Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

5
votes
2answers
6k views

How do I disable remote root login via ssh?

How do I disable remote root login via ssh? I want to log into my server (I use keys on my main comp) then su into root instead of access root directly. I am using Debian. I follow guides online ...
5
votes
1answer
7k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
5
votes
3answers
8k views

Check outgoing network traffic

In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to? I am not paranoid about security, ...
5
votes
5answers
2k views

Why is it recommended to create a group and user for some applications?

Most of the time, when installing a program from source it is recommended to create a new user and a new group and give /usr/local/<myapp> the recently created user and group ownership. Why is ...
5
votes
2answers
807 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
5
votes
3answers
1k views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
5
votes
2answers
465 views

Writing a “telnet server” type program that uses SSH instead of telnet

So people have written server programs using telnet in which the user simply does telnet server.com and this connects them to the server program, which then provides them with a textual program they ...
5
votes
2answers
124 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
5
votes
1answer
822 views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
5
votes
3answers
214 views

I'm moving up from managed hosting to a VPS. What do I need to know?

I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux and I'm not afraid of ...
5
votes
3answers
499 views

Unix users, groups, and permissions

I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?
5
votes
3answers
2k views

How to clear terminal after logging out?

Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?
5
votes
4answers
347 views

Is it possible to use pendrive as key for Linux system

I want to give high security for my linux box. So i planed to use my pen drive as key for my linux box. How can i do it ?
5
votes
2answers
358 views

Why ssh-agent group ownership is not root

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? ...
5
votes
7answers
455 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
5
votes
2answers
4k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
5
votes
2answers
2k views

Preventing access to TTY when X is killed

Assume I start an X server manually from a virtual console /dev/tty1 with xinit or startx, with the line id:3:initdefault: set in /etc/inittab. The X server gets run and put on another virtual ...
5
votes
2answers
99 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
5
votes
4answers
4k views

Force Firefox to remember passwords on particular sites

Usually, when I log into a website with username and password, Firefox asks whether it should remember the login details. When I click yes, next time I visit the website, the username and password ...
5
votes
3answers
1k views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
5
votes
2answers
535 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
5
votes
3answers
324 views

Effectivity of shred on different file systems

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
5
votes
1answer
986 views

SSH Public key comment separator

I've created a SSH authentication key (with ssh-keygen) in two different servers, both with a useful comment, but the public key of one server has == between the key and the comment, while the other ...
5
votes
1answer
6k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
5
votes
2answers
479 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
5
votes
1answer
111 views

Is it safe for my ssh user to be given passwordless sudo for `apt-get update` and `apt-get upgrade`?

I have an SSH standard user account on my personal server, and it has sudo access (via its password). I ssh in using a public key, so I don't have to type in the account password to log in. Is it ...
5
votes
1answer
711 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
5
votes
3answers
293 views

Are sudo and gksudo safe?

I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes). Now let's ...
5
votes
1answer
285 views

How does having /dev/fd make running shell scripts under sudo safe?

At the end of the man page for sudo, there's the following remark: Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems ...
5
votes
2answers
931 views

How to disable login for an user?

My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be ...
5
votes
1answer
335 views

Automated ssh login with passphrase?

Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine ...
5
votes
1answer
275 views

How can I find a Ubuntu package to use with Amazon EC2?

I'm looking to set up a new server on Amazon's EC2 and I wanted to use Ubuntu 11.04 is it is fairly new but not too new. I previously used 10.10 which I think is also very stable and time-tested. My ...
5
votes
1answer
828 views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
5
votes
1answer
410 views

SSH tunnel with VNC?

In theory: I have a low-power consuption machine: eee pc, ok. I need to run a virtualized windows xp on it. (Because of a windows-only program..) I need to reach it from a smartphone (Android). The ...
5
votes
1answer
108 views

Why does visudo discourage other editors?

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables. It states that "There is no easy way to prevent a user from gaining a root shell if the editor ...
5
votes
1answer
2k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
5
votes
2answers
2k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
5
votes
1answer
46 views

Find out which kernel source files were used when kernel was compiled

I am compiling the Linux kernel for my specific hardware and I only select the drivers/options which I really need. This is in contrast to a typical distribution kernel, where they compile almost ...
5
votes
1answer
184 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
5
votes
1answer
2k views

Using LDAP for authentication, how can I safely disable/deactivate an account without deleting it?

We use LDAP for authentication for thousands of users. The primary tactic we have been employing to make a user unable to login, without removing their account, is to change the LDAP attribute ...
5
votes
2answers
2k views

Setting ulimit correctly for PHP on Linux

I have /etc/security/limits.conf set to the following: nobody soft nofile 409600 nobody hard nofile 1024000 phpuser soft nofile 409600 phpuser hard nofile 1024000 httpd soft nofile 409600 httpd hard ...
5
votes
3answers
269 views

Creating linux distro for use during exam

I'm thinking about creating a liveCD having some linux on it. The distro (let's call it Exam OS) is meant to be used by students during an exam and should be, at least, unpleasent to bypass. Let's ...
5
votes
3answers
693 views

Why does time/ident/daytime/comsat run after an OpenBSD 5.2 install?

I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd". After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output: Why does so ...
5
votes
2answers
2k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
5
votes
1answer
194 views

How do I know which files will be included in a linux kernel before I build it?

I am working on a project that includes building an old kernel version of linux. This is fine, but I still need to patch the kernel of all previously found security vulnerabilities based on CVEs. I ...
5
votes
1answer
120 views

Sterilize PDF files

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious ...
5
votes
1answer
774 views

Save password in bash script for multiple queries

I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be ...
5
votes
1answer
395 views

Secure access to remote SSH tunnel

So I wish to be able to access my Raspberry Pi (which I keep at home behind a firewall) remotely. One option is to use a static IP address, but as a poor student I don't want to fork out for one, and ...
5
votes
1answer
703 views

Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?

I've been looking for this for quite a while now but couldn't find a satisfying answer. My scenario: I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
5
votes
1answer
770 views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...