Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

7
votes
2answers
958 views

What encryption does vim -x use?

I read man vim, :h -x and :h encryption none of this actually says what algorithm it's encrypted with.
7
votes
2answers
13k views

SSH key-based authentication: known_hosts vs authorized_keys

I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong… Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
7
votes
5answers
650 views

how do I wipe a server that I don't have physical access to?

I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
7
votes
2answers
230 views

Hibernate and security considerations

How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?
7
votes
5answers
1k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
7
votes
2answers
307 views

Can I get infected in this case if I run a live cd?

I recently got rid of a nasty trojan on Windows and want to migrate to Linux(Ubuntu). I want to run a Live CD so that I can format an SD card to put my brand new firmware on my router and format the ...
7
votes
1answer
545 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
7
votes
2answers
601 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
7
votes
2answers
4k views

How to check, which limit was exceeded? (Process terminated because of ulimit. )

Let's assume process runs in ulimited environment : ( ulimit ... -v ... -t ... -x 0 ... ./program ) Program is terminated. There might be many reasons : memory/time/file limit exceeded ; just ...
7
votes
4answers
349 views

How can I safely give a shell to somebody?

I have a question about giving a shell account to somebody. How safe is it? He could read /etc. How can I give a secured shell account that will only restrict the user to some bins and his own home? ...
7
votes
1answer
238 views

Why is it a security problem to have /usr/sbin owned by bin?

The Sendmail Installation and Operation Guide (§1.3.1) asserts: For security reasons, /, /usr, and /usr/sbin should be owned by root, mode 07552[...] 2Some vendors ship them owned by bin; this ...
7
votes
2answers
139 views

Signing/Checksumming the kernel to prevent/detect manipulation

All my partitions are encrypted (/ and /home), but the /boot partition has to remain unencrypted and is open for manipulation. I was thinking about hashing the kernel on bootup and checking the result ...
7
votes
4answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
7
votes
1answer
414 views

How can I limit ssh *remote* port forwarding?

I need to limit which ports can be remotely 'ssh -R' forwarded by an user. I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding ...
7
votes
1answer
180 views

How to use /etc/fbtab in OpenBSD to secure X11?

OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X." How might one do this? What lines when added to /etc/fbtab would ...
7
votes
0answers
3k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
6
votes
4answers
4k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...
6
votes
3answers
2k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...
6
votes
6answers
188 views

File protection in Unix

Is there a way to protect a file in such a way that even root cannot delete it or rewrite it after creating it? I have a file which is created by root under /var/log/ and I want to restrict all users ...
6
votes
3answers
212 views

Under what scenarios would I want to set a SUID bit?

I'm struggling to wrap my mind around the concept of SUID bits and why they're would be useful. For example, let's say I have a program: -rwsr-xr-x 1 root root 12364 Jan 12 2013 ...
6
votes
2answers
3k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...
6
votes
2answers
181 views

Is there any issue to put / as a home directory of root user from security point of view?

Is there any issue to put / as a home directory of root user from security point of view instead of /root
6
votes
2answers
927 views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
6
votes
8answers
11k views

Is it possible to test user name and password?

I've written a python CGI script that invoke bash commands, and it needs to test for a successful login on the host. Is it possible to create a bash script that will test a given username and ...
6
votes
2answers
571 views

Why did SDF switch from NetBSD to Linux?

I personally don't have much experience, but I was reading about SDF, and at one point the article mentions that SDF migrated to Linux in 1997, but due to the large number of malicious attacks it ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
6
votes
2answers
769 views

I/O-overhead of dm-encrypted device?

What would be the Read-/Write-overhead when using dm-crypt (LUKS) as full disk-encryption (including root partition) on a Linux-Desktop (Ubuntu)? I plan to stack it like so: LUKS > LVM > ext4 The CPU ...
6
votes
3answers
400 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
2answers
11k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
6
votes
4answers
2k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
6
votes
2answers
243 views

Lock some accounts during some time periods

Is it possible to lock some accounts in order to be accessible only during specific time periods? For instance the account joe should only be accessible during office hours.
6
votes
3answers
240 views

Force Firefox to remember passwords on particular sites

Usually, when I log into a website with username and password, Firefox asks whether it should remember the login details. When I click yes, next time I visit the website, the username and password ...
6
votes
1answer
589 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
6
votes
1answer
209 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
6
votes
1answer
468 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
6
votes
2answers
806 views

Optimize performance for encrypted disk

Recently I tried to copy 200GB to a 1TB external / USB2 / encrypted disk and it took 36 hours. The same copy when the disk was not encrypted took no longer than 1 hour. I am using dm-crypt (LUKS) ...
6
votes
4answers
6k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
6
votes
1answer
1k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
6
votes
2answers
90 views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...
6
votes
1answer
96 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
6
votes
1answer
282 views

Any random password results in successful login on tty

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type... I tried to reset password for ...
6
votes
2answers
411 views

ssh-agent: don't forward authentication for the whole keyring

I have two private ssh keys : one to access my personnal machines, one to access servers at my job. I add those two keys to my ssh-agent with ssh-add. Now, when I do ssh -A root@jobsrv I ...
6
votes
1answer
837 views

Jailbreaking HDTV

I have a Vizio internet TV, the predecessor to this one with basically the same specs, not 3D though. I wanted to try and gain root access to the tv. Using nmap I leaned that the only port open is ...
5
votes
4answers
2k views

Are there any GUI's for Linux that doesn't use X11?

Are there any GUI's for Linux that doesn't use X11? Since X has very poor security :O e.g.: Ubuntu, Fedora - what else are there? Goal: having a Desktop Environment without X. - what are the ...
5
votes
4answers
1k views

How sudo/root-ness detection works

Programs that make changes system-wide require sudo unless I am already the root user. Now, the question is: how exactly does the system figure out that I am (not) root? Does it: Check to see if ...
5
votes
3answers
283 views

Preventing binary planting attacks in Linux

If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised. Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
5
votes
2answers
698 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
5
votes
2answers
250 views

Writing a “telnet server” type program that uses SSH instead of telnet

So people have written server programs using telnet in which the user simply does telnet server.com and this connects them to the server program, which then provides them with a textual program they ...
5
votes
2answers
119 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
5
votes
2answers
5k views

How do I disable remote root login via ssh?

How do I disable remote root login via ssh? I want to log into my server (I use keys on my main comp) then su into root instead of access root directly. I am using Debian. I follow guides online ...