
63 views

how to fix potentially infected binary files? [closed]

when I installed the updates on my computer (Ubuntu 14.04), I typed the password, thinking that it was asked for regular updating , but when I noticed some strange behavior and crash at this moment, I ...
1
vote
0answers
41 views

BeEf Famework Kali-2 configuration

I am running Kali-2(rolling 1 latest) in Vmware workstation 12. I have forwarded my ports and am using NAT. The beef framework links only seem to work within the local network. Any specific reason? ...
0
votes
1answer
55 views

pam_mount changes owner of mountpoint to root

On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image ...
8
votes
1answer
311 views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
2
votes
4answers
72 views

security issues from installing from source code as root

I had a question arise about how installing from source code in the root account is not a good idea because of security reasons. My stance on it is that it does not really matter if someone is in ...
1
vote
2answers
723 views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
2
votes
1answer
61 views

Information leaks out of encrypted file system

If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems like swap space files in /tmp ...
0
votes
1answer
39 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
1
vote
0answers
28 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
0
votes
0answers
47 views

How to set usb stick's ntfs filesystem's attribute to readonly in linux

I know how to set readonly attribute to ntfs filesystem of a usb device by using diskpart tool in windows. attributes disk set readonly but how to set readonly attribute to the same usb device ...
4
votes
1answer
40 views

LXC: Are downloaded templates verified?

Debian 8.3, LXC 1:1.0.6-6+deb8u2 When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the ...
1
vote
1answer
36 views

Creating Encrypted Tunnel Between 2 Lans

I have 2 LANs and one of them is connected to the internet and I need to connect them together. Normally, a single cat6 cable is enough for connection however, this cable is going through a public ...
31
votes
4answers
2k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
1
vote
1answer
70 views

Linux TOTP vs SSH Keys

I am in the middle of a security upgrade task and have been reading a lot of articles around SSH security. I have a question around what is the better method of securing SSH by using SSH Keys or TOTP? ...
4
votes
2answers
98 views

Debian Lenny Server Compromised - No Sign Of Intrusion Point?

I have a server, it's outdated running Debian Lenny, and yes I know that is probably half the problem. It also has PHPMyAdmin and ProFTPd. Again, I get it, all bad signs. But for the life of me, I ...
2
votes
0answers
48 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (...
1
vote
1answer
121 views

fail2ban ip blocked, yet still login attempts

everything seems ok, iptables shows its blocked, yet I still get auth attempts I have configured fail2ban # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1/8 bantime ...
0
votes
2answers
70 views

Need the sshd server be run in root privilege for a password-less login? [closed]

I mean: if the sshd is't being run in root account, then how can it let the remote ssh client run shell or other command in root account ? if sshd call the login command, then the user could login ...
4
votes
1answer
120 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
3
votes
4answers
259 views

Why does mknod require root privileges?

I noticed that the mknod command required root privileges when a creating a node other than a regular file, FIFO or a Unix socket. Why is that? How can a regular user harm a system or compromise ...
4
votes
1answer
119 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
3
votes
1answer
38 views

What are the drawbacks of using policy_any in openssl.cnf?

As given in this document, we may use policy_any to ignore most of the fields of subject in certificate request. There must be some drawbacks of ignoring such fields, would it may lead to some ...
0
votes
3answers
51 views

What additional privileges does the root user have over a standard user? [closed]

What additional privileges does the root user have over a standard user in Linux?
0
votes
1answer
30 views

Is sudo useful to protect my data from malwares?

I'm considering creating a separate account for browsing, and launching my browser with sudo -u browseraccount {firefox,chromium,etc}. I wonder if this can prevent a malware (especially ransomwares) ...
1
vote
2answers
107 views

Is it evil to link to a crontab?

I think about doing something like: sudo ln -s ~/myCustomCrontab /var/spool/cron/crontabs/username because I'd like to have all customized files in my home directory. Possible risks I can think of ...