Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
0answers
133 views

Writing to Arbitrary Memory Addresses [closed]

I'm reading "Art of Exploitation 2nd Ed." and I have a question regarding a section on format string attacks. Target program Below code (fmt_vuln.c) is a target program. #include <stdio.h> ...
3
votes
1answer
161 views

present users a login prompt? /bin/login? getty?

I have a service that execs a command when a user connects to it through a socket, and redirects everything it receives to the executed program. It works ok with shells like bash, giving the user a ...
4
votes
2answers
2k views

rkhunter warn me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
1
vote
1answer
206 views

How to recognize harmful AUR packages

How do I recognize if a package which is installed via yaourt on arch linux could be harmful to my pc? I read in the wiki that I should check every installation I make with yourt. But what exactly do ...
2
votes
1answer
101 views

How 'passwd' gains ROOT user permissions?

How does Linux knows that it has to give euid 0 (uid of root) to only certain process like passwd, setuid, etc. If a process can gain root user's permissions, will it not lead to security breach in ...
0
votes
2answers
168 views

SSH authentication by public key and password in the same time

Something is not clear to me with SSH authentication. I have a Talend job which connects to sFTP (using SSH protocol) and on the property page of the component, I have the choice between: 1. ...
0
votes
1answer
39 views

Login retrieval in osx [duplicate]

I got an old Mac G4 (powerPC) from the company who wanted to put it in a bin. The company agreed that I can take it home for private use. It is running an early version of OSX but because it is old ...
4
votes
1answer
227 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
2
votes
2answers
246 views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
2
votes
1answer
184 views

GlassFish/Tomcat security issue between domain users in linux server (alternate docroot issue)

Let's suppose we give to different users(clients) different domains (one domain for one user) in our glassfish application server for their work. This glassfish works in centos 6 server. Every user ...
0
votes
3answers
322 views

How to make accessible folder/file to other user

How is it possible to make a folder under $HOME accessible to other users? I thought that's the case why we have softlinks but apparently I am missing some bits here. Can someone please shed a light ...
4
votes
1answer
75 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
1
vote
2answers
174 views

Why can I access all my files without a password when booting with a Chakra Linux live CD?

The other day I burned a Chakra Linux iso on a dvd. When I booted into a live session I was able to access all my regular data. In dolphin when clicking on the icon belonging to my /home/user ...
5
votes
4answers
334 views

Allowing rename but not moving to other directory

Users can upload/delete/rename files via vsftp server and everything works well except they can also move files across directories. Is it possible to allow renaming of files but disallow moving them ...
4
votes
2answers
1k views

How to identify a process which has no pid?

I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid : netstat -antlp | grep 45136 tcp 0 0 ...
1
vote
2answers
764 views

DNSCrypt, Unbound and DNSSEC

I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) . I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers : ...
1
vote
1answer
129 views

Configuring ProFTPd securely in a shared environment

We currently have a LAMP stack for shared webhosting, and are using ProFTP with that. Currently the ProFTP config is fairly stock - users are chrooted to ~. Currently running as the default ...
1
vote
2answers
374 views

Can any user account in Linux invoke command chmod?

Since permissions are sensitive, is it vital to be clear whether a specific user is or not allowed to run command chmod?
2
votes
3answers
278 views

What happens if I delete all user passwords?

I have a Fedora VPS with a root user that has no password. I login with SSH keys. I had another, less privileged account on that server, used for web administration. I've now deleted its password ...
2
votes
3answers
375 views

Use EncFS to encrypt files so that a particular user or process can access them, but root cannot

I have a process which I would like to have access to an encrypted file system. This is very easy to do with EncFS, but this requires a user mounting the encrypted file system, therefore giving any ...
3
votes
1answer
94 views

New webserver: What all user accounts should I create and permissions to provide for

This is a followup on my question here. I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have. ...
1
vote
2answers
146 views

What kind of Linux can verify all of its files / packages like debsums(Debian), but more?

# debsums -a, --all check configuration files (normally excluded) However, there is large amount of temporary, ancillary files here and there, not only in tmp-dir. About 4,000 of binaries .pyc ...
3
votes
2answers
151 views

How to harden linux against DMA attacks?

