Questions tagged [security]
Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.
2,661
questions
0
votes
1
answer
113
views
Difference between passwd and passwd- file as well as shadow and shadow- file
on my server running UnraidOS I got a bit suspicious. There are both 'passwd' and 'passwd-' files (same goes for shadow(-)). These ones should be only backups as I understood.
Running:
root@Unraid-...
- 1
0
votes
1
answer
80
views
Reasons firmware checksums are wrong
What are the possible reasons that running fwupdmgr verify fails?
$ fwupdmgr verify 230c8b18-8d9b-53ec-838b-6cfc0383493a
Reading… [- ]Selected ...
- 1,988
1
vote
1
answer
147
views
Discover which process is asking for sudo?
I have a fairly long-serving Ubuntu 18.04 LTS desktop computer onto which I have installed a great many apt packages from mainstream and non-mainstream repositories as well as numerous random tarballs ...
- 11
1
vote
0
answers
57
views
How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own using SELinux in Android
I am developing an application on Android as a non-root user.
However, I need read access to all the /proc/{pid}/fd files so as to check the inode numbers from the symlink under fd.
How do I do that ...
0
votes
1
answer
69
views
How to react to a psad alert?
I am setting up a Linux home server and several guides recommend using psad to detect intrusion attempts. These guides explain in detail how to set up psad and receive alert emails when port scans are ...
- 145
0
votes
0
answers
43
views
Random rsync running in the background on Debian
I have recently had some lag in my system, when saving a file in vim.
I noticed that an rsync process was running. It was copying the ~/.openshot_qt dir (openshot is not currently installed on my ...
- 493
0
votes
0
answers
381
views
Windows 11 disappeared with my Linux & Windows dual boot
I had a dual boot with Windows 10 in a SSD NVMe M2 and Fedora 36 in a HDD, that I kept choosing the OS by pressing F12 key. I then enabled TPM 2.0 to update the system to Windows 11. After the update ...
- 1
0
votes
0
answers
102
views
Good security practice for remote to local backup using rsync
I would like to perform a manual backup of a remote VPS (Debian 12) to my laptop using rsync. I want to backup the single files and directories to easily inspect them locally, and not e.g. a VM ...
- 1
2
votes
0
answers
122
views
PHP-FPM + Apache2 security
My question is almost identical to Luis Machuca's from 2 years ago (Apache + php-fpm: Proper permissions for per-pool, per-user projects?), but with some additional conditions.
I have also configured ...
- 21
4
votes
3
answers
8k
views
Copy ssh keys to a new computer
I'm changing between computers.
On an old one I have SSH keys (to remote servers, AWS, etc...)
Is it considered to be a good practice just to copy the .ssh folder to a new computer ?
If not, what is a ...
- 163
2
votes
0
answers
535
views
Network Bound Disk Encryption (tang/clevis) Setup
I am trying to have NBDE on Ubunutu LTS 22.04.1 . basically i want my compute-1 node to auto decrypt on boot when it's able to ping controller (tang server) node. the problem is i encrypted every ...
- 335
0
votes
2
answers
336
views
How do I set a password request to connect USB devices?
I need to make it so that when I connect any device to USB, be it a drive, smartphone, printer, etc. The system will ask for a password to authorise this connection, and the device will only connect ...
- 1
0
votes
1
answer
367
views
Is possible compress and uncompress a file with a password but considering an expiration date too?
In Linux about compression files can be accomplished with the tar and zip/unzip commands, perhaps more. I know that is possible establish a password protection for security reasons.
The question is:
...
- 1,738
-1
votes
1
answer
434
views
preventing linux user from chmod 777
With /etc/login.defs having UMASK 007 or UMASK 027 for example will result in created files not having world rwx permissions. But a user can chmod 777 file they own correct? Also for home accounts, ...
- 6,617
0
votes
1
answer
73
views
Is it possible to set 2FA so that it cannot be undone in any way - password for /etc/pam.d/common-auth or total deactivation rescue mode?
I would like to be sure that without knowing the password no one can delete / edit the 2FA credentials etc
can I securely password protect them or are there other ways to achieve such a result?
I ...
- 1
0
votes
0
answers
510
views
Android not use DNS personal! (Spoofing ipv6 DNS possible?)
I have a personal DNS server (use ubound) in my network. I disabled my home wifi router's DNS to use my own and pass my personal router's DNS parameters for ads blocking. All home devices work ...
0
votes
1
answer
322
views
libprocesshider.so installed and added to /etc/ld.so.preload
Today I received an alert from AlibabaCloud that libprocesshider.so is installed on my bastion server. They told me that it is a backdoor rootkit.
I researched for a bit and found out that ...
