Content related to computer security.
3
votes
2answers
77 views
In Gnome, how do I decide whether to accept a PackageKit software source?
When I try to install software in the Gnome environment of Linux (mine is openSUSE) from a repository that I have not used before, PackageKit asks me to respond "Yes" or "Cancel" to a dialog "Software ...
-2
votes
4answers
191 views
Steps to secure your server? [duplicate]
Possible Duplicate:
What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?
I'm just completed install my web server.
So what should i do to secure it?
I just ...
6
votes
1answer
497 views
Jailbreaking HDTV
I have a Vizio internet TV, the predecessor to this one with basically the same specs, not 3D though. I wanted to try and gain root access to the tv.
Using nmap I leaned that the only port open is ...
3
votes
1answer
174 views
SSH Bash Jail Session
I've seen some game tunneling service providers that jails the customer's account to a Information screen upon login and any input is ignored. Ctrl+C closes the SSH session, and disconnecting. This ...
1
vote
2answers
683 views
Allow non-root process to access all home directories without compromising security?
Any ideas how to allow one non-root process to access (read&write) all home directories without compromising security? Normal users should not have access to each other's home directories.
All ...
3
votes
2answers
934 views
How can I block a range of IP addresses with an Amazon EC2 instance?
I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
3
votes
1answer
114 views
What is the best way to restraint/secure a workstation?
I want to prevent users to copy on usb devices and some others actions.
I was thinking of using polkit. Do you think it is a good solution or does someone know some alternatives ?
EDIT:
I also need ...
2
votes
1answer
1k views
Linux: LUKS and multiple hard drives
I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM).
I think the basic ...
2
votes
0answers
95 views
Why do I get a different RSA fingerprint when multihopping using ProxyCommand
I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems):
Host gw1
HostName ...
2
votes
1answer
114 views
Securely Deleting A File In Ram
I'm running a live distro in ram. I need to write a password to a file. Later, I need to delete it securely.
I don't know how live file systems work, so I'm unsure if I open the file for writing, ...
6
votes
5answers
493 views
Securing a Debian installation for general home usage
Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, ...
4
votes
1answer
261 views
Disabling Web camera
My Eee PC comes with a Web cam, which I never use. How can I ensure that it is effectively disabled, so that no software can use it?
0
votes
0answers
422 views
Any better alternative to chroot on an OpenVZ VPS?
Are there any better alternative to chroot environment?
I'm thinking about running nginx on a jailed environment.
BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no.
(I think that prevents ...
10
votes
1answer
592 views
Why aren't the Fedora GPG keys signed?
Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https.
For example the checksum ...
6
votes
2answers
340 views
Why did SDF switch from NetBSD to Linux?
I personally don't have much experience, but I was reading about SDF, and at one point the article mentions that SDF migrated to Linux in 1997, but due to the large number of malicious attacks it ...
3
votes
1answer
296 views
SELinux outbound access to other sites with restrictions
We have CentOS 6 configured with SELinux to host a number of websites.
Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update ...
10
votes
3answers
794 views
Can SSH passwords be sniffed out over Wi-Fi?
When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).
4
votes
1answer
249 views
Does using epub2pdf pose a potential security risk? Is there an alternative?
epub2pdf is a fairly platform-independent program. Based on Java, it executes without a hitch on my machine, with no dependencies.
However, strangely enough, the program requires an active internet ...
3
votes
2answers
13k views
What user should apache and PHP be running as? What permissions should /var/www files have?
I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
2
votes
2answers
1k views
Hardening debian?
So I have thought a bit about hardening a Debian squeeze file & VPN server
lately.
Right now, we've placed the machine behind a firewall only allowing SSH connections from LAN, set a strong root ...
-4
votes
4answers
295 views
Since Android has malware, does it mean no Unix is immune from malware?
Android has virus: Android.Counterclank, Android.Tonclank (seal info, back-door). Does it prove that FreeBSD, Solaris, Fedora, CentOS, ArchLinux, Ubuntu all is running and having similar ...
10
votes
4answers
1k views
Why do we need a firewall if no programs are running on your ports?
When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if ...
5
votes
3answers
202 views
Preventing binary planting attacks in Linux
If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised.
Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
5
votes
5answers
2k views
Shell Script mktemp, what's the best method to create temporary named pipe?
I'm aware its best to create temporary files with mktemp, but what about named pipes?
I have an idea, I'm sure it would work,
but I would really like an expert opinion.
I prefer things to be as ...
1
vote
1answer
217 views
portsentry and IPTables on constant reboot, but not sure why
I have been doing some hardening on a new server [ centos 5.7 final ]
i also have logwatch and seem to be getting these strange logs
Commands Run:
User root:
/sbin/service portsentry restart ...
