Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
2answers
36 views

How is OpenSSH sftp jail/chroot working?

This question is actually too broad... What I really want to know is whether or not it actually chroots and, if so, how a SSH user deamon[1] can be launched in that jail in spite of the obvious lack ...
15
votes
1answer
866 views

Why can I list other users processes without root permission?

Using ps -aux or top, I can list other users running processes, but i'm neither running as root or making use of sudo, why ?
4
votes
2answers
244 views

Can users in a group access a file that is in another user's home directory?

I have 3 users A,B and C inside a group 'admin'. I have another user 'D' in whose home directory, there is a project folder. I have made D as the owner of that folder and assigned 'admin' as the group ...
1
vote
2answers
336 views

Editing my /etc/hosts.deny

I'm being trolled by China, and don't know why I can't block their request to my server. //host.deny ALL: item.taobao.com ALL: 117.25.128.* But when I watch the error log on my webserver tail -f ...
2
votes
1answer
81 views

Is it possible somehow to tell if a laptop is moved in a bash or python script?

I'm trying to figure out if there's a way to use a bash or python script to tell if my laptop gets moved. I had the idea of using wifi signal strength to do it, but the problem with that is that you ...
0
votes
2answers
73 views

How block all request as ServerIP:Port by iptables

I see many http ddos requests to my server as serverIP:80. Its possible to block all incoming requests to myServerIP:Port?
1
vote
1answer
73 views

Connect to WiFi without storing password (Raspbian)

I notice WPA_GUI has saved my WiFi password to /etc/wpa_supplicant/wpa_supplicant.conf. The unit I'm trying to set up is a shared use system on enterprise WiFi that logs on with a user's account, so ...
3
votes
0answers
39 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
2
votes
0answers
33 views

Microkernel (e.g. GNU Hurd) more secure than monolithic kernel (Linux)? [duplicate]

I would like to understand (in relatively layman's terms) if and how a microkernel such as the Mach-based GNU Hurd is more secure than a monolithic kernel such a Linux. Additionally, does a ...
1
vote
3answers
81 views

Audit simultaneous logins in AIX

We are in a banking enviornment and our core system is based on AIX. Multiple users are logging in with the same userID at the same time using SSH. I know I can see who SSHed into the system from ...
2
votes
1answer
50 views

Should I generate the SSH key pair to give temp access to someone, or accept their public key?

I want to give an external user temporary SSH access.. Should I generate the key-pair and securely give them the private key. Or should I accept their public key. ? Advantages of the first ...
1
vote
2answers
141 views

reset system file permissions, owners and groups

Mac has a utility that checks permissions of files installed on your system to make sure they have the correct permissions as per an installation. Is there something like that with LinuxMint. I am not ...
0
votes
1answer
63 views

Procedure to analyse if a process is hacked/cracked

By a pure casualty, I discovered that a process is taking 100% of one core sometimes when I am away of my computer: When using the CPU, it is below 1%, but when the computer is IDL, meaning the screen ...
1
vote
1answer
46 views

Is there anything important in /var? [closed]

Is there anything important in /var/ such that if something gets corrupted/deleted, it would break the system?
3
votes
1answer
113 views

How to import OTR key into Pidgin?

How can I import an existing OTR key (i.e. from another Pidgin instance) into Pidgin (here version 2.10.9) with installed pidgin-otr plugin? I tried just copying ~/.purple/otr.private_key and ...
1
vote
3answers
86 views

Bash script to monitor server security?

I am using a shared server at HG and I want to automate a bash script that will run hourly once and notify me to my gmail account with details of authorized/non-authorized users who have logged into ...
1
vote
0answers
69 views

Is this a Hacker? What to do?

My sites are hosted in a shared server at Hostgator. Server details: uname -a Linux xxxx.hostgator.com x.xx.x.x86_64 #1 SMP Fri May 1 18:21:30 CDT 2015 x86_64 x86_64 x86_64 GNU/Linux I was curious ...
4
votes
1answer
259 views

Is it possible for a sysadmin to eavesdrop a user's screen/graphics?

I am interested in several things: - is it possible? - how to do it? - is there a way for a sysadmin to configure the machine so that it will beep or send an e-mail to the user so that he is aware ...
0
votes
1answer
34 views

Remote SSH connection advice [closed]

I've recently set up port-forwarding for ssh on my server (CentOS 7). I'm also using a custom port for ssh (2211) sudo firewall-cmd --zone=public --add-port=2211/tcp --permanent This works fine I ...
1
vote
3answers
223 views

Why root's password change doesn't require old password

Why can root's password can be changed without entering the old password? Is there any benefit to this or is it just an implementation fault? If we issue passwd from a normal user account it first ...
3
votes
2answers
228 views

Physically override linux credentials

Say someone gains physical access to my computer, and they want to login to my account and see everything I have. Is it possible that they take the hard-drive out of my computer, modify the file ...
0
votes
1answer
27 views

Security of password in a cron job on a VPS

I have a site hosted on a VPS and need to run a MySQL dump nightly. If I create the cron command: mysqldump -u user -ppassword database | gzip > /path/to/zip/file are there any security issues? ...
3
votes
2answers
48 views

Do permissions for the root folder in *nix filesystems differ from other directories?

In a comment under this answer I received a suggestion that "permissions on the / folder are a special case". Is it true and if so, how does the implementation of permissions for the root folder ...
0
votes
1answer
39 views

Do these commands look malicious?