- 385
0
votes
1
answer
498
views
UFW Block in Syslog - Why are many different IPs trying to connect to my server
first of all I want to clear up that I'm not a network expert and just trying to understand things. I hope I can find help here and get a bit smarter.. I'm hosting a service on a Ubuntu 22.04 vps. ...
- 1
0
votes
0
answers
106
views
How can I list all hosts on my network with the time and/or date that they connected to the network?
Regarding the situational context, long story short, a family member did a dumb thing, and I need to increase the capabilities of my network monitoring system.
Is there a way to create a log of the ...
- 105
1
vote
1
answer
169
views
Restrict key file access to allow keepassxc executable only
I would like to be able to secure a KDBX key file in my $HOME, so that nobody except keepassxc (and root) can access it, excluding even myself.
My only approach is to use the setgid bit on the ...
- 123
0
votes
2
answers
69
views
linux clipboard update appears to persist reboot
I was horrified to reboot Debian Buster after a recent update to find that there is a log of previous copy-and-pastes, including passwords. Isn't that kind of thing supposed to live only in the RAM?
A ...
- 550
0
votes
1
answer
91
views
Possible security risk by sudo on bash exit
I recently read about using bash's built-in trap command to execute a command when bash exits, for example trap "notify-send test" EXIT would send a desktop notification as soon as bash ...
- 1
0
votes
0
answers
403
views
What is the best way to make LDAP based TOTP only required in some cases?
I have a 2FA setup on my network for certain kinds of authentication, but not others. The way it currently works is a combination of pam_ldap for passwords, and pam_oath for TOTP. PAM is configured in ...
- 5,454
2
votes
2
answers
3k
views
Apache2 not starting: AH00526: Syntax error on line 43 of /etc/modsecurity/rules/REQUEST-922-MULTIPART-ATTACK.conf
I am trying to secure my Apache2 installation on my Ubuntu 22.04 server, using OWASP rules with ModSecurity, but when I installed the v3.3.4 rules and activated modsecurity, Apache2 won't start.
...
- 143
-1
votes
2
answers
205
views
How does using sudo instead of su improve the security level?
Edit::
With the help of people, I realised I misunderstood the text and thought the creators Ubuntu also created sudo, which is not the case! So the question should be something like how forcing ...
- 143
1
vote
1
answer
59
views
Can I limit a user to only be able to upload a file to a single directory via scp?
I would like to create a ci user on a device to allow for a pipeline to drop a file into a single directory only.
I have created a user using:
useradd -M -N -r -s /bin/false devops
chown -R devops /...
- 151
0
votes
0
answers
361
views
SSH fingerprints not matching
host_a is macOS
host_b is Ubuntu
host_b is in known_hosts on host_a
host_a is not in known_hosts on host_b
I've changed the fingerprints and trimmed some output for brevity but otherwise this is ...
- 101
0
votes
1
answer
84
views
How can I prevent normal users from being able to look up other logged-in users?
For security and privacy reasons, I want to stop logging logins, as well as hiding information about currently logged-in users.
So far, I tried revoking reading permissions to utmp and wtmp:
sudo ...
- 15
0
votes
1
answer
314
views
"Other users are logged in" how does the system know? Where is the information leaking?
(Example screenshot taken from https://askubuntu.com/questions/1343872/ubuntu-shows-other-users-are-logged-in-whenever-i-shut-down-even-though-i-am-the)
But my question is: how does the system know ...
- 15
-3
votes
1
answer
58
views
ubuntu: questions about security
I am using multi-core server equipped with Ubuntu 20.04 OSX. I have some questions about security and the overall access to the machine.
Assuming that I am only one Administrator on the workstation, ...
- 137
1
vote
3
answers
523
views
Prevent Linux from using an IP address on the wrong interface
Computer A has two physical interfaces:
eno0 ⇨ 192.168.1.1/24
eno1 ⇨ 192.168.2.1/24
Computer B has only one physical interface:
eno0 ⇨ 192.168.2.2/16 (note the abnormally small subnet mask--we'll ...
- 785
8
votes
2
answers
2k
views
What is the purpose and benefit of a Security Profile in Almalinux setup screen?
On AlmaLinux during setup there is an option to choose a Security Profile. I run live and public websites on this server, so security is good, but I don't know what these are and how it could benefit ...
- 207
0
votes
0
answers
24
views
Sourcing variables from a script file without executing code from that file [duplicate]
There are cases where a (Bash) script will need to import shell variables from another (untrusted?) script file.
For example:
#!/usr/bin/env bash
. /etc/lsb-release
#
#... make use of the contents of ...
- 610
0
votes
0
answers
50
views
What "older versions of sh" that source in $ENV even for non-interactive shells are there?