5
votes
2answers
773 views
Automatic security updates on Debian squeeze server
For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
2
votes
1answer
94 views
Fedora15/Gnome3 - Exit elevated priviliges mode
While using Fedora 14 (Gnome2), Each time if I was doing some privileged task (ex - mounting a new hard drive), I would be prompted for password and then there would appear an icon (like keys) on the ...
5
votes
5answers
358 views
Why is it recommended to create a group and user for some applications?
Most of the time, when installing a program from source it is recommended to create a new user and a new group and give /usr/local/<myapp> the recently created user and group ownership.
Why is ...
10
votes
3answers
2k views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 ...
4
votes
8answers
5k views
Is it possible to test user name and password?
I've written a python CGI script that invoke bash commands, and it needs to test for a successful login on the host.
Is it possible to create a bash script that will test a given username and ...
2
votes
1answer
88 views
What commands should be run when retiring a remotely hosted server?
I have a dedicated server from a friendly host located a substantial distance away from me, so the only access to the machine is SSH. It's a month to month deal, so I don't own the hardware. I'm ...
3
votes
1answer
175 views
sandbox tcpdump under OpenBSD?
From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running:
tcpdump -w output.pcap
because it can be only used ...
11
votes
3answers
340 views
Prompt user on Linux security denial
Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
2
votes
1answer
313 views
UFW Limit does not appear to work
I have my ssh port changed to XXX. Then I did
ufw limit XXX/tcp
However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the ...
4
votes
3answers
1k views
SSH authentication: either SSH keys or one time password
I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
2
votes
3answers
897 views
Making sense of auth log
I am seeing some log enties that look like hacking attempts
Type 1
Dec 26 03:09:01 ... CRON[9271]: pam_unix(cron:session): session closed for user root
Dec 26 03:17:01 ... CRON[9308]: ...
8
votes
4answers
200 views
Good practice to use same SSH keypair on multiple machines?
I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...
4
votes
3answers
177 views
Linux executable sandboxing?
I'm running a service that allows users to submit code which is compiled and executed on the server.
At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
10
votes
4answers
5k views
How do I recursively shred an entire directory tree?
I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding.
How can I shred an entire directory tree ...
1
vote
1answer
233 views
How can I use Skype with lxc?
Under Scientific-linux?
https://en.wikipedia.org/wiki/LXC
I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
4
votes
2answers
2k views
How can I track who SSH'es into my linux machine?
I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
2
votes
1answer
437 views
Deny external SSH access to a user
Is it possible to deny access to a user (in my case www-data) from outside the network? Or possibly deny this:
ssh www-data@example.com
But allow this if already logged in:
su www-data
3
votes
2answers
434 views
If you SSH into another computer, how to access other X displays?
This is a query based on personal use. A troll in our local network had downloaded Crikey, the key-event simulator. He used it to simulate events on other computers, leading to unwanted things. For ...
1
vote
1answer
155 views
How 'safe' is it to use new distributions of linux? [closed]
I hope this is the right place to ask this. I was looking at some new distros of linux that came out fairy recently and I really like their UI. I want to start using one of these but I'm a bit ...
2
votes
1answer
442 views
Debian + Nginx/Unicorn permissions
Is there a security risk in running a web server like Unicorn as root?
The Nginx master process runs as root, the Nginx worker runs as the limited www-data user, but I can't set another user like ...
2
votes
2answers
125 views
Is it possible (and a good idea) to do `pw lock root` on FreeBSD?
I have set up sudo on my FreeBSD server. As I now never want to log in as root anymore, I was wondering whether I should do sudo pw lock root.
My questions are:
Is this possible, without forever ...
-1
votes
3answers
245 views
no root shell freely available sudoers policies
I want to prevent users who need escalated privileges from obtaining any kind of a root shell. However since there are many ways to attain this, and many non root commands ( like those found in ...
7
votes
2answers
125 views
Signing/Checksumming the kernel to prevent/detect manipulation
All my partitions are encrypted (/ and /home), but the /boot partition has to remain unencrypted and is open for manipulation. I was thinking about hashing the kernel on bootup and checking the result ...
23
votes
4answers
749 views
Execution of possibly harmful program on Linux
I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it.
I was thinking ...
5
votes
1answer
153 views
How can I find a Ubuntu package to use with Amazon EC2?
I'm looking to set up a new server on Amazon's EC2 and I wanted to use Ubuntu 11.04 is it is fairly new but not too new. I previously used 10.10 which I think is also very stable and time-tested.
My ...
