Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

10
votes
2answers
11k views

How do I get sudo -u $user to use the users env?

It seems when sudoing down that using sudo -u $user that the environment of root is still being used. How can I make sudo use the users environment? as a special note not all users that I will be ...
10
votes
2answers
3k views

Should you run automatic updates

I'm running production Centos web servers. I want to know what is best practice for running updates. Should I automate this with yum-cron or yum-updatesd? Or is there a danger of updates breaking ...
10
votes
2answers
263 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
10
votes
2answers
8k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
10
votes
2answers
2k views

How do I hide/anonymise/defend a computer when on hostile networks?

I connect to a lot of open networks when I'm pootling around. I'm fairly careful to VPN home for anything important but that's not really my boggle. The laptop runs several services (nfs, dev http ...
10
votes
3answers
6k views

How to make a folder private?

I'm using Ubuntu with several users and I want to make folders viewable just for a specific user. Any idea how to do it?
10
votes
2answers
3k views

Automatic security updates on Debian squeeze server

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
10
votes
4answers
764 views

Good practice to use same SSH keypair on multiple machines?

I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...
10
votes
2answers
6k views

Use wpa_supplicant without plain text passwords

I'm running gentoo on my laptop, and I'm currently using wpa_supplicant to handle wifi. My configuration works and I can connect, but it is required to type in the plain text password into the ...
10
votes
1answer
2k views

D-Bus authentication and authorization

I'm trying to set up remote access to D-Bus, and I don't understand how authentication and authorization are (not) working. I have a D-Bus server listening on an abstract socket. $ echo ...
10
votes
2answers
11k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
10
votes
1answer
667 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
10
votes
2answers
749 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
9
votes
3answers
2k views

Is it a good practice to run a daemon under a non-root user account?

I've developed an application that uses NTP to change the network time, to sync two of my computers. It runs as root, since only the latter is allowed to change the time and date on Linux(I guess). ...
9
votes
9answers
2k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
9
votes
3answers
476 views

Physically break into box? (Memory & disk)

I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it ...
9
votes
3answers
3k views

Is it safe to close shell just by clicking “X” or using “ctrl+d”?

Is it safe to close shell just by clicking "X" or using "ctrl+d" while logged in as root with su or is it safer to close it by typing "exit"? Is there any difference (security-wise) at all or is it ...
9
votes
1answer
3k views

How to stop users from Switching to Root user

I have disabled the root user login from Sshd.conf file so now no one can login using root user even if they know the password SOMEHOW. Now I have 3 users in server ROOT,EMERG and ORACLE. I want to ...
9
votes
1answer
279 views

Why does the location of Enviroment Variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run ...
9
votes
1answer
184 views

Does ssh-agent store my passphrase?

Is it possible to determine the passphrases of private keys added to ssh-agent? I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
9
votes
3answers
3k views

How can I set that only root + a given user can shut down my pc?

If I'm using Ubuntu 11.04, how can I configure it such that that only two users can shut down/suspend/hibernate my PC: the root user and one regular user?
9
votes
1answer
282 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
9
votes
2answers
7k views

How to check, which limit was exceeded? (Process terminated because of ulimit. )

Let's assume process runs in ulimited environment : ( ulimit ... -v ... -t ... -x 0 ... ./program ) Program is terminated. There might be many reasons : memory/time/file limit exceeded ; just ...
9
votes
4answers
12k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
9
votes
5answers
2k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
9
votes
1answer
969 views

Log every invocation of every SUID program?

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
9
votes
1answer
1k views

How can I limit ssh *remote* port forwarding?

I need to limit which ports can be remotely 'ssh -R' forwarded by an user. I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding ...
9
votes
1answer
534 views

Is locking the screen safe?

See USB driver bug exposed as "Linux plug&pwn", or this link Two choices [GNOME, Fedora 14]: Use the gnome-screensaver Use the "switch user" function [gnome menu -> log out -> switch user] ...
9
votes
0answers
4k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
8
votes
4answers
4k views

Are there any GUI's for Linux that doesn't use X11?

Are there any GUI's for Linux that doesn't use X11? Since X has very poor security :O e.g.: Ubuntu, Fedora - what else are there? Goal: having a Desktop Environment without X. - what are the ...
8
votes
3answers
425 views

Trap: can't su as root, can't change group to wheel, ssh as root prohibited

Is this a trap? I made these steps in FreeBSD 10: 1) ssh as root prohibited 2) logged as user 3) su as root 4) as root chsh changed name of user "user" to "luser" 5) exit from ...
8
votes
3answers
808 views

Why is konsole reading /etc/passwd?

In relation to this question: While observing the behavior of fatrace, I notice something which concerns me. Here are the first few lines of output of the command "fatrace|grep konsole" ...
8
votes
9answers
17k views

How do I write a test for system login?

I've written a Python CGI script that invokes bash commands, and it needs to test for a successful login on the host. How do I write a test for that? For example, could I create a bash script that ...
8
votes
4answers
3k views

How to best encrypt and decrypt a directory via the command line or script?

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line. Ideally, ...
8
votes
4answers
5k views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
8
votes
2answers
191 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
8
votes
1answer
8k views

Is there a way to deactivate Buffer overflow protection on my machine?

I want to do some experiments with buffer overflows on my various virtual machines, including (but not limited to) Debian 6, Ubuntu 12.04, Fedora 16, but every time I try to execute the buffer ...
8
votes
2answers
1k views

What encryption does vim -x use?

I read man vim, :h -x and :h encryption none of this actually says what algorithm it's encrypted with.
8
votes
2answers
9k views

how to know the type of symmetric encryption used by ssh?

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?. I have looked in ...
8
votes
5answers
1k views

how do I wipe a server that I don't have physical access to?

I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
8
votes
2answers
1k views

I/O-overhead of dm-encrypted device?

What would be the Read-/Write-overhead when using dm-crypt (LUKS) as full disk-encryption (including root partition) on a Linux-Desktop (Ubuntu)? I plan to stack it like so: LUKS > LVM > ext4 The CPU ...
8
votes
2answers
9k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
8
votes
2answers
574 views

How can I create a hard to kill process

I want to create a program that will be difficult to stop (even for the administrator) once it is started (with root privileges). Once started the process should continue to start itself at startup ...
8
votes
3answers
7k views

Why is PATH reset in a sudo command? [duplicate]

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH ...
8
votes
2answers
319 views

What is most secure and simplest way to have a user-typed password on bash become part of stdin to a program?

I'm looking for the (1) most secure and (2) simplest way to have a user type a password on a bash shell prompt and to have that password become part of stdin to a program. This is what the stdin ...
8
votes
2answers
2k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
8
votes
2answers
164 views

Signing/Checksumming the kernel to prevent/detect manipulation

All my partitions are encrypted (/ and /home), but the /boot partition has to remain unencrypted and is open for manipulation. I was thinking about hashing the kernel on bootup and checking the result ...
8
votes
1answer
384 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
8
votes
1answer
2k views

GNOME-keyring KWallet integration?

I use some GNOME apps, and some KDE apps, so some of them use G-keyring and some KWallet... What I would like to have is a single place for managing passwords. Is there a way to integrate G-keyring ...
8
votes
1answer
4k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...