In FreeBSD 13.1's man sh, in the "Invocation" section, it mentions:
Unlike older versions of sh the ENV script is only sourced on invocation of interactive shells. This closes a well-known,...
- 277
0
votes
0
answers
23
views
List of files that should ne be allowed to be served by apache
My Apache web server should never serve a directory named ".git" or a file named "*.sqlite", or "config.php". It's so much probably a mistake that the potential false ...
- 175
0
votes
0
answers
935
views
Is it secure to inject a password from a batch script variable in Windows to a SSH command run on Linux?
We are thinking of using a batch file as shown below for our software deployment.
While we don't need high security we are still wondering if there are obvious security issues with this approach.
@...
- 143
5
votes
2
answers
386
views
How to limit which characters are allowed in filenames?
Following up on Fixing Unix/Linux/POSIX Filenames: Control Characters (such as Newline), Leading Dashes, and Other Problems*, is there some way to forbid the creation of files with problematic names ...
- 51.5k
-3
votes
1
answer
194
views
How to setting Ubuntu sudo password dialog for every 1 hours [duplicate]
i work on my personal Desktop that no one touch it.
so, i mean, duration password needs to be entered again after entering corect pasword.
how to do that? thx
0
votes
0
answers
34
views
Which Linux security mechanisms tied to file path and underlying block device
Among the in-tree Linux security modules, AKARI, any out-of-tree LSMs, and other existing kernel-based solutions, does there exist a way to protect files on the basis of their paths AND their ...
- 4,048
0
votes
1
answer
236
views
How do I trigger a delayed shutdown after screen lock?
I'm a beginner Linux user, running Pop!_OS.
Pop!_OS is based on Ubuntu, but uses SystemD and Gnome. I have no idea if that's going to be relevant, but figured it wouldn't hurt to mention.
Here is what ...
user555062
0
votes
0
answers
29
views
How can I isolate my firewall rules in a chain such that I can reset them separately?
I've been running some iptables rules for a while, which are (I hope) fine, no issues so far. Here's a snippet of that
# Block all input and forward traffic, both IPv4 and IPv6
iptables -P INPUT DROP
...
1
vote
1
answer
421
views
How to limit the concurrent GUI login, but allow multiple SSH login?
On an Ubuntu desktop, contains several accounts, I want to limit the GUI login number.
At anytime, there should be only one account can login by using local GUI. (The first account must logout before ...
- 11
0
votes
1
answer
216
views
change the kernel version OS [closed]
It is possible to modify the linux kernel,
I have tried to search but I can't find anything related in the source code
I want to modify this line GNU/Linux
I have noticed that there are kernels with ...
0
votes
0
answers
226
views
Place to keep a list of trusted external IP addresses on a system?
What I have
Many services on my system trust the same list of IP addresses.
For example, I mention/use/refer to:
192.0.2.43,
198.51.100.2 and
203.0.113.76
when configuring:
iptables,
fail2ban,
...
- 700
1
vote
0
answers
322
views
debsecan reports vulnerable packages despite installed fixes
I have an up-to-date debian stable (bullseye) install, complete with debian-security:
$ cat /etc/apt/sources.list
deb http://deb.debian.org/debian/ bullseye main contrib non-free
...
- 13.7k
3
votes
1
answer
631
views
How do I enable unprivileged_userns_clone selectively for one executable or user?
How do I enable CLONE_NEWUSER in a more fine-grained fashion compared to just kernel.unprivileged_userns_clone?
I want to keep kernel API attack surface manageable by keeping new and complicated ...
- 5,688
0
votes
1
answer
108
views
How can I assign two contexts to a folder/file to give permissions to two processes (snapper and samba)?
I like to take snapshots of a Btrfs subvolume (mysubvol, using snapper) and share the .snapshots directory using samba. I can either assign the samba_share_t context to .snapshots and will then be ...
- 102
1
vote
0
answers
43
views
/usr mysteriously changed owner
Somehow my /usr directory had its ownership changed from root:root to <my username>:<my username>. I noticed this when I tried to use sudo, and got an error messaging saying it had to be ...
- 121
0
votes
1
answer
141
views
Setting file contexts on /proc files
I want to restrict access to files in /proc as much as possible using SELinux. When I try to chcon a directory in /proc, it fails:
$ chcon -t staff_proc_t /proc/acpi
chcon: failed to change context of ...
- 1,071
2
votes
3
answers
407
views
rkhunter warnings: SSH protocol v1 + SSH root access allowed, fix?
How can I solve the following rkhunter warnings?:
Checking if SSH root access is allowed [ Warning ]
Checking if SSH protocol v1 is allowed [ Warning ]
and what do ...
- 27