Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
51 views

hydra verification before stopping

I am getting false positives when I try a penetration test on my local service with hydra: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post ...
1
vote
2answers
266 views

Secure wipe (scrub) filesystem of VPS from VPS itself

I have a VPS I'm planning to delete. This particular cloud provider makes no guarantee that the data on the drive will be wiped before giving the disk to the next person. What's a best effort attempt ...
3
votes
1answer
87 views

Explanation of version build time as opposed to version number, eg OpenSSL 1.0.1e versus h [duplicate]

Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the ...
1
vote
2answers
254 views

/etc/init.d permissions issue

We are trying to harden our Linux Redhat 5 servers and one of the findings is for the /etc/init.d. The security finding is requiring that we chmod it to 700 or more restrictive. Please see the ...
1
vote
0answers
16 views

backupninja: password outside config file

I would like to use a dup rule in backupninja to make an encrypted remote backup. The configuration file format includes entries for the encryption and ftp password. I would like to move them out of ...
0
votes
1answer
139 views

How do you encrypt a USB drive partition with the Twofish cipher and SHA-512 hash without using TrueCrypt? [closed]

I've been trying to string together the right flags in cryptsetup: cryptsetup -y -h sha512 -c twofish-xts-plain64 -s 512 luksFormat /dev/sdx But it hasn't been working. When I enter the command ...
1
vote
1answer
539 views

cleaning up an hacked ubuntu server

They have hacked my VPS and changed the root passowrd. Fortunately my provider has reset it for me and now I got control back again. The thing is that now I would like to make sure the don't have ...
1
vote
2answers
37 views

List of files accessed by application

I want to install propertiary AMD driver but I would also like to know which files were created/changed by installer. Is there some application which can observe (probably by inotify) which files were ...
2
votes
2answers
225 views

How can I ssh to a remote server with an automated password and no key?

I have a remote server. I planned to use public keys to connect over ssh without typing the password but the remote system rejects public key authentication. So what is the best way to do it? What ...
0
votes
1answer
57 views

Execute scripts without decrypting them

I have a set of scripts (bash, ruby, python) and want to put everything into a container like file so I can deploy this container on a lot of servers. This scripts need to protect from accessing other ...
0
votes
2answers
427 views

Unable to telnet public ip on port 80

We are facing a communication problem between the public and our private network. We have a Linux based web server behind a firewall and an internet router. As part of some integration, our web portal ...
3
votes
1answer
3k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
1
vote
2answers
146 views

how to nsupdate remotely?

I have BIND as a DNS server, what I want is to let this server to allow me to add or remove records to a zone without manually editing the zone file and I want to do this remotely. Is this updating ...
1
vote
0answers
65 views

What information is sent from client to the server when a SSH connection is established?

So let's say I'm on machine A and connect to machine B, and then from there I connect to machine C (with three different usernames). So the SSH connections are: A (john) --> B (eli) --> C(bill) ...
2
votes
3answers
4k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
2
votes
2answers
64 views

Is it secure to connect remotly to Mysql using shell?

I have created a shell script to connect to a DB and do some queries: #/!bin/bash ... ... mysql -h remote -u root --password='pw' MatchingDB some SQL queries My question is : Is this connection ...
1
vote
1answer
462 views

debian7 cron.allow & cron.deny files

Almost 3 weeks that, in my downtime, I try to find out where the files cron.allow & cron.deny are located in debian7 distro. No way, it seems that by default they are not in the system. 'Just' ...
1
vote
1answer
96 views

Meaning of entries in /etc/securetty?

I've been given a set of entries to apply to /etc/securetty, what does each of them mean? console tty1cd / tty2 tty3 tty4 tty5 tty6 ttyS0 ttyS1 I'm especially interested in the "tty1cd /" entry. I ...
5
votes
1answer
86 views

Why does visudo discourage other editors?

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables. It states that "There is no easy way to prevent a user from gaining a root shell if the editor ...
1
vote
0answers
17 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
6
votes
3answers
2k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...
1
vote
1answer
437 views

How to copy files as Jenkins “post build” action if i don't have privileges to destination directory

I have the following users "architecture" : root access is disabled. admin user have access only to its home directory. Apache runs as root service (root is the only one that have access to ...
1
vote
0answers
33 views

I'm wondering about CUPS security. What can I do?

