Content related to computer security.
5
votes
5answers
319 views
how do I wipe a server that I don't have physical access to?
I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
5
votes
1answer
59 views
Does fail2ban offer any additional protection to SSH if password login is already turned off?
I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions.
The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
5
votes
3answers
181 views
Are sudo and gksudo safe?
I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes).
Now let's ...
5
votes
2answers
212 views
How to disable login for an user?
My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be ...
5
votes
1answer
212 views
Automated ssh login with passphrase?
Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine ...
5
votes
2answers
772 views
Automatic security updates on Debian squeeze server
For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
5
votes
1answer
153 views
How can I find a Ubuntu package to use with Amazon EC2?
I'm looking to set up a new server on Amazon's EC2 and I wanted to use Ubuntu 11.04 is it is fairly new but not too new. I previously used 10.10 which I think is also very stable and time-tested.
My ...
5
votes
1answer
323 views
Opening port 80 but remain secure
I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
5
votes
1answer
2k views
What is hvc0? (appearing in “who” list)
I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
5
votes
2answers
185 views
Lock some accounts during some time periods
Is it possible to lock some accounts in order to be accessible only during specific time periods?
For instance the account joe should only be accessible during office hours.
5
votes
3answers
403 views
Why does time/ident/daytime/comsat run after an OpenBSD 5.2 install?
I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd".
After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output:
Why does so ...
5
votes
1answer
745 views
Lock screen w/ slock after a certain time?
I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)?
Thanks!
5
votes
1answer
1k views
GNOME-keyring KWallet integration?
I use some GNOME apps, and some KDE apps, so some of them use G-keyring and some KWallet... What I would like to have is a single place for managing passwords.
Is there a way to integrate G-keyring ...
5
votes
1answer
174 views
Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?
I've been looking for this for quite a while now but couldn't find a satisfying answer.
My scenario:
I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
5
votes
5answers
421 views
Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)
Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run.
I remember seeing a command ...
5
votes
2answers
969 views
Can KWallet manage my ssh passwords?
I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill ...
5
votes
2answers
1k views
Hide processes from other users based on groups (under Linux)?
Is it possible to configure process hiding for certain user groups under a linux system?
For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc.
...
4
votes
4answers
729 views
How sudo/root-ness detection works
Programs that make changes system-wide require sudo unless I am already the root user.
Now, the question is: how exactly does the system figure out that I am (not) root?
Does it:
Check to see if ...
4
votes
2answers
167 views
What does “Do you expect to run the X Windows System?” do when installing OpenBSD?
When installing OpenBSD 5.1, I got the question:
Do you expect to run the X Windows System?
What change does the installer make to my system if I say "yes"? I know what X Windows is, but I don't ...
4
votes
2answers
3k views
How do I disable remote root login via ssh?
How do i disable remote root login via ssh?
I want to log into my server (i use keys on my main comp) then su into root instead of access root directly.
I am using debian. I follow guides online ...
4
votes
2answers
1k views
How do you protect a plain text credentials file with the username and password?
I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass.
[not recommended] put the ...
4
votes
5answers
151 views
Hiding work in account with multiple users
I'm currently working on an assignment in a cluster programming class. The class has been given an account on the cluster, so we can ssh in and do our work. The problem is that the one account is ...
4
votes
2answers
125 views
Purpose of using setuid() in SUID programs
I wonder that an SUID program like passwd why using setuid function call, why he drop root privilege?
What types of attack is against(buffer-overflow)?
thanks for the answers
4
votes
1answer
175 views
root owned program with setuid bit on
Ping is a a program owned by root with the user id bit set.
$ ls -l `which ping`
-rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping
As I understand it, if a user runs the ping process, then the ...
4
votes
4answers
247 views
SSH to untrusted machine
If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
4
votes
3answers
176 views
I'm moving up from managed hosting to a VPS, what do I need to know?
I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux before and I'm not ...
4
votes
3answers
774 views
How to clear terminal after logging out?
Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?
4
votes
1answer
214 views
What's the best way to configure shared filesystem directories? (beyond standard unix perms)
I have multiple users on my system. I'd like to have shared directories like music, video. pictures etc. The problems is that I want users to be able to write any new files to any directory, but not ...
4
votes
3answers
298 views
Something like pwgen-win for linux?
Is there some kind of pwd generator for Linux that has a nice GUI and options like this one for Windows? I know that there is pwgen, but as far as I know it does not support mouse/keyboard entropy and ...
4
votes
8answers
5k views
Is it possible to test user name and password?
I've written a python CGI script that invoke bash commands, and it needs to test for a successful login on the host.
Is it possible to create a bash script that will test a given username and ...
4
votes
2answers
424 views
Why is 8 numbers considered a “strong” password?
Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word.
It's 10 vs 26 per digit after all. (52 counting CaSe ...
4
votes
3answers
137 views
Can someone execute a malware by just inserting a flash disk?
I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
4
votes
2answers
245 views
what is OS hardening in linux or unix?
The term OS hardening itself is misleading/vague to me as i am reading to understand it online here.
It seems to me that its something related to making linux/unix box more secure.
4
votes
3answers
258 views
Is it impossible to run as `root` if the machine isn't rooted?
By default, the user of the device does not have access to certain root objects (e.g. the /data directory). Even though these objects are off-limits, however, it would seem to me that these objects ...
4
votes
3answers
100 views
Is a command's stdout to the terminal being logged?
I am interested in learning whether a command's output to the terminal is logged somewhere.
Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
4
votes
3answers
103 views
Effectivity of shred on different file systems
man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
4
votes
1answer
260 views
Disabling Web camera
My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
4
votes
3answers
1k views
SSH authentication: either SSH keys or one time password
I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
4
votes
3answers
177 views
Linux executable sandboxing?
I'm running a service that allows users to submit code which is compiled and executed on the server.
At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
1answer
372 views
Custom PAM modules and security considerations
I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
4
votes
3answers
186 views
Randomise or shred memory of an application
Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory?
A command-line utility like this would be perfect:
...
4
votes
2answers
580 views
Arch: Is “SigLevel = Never” the only convenient way?
The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf.
Its not supposed to be the right way, but I don't seem to be able ...
4
votes
2answers
2k views
How can I track who SSH'es into my linux machine?
I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
4
votes
1answer
318 views
SSH tunnel with VNC?
In theory:
I have a low-power consuption machine: eee pc, ok.
I need to run a virtualized windows xp on it. (Because of a windows-only program..)
I need to reach it from a smartphone (Android).
The ...
4
votes
1answer
748 views
Disable random memory address generation in my programs
I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
4
votes
2answers
902 views
BCRYPT - Why doesn't the Linux Distributions use it by default?
Does OpenBSD use bcrypt by default?
Why doesn't every modern Linux Distribution use BCRYPT?
http://codahale.com/how-to-safely-store-a-password/
https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt
...
4
votes
2answers
563 views
Why is mount.cifs not installed suid by default?
I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
4
votes
1answer
689 views
Linux - why is kernel.shmall so low by default?
I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments.
This page is typical of the info that I've found about shmall/shmmax:
...
4
votes
1answer
177 views
What are EXT4 Security Labels?
During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by:
Security labels support alternative access control ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