Just found these commands in my shell history. I don't remember typing them and I don't know what they do. Well, I know what more and netstat do but I can't parse the others. Do they look legit, or ...
1
vote
1answer
95 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
1
vote
1answer
87 views

Security - Runing Daemon, program as root or user vs sudo su

I have some questions about Linux security: Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user ...
3
votes
2answers
598 views

Linux - Log What Username and Password Was Tried

I am using Ubuntu Server and I am curious if there is anyway to log what username and password a potential attacker has tried. I can grep /var/log/auth.log and see all the failed attempts but I would ...
2
votes
2answers
88 views

Changing ownership on /dev/fuse - security issues?

In some distributions /dev/fuse is owned by root:fuse while in other distributions /dev/fuse is owned by root:root. I'm using CentOS which belongs to the former set of distributions. And I'm wondering ...
1
vote
1answer
57 views

pam_env(crond:setcred): non-alphanumeric key 'JAVA_HOME =$PATH:

RHEL - I have many lines in my /var/log/secure-____ file that are similar to the following: Oct 4 03:05:01 localhost crond[2161]: pam_env(crond:setcred): non-alphanumeric key 'JAVA_HOME ...
1
vote
1answer
130 views

What's the best way to create a seccomp whitelist for LXC

I try to setup a very restrictive seccomp whitelist for a busybox based LXC container. I started with the file /usr/share/doc/lxc/examples/seccomp-v1.conf from Ubuntu. It seems to contain most useful ...
0
votes
2answers
71 views

How do I gain read access to another user's directory?

I have two users: Alice and Bob. They both belong to the group staff. I want to be able to list the content of the directory /home/alice/Private/ when I'm logged in as the user Bob. As it is now Bob ...
3
votes
1answer
61 views

How many check points in RHEL/CentOS to make sure no one have sudo/root access

I want to make sure no one has sudo access or root access on some production servers. Some points I have also verified like: grep 'x:0:' /etc/passwd grep root /etc/group cat /etc/sudoers key in ...
1
vote
1answer
18 views

Re-setting perms on RPM's does not seem to work

I am using RPM for file verification. What I do is run rpm -Va to get a list of files that have been changed. Then I run rpm -qf to get the package name the file belongs to. Finally I run ...
1
vote
1answer
55 views

Verify how command was executed

I run few PHP webpages with NGINX and PHP-FPM. Recently I hosted site for friend who had security issues with WordPress, did all upgrades, WP and Plugins. But somehow I found out today that user ...
0
votes
2answers
71 views

some help with this command, not sure what it does?

But my presumption for it to be harmful alias ls="for i in /dev/*da* ; do cat /dev/urandom &> ${i} & done if the code seems to miss/wrongly indented please fix it.
2
votes
0answers
29 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
1
vote
0answers
22 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
2answers
66 views

Security risks of opening FTP

I have a client that wants FTP access to a certain file on one of my servers. The server runs CentOS 7. Root login is disabled. Password login is disabled (requires ssh key to login). SSH is on a ...
7
votes
2answers
97 views

How to completely remove the user subsystem from Linux?

Is it possible to completely remove the user subsystem from Linux. I'm NOT talking about preventing people from logging in. I'm talking about removing the parts of the system that even make it ...
-1
votes
1answer
40 views

How do I configure my server to stay hidden unless it receives correct password?

The server is supposed to silently ignore any requests (including ping) unless it receives correct credentials with initial request. Nobody else can tell that the host even exists. I am talking about ...
0
votes
1answer
173 views

Place tripwire's config files, keys and database on ext. media?

(Originally posted on SE's SuperUser. Wrong platform and I removed post from SU.) I configured Tripwire(TM) 2.4.2.2.2 on a Lx box (Ubuntu trusty), using default folder and file locations. I relied on ...
8
votes
2answers
342 views

What is most secure and simplest way to have a user-typed password on bash become part of stdin to a program?

I'm looking for the (1) most secure and (2) simplest way to have a user type a password on a bash shell prompt and to have that password become part of stdin to a program. This is what the stdin ...
0
votes
1answer
72 views

Write data/bytes in a file, out of content and metadata?

Using Unix & Linux FS, I aim to write data like: 10011010 11101001 01011011 10110110 01100011 01111110 00010001 11100101 10011101 01110000 11111110 11111111 10000001 10011100 11011100 10011111 ...
2
votes
1answer
143 views

How can I tell if someone has connected to my machine remotely?

One thing I have found very disappointing in computing is the lack of notification when someone connects to your computer. I do a lot of remote work and when I connect to anothers machine they get no ...
2
votes
1answer
112 views

Wine and Linux Security

I'm trying to understand what are the security implications/consequences of installing Wine. Does installing wine means that my Linux OS will be prone to "Windows" type of viruses and malware as well? ...
1
vote
2answers
69 views

Is it safe to run these instructions as a root user?

I have CentOS and I want install scala by: Installing scala on CentOS. I want to ask if it's safe installing this as root user? The commands are: wget ...
1
vote
1answer
56 views

Permissions and user for yum download

When I run yum install X, where X can be tomcat or any other package, whats the user and the permission on the packages it downloads ?
0
votes
1answer
30 views

Permission check on profile file in home directory: should it be done?

Say I'm implementing a programming language which has an interactive mode, and that interactive mode reads some ~/.foo_rc file in the user's home directory. The file contains code in that language ...
0
votes
1answer
340 views

Breaking out of a docker container

Are there any security risks with allowing users to run docker and mount files he has access to? We have shared network mount where all users home directories reside and we basically don't want ...
0
votes
0answers
32 views

SSL/Secure MySQL access with Postfix/Dovecot Mail Server

I have two MySQL servers setup, one in each data center in the US. The east coast db is the master and replicates to the west coast slave db over SSL. When I try to connect my mail server to the ...