I run Debian Wheezy on a old Acer Aspire One ZG5 model netbook as a server. I have a printer shared to all my other systems and I'm worried about security. On the server I have IPtables set up to ...
1
vote
1answer
35 views

Limiting readers on a pipe

I want to use a pipe to pass some security credential information from "process1" to another script. I only want authorized reader processes to be permitted to read the pipe. I am thinking I will ...
1
vote
2answers
935 views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
-1
votes
1answer
168 views

How to Always make the ttyUSB0 none root access allowed?

Ubuntu 13.10 64-bit OS. I have a service running using Python serial the application running without root as username. But it has to access /dev/ttyUSB0 , so i need to do every time manually chmod -R ...
5
votes
1answer
63 views

Can swap be encrypted per user?

The problem arises for a multiuser computer with encrypted swap, as to how to allow each user to hibernate and resume from hibernation without compromising the security of the other users. I'm ...
3
votes
1answer
891 views

kernel: disabling /dev/kmem and /dev/mem

I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
1
vote
1answer
261 views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
6
votes
1answer
111 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
1
vote
1answer
84 views

Check that only root can edit a script before executing it

I have a script that needs to run as root. It also has a configuration file which is read using source: source conf.sh I would like to check that normal user can't edit conf.sh and therefore get ...
4
votes
1answer
2k views

How to check if port forwarding is enabled?

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled. The thing that is not clear to me is this: should I ...
2
votes
2answers
443 views

How is using a public-key for logging in to SSH any better than using a password?

I'm not asking about password vs key authentication. I've seen a few times (and even Amazons AWS) says that even if SSH has a major vulnerability that key authentication would make such an exploit ...
8
votes
3answers
499 views

Why is konsole reading /etc/passwd?

In relation to this question: While observing the behavior of fatrace, I notice something which concerns me. Here are the first few lines of output of the command "fatrace|grep konsole" ...
5
votes
1answer
499 views

Save password in bash script for multiple queries

I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be ...
1
vote
3answers
136 views

Why does SSH have unsecure defaults?

Why does SSH come with such an unsecure default configuration? to name what I consider unsecure defaults: root login enabled on SSH SSH protocol version 1 (which is vulnerable to MIM attacks) ...
2
votes
2answers
139 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
5
votes
1answer
303 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
3
votes
2answers
199 views

How to securely manage etckeeper from gitolite?

I want to maintain my debian servers by pushing etc into gitolite. The problem is that gitolite shouldn't be run as root and neither as a user that can get shell access into the system from the ...
6
votes
3answers
425 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
3
votes
1answer
74 views

unnecessary accounts in linux

It is recommended in hardening that unnecessary accounts be removed. Do these accounts include process and daemon accounts? What security problems exist with unnecessary user accounts? Can attackers ...
0
votes
1answer
37 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
1
vote
1answer
112 views

Cryptsetup: pre-fill the partition with random data

It says it is an optional step, but it is recommended to do this, it improves encryption to pre-fill the partition with random data. What brings security filled with random data? Is it more difficult ...
3
votes
1answer
90 views

SELlinux security domains

I'm studying SELinux, but I can't find any clear definition for security domains. What is a security domain and what is its difference with security context?
77
votes
3answers
18k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
6
votes
1answer
594 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
0
votes
0answers
170 views

Some files under `/` are owned by UID `501`, is this dangerous?

I just noticed that that the directory /usr was owned by UID 501 on my system. Such a user does not exist on my system, as verified by looking at /etc/passwd. Have I suffered a security breach, or is ...
0
votes
1answer
106 views

rkhunter warnings scan, what to do

When i run a scan with rkhunter i get 2 warnings, i checked the log file and warnings are as the following : first warning : Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
1
vote
1answer
46 views

How kernel allows a process to receive network data that do not belong to it? [closed]

Each process is assigned with port number when using network resource. A process can only send and receive network data from its assigned port number. How kernel allows security programs like IDS, ...
1
vote
1answer
208 views

Does an in-kernel firewall sit between the network access layer and Internet layer?

This question is a follow-up to my previous question. Logic for me to says that an in-kernel firewall sits between the network access layer and the Internet layer, because it needs to have access to ...