Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
1answer
32 views

How does JetBrains PyCarm IDE put files into directories outside of ~/ despite being run without sudo?

PyCharm is a lovely Python IDE by JetBrains that can be downloaded here. I have downloaded the free community edition, extracted (with sudo) it into /opt/jetbrains/pycharm and run (without sudo) /opt/...
1
vote
0answers
20 views

How to view WIFI devices names and signal strength [duplicate]

I want a cli utility or script that shows all the Wifi devices or hotspots or access points and their signal strength. I want to log this data using Python. I will write the logging script myself. ...
0
votes
1answer
53 views

How would pressing backspace 28 times break Grub2 [duplicate]

I just came across this article about how pressing backspace 28 times on the grub screen. Since most mainstream media just says this happens, I've been unable to find anything that explains how it ...
1
vote
1answer
49 views

How to track who added sudo privilege to a user

I have a LDAP user named "ciadmin" created on the Red Hat based system without sudo privlidges. Somehow this user now has sudo privileges and can basically become root on the system. I want to track ...
0
votes
1answer
34 views

Is there any concrete risk involved in using the same password for root, kde wallets and key rings?

To make it easier I decided to use the same password for root (su(do)), kde wallet (KDE desktop) and keyring(s). No one has access to this password in "real world" (given that the computer is ...
3
votes
1answer
24 views

Monitoring ports on ongoing connections

I have a vps server that is blocking me every hour via ip with its firewall. Looking the logs several messages like these where found: Dec 16 13:52:08 srv kernel: [17226167.610181] Firewall: ...
0
votes
2answers
73 views

set up secure connection over SSH

I'm setting up a server application which requires to establish a secure connection over SSH2, e.g. a client must open SSH2 connection to the server to reach specific application: % ssh -s -p5000 my....
1
vote
0answers
21 views

Benefit of using multiple checksums for a group in AIDE

What are the benefits to having all md checksum functions specified for a group when running AIDE? For example, what is the difference between defining the first line and the second line with less md ...
0
votes
1answer
59 views

ARP Spoofing in Data Center

I have a dedicated root server. I noticed strange connections from 255.255.255.255 in iftop. Because of that i tried to investigate it. I runned the following command: tcpdump -i eth0 ether ...
0
votes
0answers
161 views

Block IP Fragmentation attack using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
0
votes
0answers
16 views

How can I encrypt disks in Mint-17 without destroying the data

I have a mint-17 machine with 2 disks managed through lvm. I would like to encrypt the disks. I need to keep the data/apps intact. Is there a way in mint if I could just encrypt the drives or ...
3
votes
1answer
72 views

How come I can login to another person's session over vnc just by changing the port number?

I have a user account on a server administered by someone else. I don't have root access. The server is CentOS 7. I couldn't connect over vnc on the usual port I use, so I ssh'd into the server and ...
0
votes
0answers
33 views

When have software mirrors been compromised before?

Stemming from this answer Mirrors can be compromised (this has happened in the past). It's easier to watch a single distribution point. If an attacker managed to upload a malicious package ...
0
votes
1answer
408 views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
0
votes
2answers
68 views

Is UFW behind a firewall(ed) gateway router necessary

Is it really necessary to run UFW behind my Gateway Router which already has Firewall/Port rules? In this example, I am discussing running UFW on an Internet Accessible (Linux) Server that is behind ...
0
votes
1answer
25 views

Value of nmap option

I've found in some docs of port knocking, that it is used the option --host-timeout I don't understand why is 201 assigned to it? e.g.: nmap -Pn --host-timeout 201 --max-retries 0 -p 7000 192.168.80....
15
votes
1answer
325 views

Why does ArchLinux keep some users/groups after package uninstallation?

I've noticed that after uninstalling the postgresql package in ArchLinux the postgres user and group are not removed automatically. The same is true for some other packages. Investigating this further,...
1
vote
2answers
216 views

What kind of data is stored in the ext4 file system's journal?

The ext4 file system has a feature called has_journal. In the dumpe2fs output, we can see something like this: # dumpe2fs /dev/sda2 | grep -i journal Journal inode: 8 Journal backup: ...
0
votes
0answers
12 views

Folder Permission on Storage Mounted by User [duplicate]

I'm having trouble with an external hdd. Let us say there're two users; user, guest. Let the external storage be called hdde. User has automagically mounted hdde in Ubuntu (for some reason it's /media/...
0
votes
1answer
94 views

How do I bind webmin to the 127.0.0.1 address?

How do I bind webmin to the localhost address? I'd like to be able to do this so that I can secure all the admin services on my TurnKey Linux machine by binding all of them to the localhost address ...
1
vote
2answers
52 views

Symbolic link in the form of user@hostname.6912:144780xxxx

I just noticed a symbolic link named .#tmp.tmp# in my home directory (not created by me) and it pointed to user@hostname.6912:177780xxxx where the x's are additional numbers. A google search revealed ...
2
votes
1answer
99 views

Replace Firewalld with system-config-firewall-tui on CentOS 7

I have a question regarding firewall config on CentOS 7. What I have done Disabled firewalld with systemctl stop firewalld.service Installed and configured system-config-firewall-tui Tested my ...
1
vote
2answers
39 views

How is OpenSSH sftp jail/chroot working?

This question is actually too broad... What I really want to know is whether or not it actually chroots and, if so, how a SSH user deamon[1] can be launched in that jail in spite of the obvious lack ...
15
votes
1answer
890 views

Why can I list other users processes without root permission?

Using ps -aux or top, I can list other users running processes, but i'm neither running as root or making use of sudo, why ?
4
votes
2answers
340 views

Can users in a group access a file that is in another user's home directory?