How can I configure my linux system to be secure against DMA-attacks? Is there a way to make them impossible? DMA Attacks excerpt From wikipedia In modern operating systems, non-system (i.e. ...
4
votes
2answers
334 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
7
votes
2answers
578 views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
4
votes
1answer
66 views

TCP wrapper “except” option

I configured the /etc/hosts.allow at the machine 192.168.122.50 with the following option. sshd : ALL EXCEPT 192.168.122.1 and tried ssh root@192.168.122.50 from the machine 192.168.122.1 and I was ...
2
votes
3answers
587 views

Restrict standard users to run a command with a specific argument

I know how to restrict standard users to run a command by removing execute permissions for that command. But it's possible restrict standard users to run a command with a specific option/argument? ...
1
vote
2answers
3k views

Postfix, Amavis-new, ClamAV: Permission denied. ERROR

Error lines in /var/log/maillog Sep 22 12:08:20 sun amavis[4493]: (04493-09) (!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/spool/amavisd/tmp/amavis-20130922T052321-04493-crApLkq5/parts: ...
1
vote
3answers
3k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
4
votes
1answer
482 views

How can I secure my Ubuntu 13.04 to prevent network attacks? [closed]

Is there a way I could protect my pc computer from being hacked in an event where the internet conection will be opened? Thing is I am going to Campus Party Colombia 2013 and I was sugested to format ...
4
votes
3answers
570 views

Why is PATH reset in a sudo command?

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH ...
6
votes
3answers
210 views

Under what scenarios would I want to set a SUID bit?

I'm struggling to wrap my mind around the concept of SUID bits and why they're would be useful. For example, let's say I have a program: -rwsr-xr-x 1 root root 12364 Jan 12 2013 ...
2
votes
1answer
437 views

AIX 6.1 — Without root can I get the last failed login for a user i have access to?

I know the information is in the security files but I don't have access and it's more work then I want to do to go to our Unix admins to get the information (everytime the account gets locked which is ...
16
votes
4answers
3k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
2
votes
2answers
392 views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I know debian ...
5
votes
1answer
591 views

Security of an encrypted (dm-crypt & LUKS) Ubuntu 12.04 installed by somebody else?

Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation. Suppose also that I have somebody (e.g. my vendor) else set this up ...
2
votes
1answer
331 views

Is many consoles in securetty file a risk?

I got a problem So I expect you can give me an answer. I have to evaluate the security of a RedHat server. The idea is review the /etc/securetty file to ensure that only the console tty is listed. But ...
8
votes
2answers
1k views

Test whether Linux binary is compiled as position independent code

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization ...
4
votes
3answers
432 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
3
votes
2answers
777 views

how to know the type of symmetric encryption used by ssh?

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?. I have looked in ...
4
votes
1answer
98 views

Tomoyo Linux: Have a private folder, that can't be read by default

Is it possible to specify folders, eg: /home/$user/private that can not be listed, read or written to by any application in the default profile 0, but only with programs where I specify this as ...
2
votes
2answers
129 views

Securely allowing users to create accounts

1) I'm struggling to find a secure way to allow new users to create accounts without granting them admin rights to do so. If you already have an account on my system and can work UNIX command line, ...
1
vote
2answers
4k views

OpenVPN - Socket bind failed on local address [AF_INET] IP:1194: Cannot assign requested address

How get it resolved? I am trying to start the openVPN server so that i can login remotely using username: demo and password: demo, but openVPN server is failing to start. What am i doing wrong, how ...
9
votes
2answers
2k views

How does ps know to hide passwords?

Witness: $ ps f PID TTY STAT TIME COMMAND 31509 pts/3 Ss 0:01 -bash 27266 pts/3 S+ 0:00 \_ mysql -uroot -p 25210 pts/10 Ss+ 0:00 /bin/bash 24444 pts/4 Ss 0:00 ...
2
votes
2answers
194 views

SELinux: allow a process to create any file in a certain directory

I have a script that, when invoked, will cause the contents of dmesg to be written to a file, with the file's name basically being a timestamp. SELinux prevents this. Following the advice of ...
0
votes
1answer
657 views

Difference between Debian 7.1 and Linux Mint 15 Debian

What is the main difference between Debian 7.1 and Linux Mint 15 Debian besides look and Desktop Environment. Basically with a special reference to security stability, and updates if you are going to ...
2
votes
1answer
77 views

Bad to own a directory outside of your home directory?

Some how, can't remember why, I got into the habit of downloading source to the directory /opt, which I chown to my user/group. I have this feeling that it is not a good thing to do. Is there ...
0
votes
1answer
91 views

Has the launcher security issue in KDE and Gnome been fixed?

One of the first things I heard about Linux is that it doesn't get any kind of malware. Now, I see it can get malware through WINE and e-mail (although I don't even open attachments or follow links ...
0
votes
1answer
166 views

What is the effect of setting immutable bit on /boot partition [closed]

What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the ...
3
votes
1answer
1k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...