I have 3 users A,B and C inside a group 'admin'. I have another user 'D' in whose home directory, there is a project folder. I have made D as the owner of that folder and assigned 'admin' as the group ...
1
vote
2answers
373 views

Editing my /etc/hosts.deny

I'm being trolled by China, and don't know why I can't block their request to my server. //host.deny ALL: item.taobao.com ALL: 117.25.128.* But when I watch the error log on my webserver tail -f /...
2
votes
1answer
84 views

Is it possible somehow to tell if a laptop is moved in a bash or python script?

I'm trying to figure out if there's a way to use a bash or python script to tell if my laptop gets moved. I had the idea of using wifi signal strength to do it, but the problem with that is that you ...
0
votes
2answers
84 views

How block all request as ServerIP:Port by iptables

I see many http ddos requests to my server as serverIP:80. Its possible to block all incoming requests to myServerIP:Port?
1
vote
1answer
73 views

Connect to WiFi without storing password (Raspbian)

I notice WPA_GUI has saved my WiFi password to /etc/wpa_supplicant/wpa_supplicant.conf. The unit I'm trying to set up is a shared use system on enterprise WiFi that logs on with a user's account, so ...
3
votes
0answers
41 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
2
votes
0answers
33 views

Microkernel (e.g. GNU Hurd) more secure than monolithic kernel (Linux)? [duplicate]

I would like to understand (in relatively layman's terms) if and how a microkernel such as the Mach-based GNU Hurd is more secure than a monolithic kernel such a Linux. Additionally, does a micro-...
1
vote
3answers
92 views

Audit simultaneous logins in AIX

We are in a banking enviornment and our core system is based on AIX. Multiple users are logging in with the same userID at the same time using SSH. I know I can see who SSHed into the system from ...
2
votes
1answer
313 views

modsecurity rule for blocking wordpress / joomla admin login - others

I have an old rule for ModSecurity 1.x to block admin brute force attacks, and only allow them in the internal network. When I migrated to 2.x, it stopped working. Also the networking ipmatch rules ...
2
votes
1answer
58 views

Should I generate the SSH key pair to give temp access to someone, or accept their public key?

I want to give an external user temporary SSH access.. Should I generate the key-pair and securely give them the private key. Or should I accept their public key. ? Advantages of the first ...
1
vote
2answers
166 views

reset system file permissions, owners and groups

Mac has a utility that checks permissions of files installed on your system to make sure they have the correct permissions as per an installation. Is there something like that with LinuxMint. I am not ...
0
votes
1answer
67 views

Procedure to analyse if a process is hacked/cracked

By a pure casualty, I discovered that a process is taking 100% of one core sometimes when I am away of my computer: When using the CPU, it is below 1%, but when the computer is IDL, meaning the screen ...
1
vote
1answer
46 views

Is there anything important in /var? [closed]

Is there anything important in /var/ such that if something gets corrupted/deleted, it would break the system?
3
votes
1answer
121 views

How to import OTR key into Pidgin?

How can I import an existing OTR key (i.e. from another Pidgin instance) into Pidgin (here version 2.10.9) with installed pidgin-otr plugin? I tried just copying ~/.purple/otr.private_key and ~/....
1
vote
3answers
88 views

Bash script to monitor server security?

I am using a shared server at HG and I want to automate a bash script that will run hourly once and notify me to my gmail account with details of authorized/non-authorized users who have logged into ...
1
vote
0answers
70 views

Is this a Hacker? What to do?

My sites are hosted in a shared server at Hostgator. Server details: uname -a Linux xxxx.hostgator.com x.xx.x.x86_64 #1 SMP Fri May 1 18:21:30 CDT 2015 x86_64 x86_64 x86_64 GNU/Linux I was curious ...
4
votes
1answer
261 views

Is it possible for a sysadmin to eavesdrop a user's screen/graphics?

I am interested in several things: - is it possible? - how to do it? - is there a way for a sysadmin to configure the machine so that it will beep or send an e-mail to the user so that he is aware ...
0
votes
1answer
34 views

Remote SSH connection advice [closed]

I've recently set up port-forwarding for ssh on my server (CentOS 7). I'm also using a custom port for ssh (2211) sudo firewall-cmd --zone=public --add-port=2211/tcp --permanent This works fine I ...
1
vote
3answers
245 views

Why root's password change doesn't require old password

Why can root's password can be changed without entering the old password? Is there any benefit to this or is it just an implementation fault? If we issue passwd from a normal user account it first ...
3
votes
2answers
228 views

Physically override linux credentials

Say someone gains physical access to my computer, and they want to login to my account and see everything I have. Is it possible that they take the hard-drive out of my computer, modify the file /etc/...
0
votes
1answer
27 views

Security of password in a cron job on a VPS

I have a site hosted on a VPS and need to run a MySQL dump nightly. If I create the cron command: mysqldump -u user -ppassword database | gzip > /path/to/zip/file are there any security issues? ...
3
votes
2answers
48 views

Do permissions for the root folder in *nix filesystems differ from other directories?

In a comment under this answer I received a suggestion that "permissions on the / folder are a special case". Is it true and if so, how does the implementation of permissions for the root folder ...
0
votes
1answer
39 views

Do these commands look malicious?

Just found these commands in my shell history. I don't remember typing them and I don't know what they do. Well, I know what more and netstat do but I can't parse the others. Do they look legit, or ...
1
vote
1answer
102 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
1
vote
1answer
96 views

Security - Runing Daemon, program as root or user vs sudo su

I have some questions about Linux security: Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user (...
3
votes
2answers
614 views

Linux - Log What Username and Password Was Tried

I am using Ubuntu Server and I am curious if there is anyway to log what username and password a potential attacker has tried. I can grep /var/log/auth.log and see all the failed attempts but I would ...