Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

6
votes
4answers
580 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
6
votes
2answers
707 views

Can a user brute-force a directory listing without having read permission on the directory?

I noticed that when a user is working in a directory to which he does not have read permission that using cd produces different error messages, depending on whether or not a subdirectory exists: $ ls ...
6
votes
1answer
840 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
6
votes
2answers
1k views

Optimize performance for encrypted disk

Recently I tried to copy 200GB to a 1TB external / USB2 / encrypted disk and it took 36 hours. The same copy when the disk was not encrypted took no longer than 1 hour. I am using dm-crypt (LUKS) ...
6
votes
1answer
2k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
6
votes
1answer
67 views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
6
votes
1answer
51 views

Can someone give an example as to why I'd want to induce a kernel panic using auditd?

We recently implemented some auditd rules in response to an external security audit. My colleague offered some input on them and suggested adding -f 2 to /etc/audit.rules. I can't think of an instance ...
6
votes
1answer
257 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
6
votes
1answer
1k views

Save password in bash script for multiple queries

I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be ...
6
votes
1answer
511 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
6
votes
2answers
189 views

Linux graphical password dialog trick security

When we run a command by sudo, the password is asked [sudo] password for user If the sudo is not typed the password should not be asked. If asked, I would assume it as a fraud by the application. ...
6
votes
1answer
130 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
6
votes
1answer
376 views

Any random password results in successful login on tty

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type... I tried to reset password for ...
6
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
5
votes
4answers
1k views

How sudo/root-ness detection works

Programs that make changes system-wide require sudo unless I am already the root user. Now, the question is: how exactly does the system figure out that I am (not) root? Does it: Check to see if ...
5
votes
3answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
5
votes
2answers
492 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
5
votes
1answer
573 views

Linux Server Hacked

I received e-mails from Google saying that my websites are hacked. This is the e-mail. Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently ...
5
votes
2answers
871 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
5
votes
3answers
383 views

Preventing binary planting attacks in Linux

If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised. Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
5
votes
4answers
9k views

File permission execute only

How can I set file to be executable only to other users but not readable/writable, the reason for this I'm executing something with my username but I don't want to give out the password. I tried : ...
5
votes
2answers
7k views

How do I disable remote root login via ssh?

How do I disable remote root login via ssh? I want to log into my server (I use keys on my main comp) then su into root instead of access root directly. I am using Debian. I follow guides online ...
5
votes
1answer
11k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
5
votes
3answers
2k views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
5
votes
5answers
2k views

Why is it recommended to create a group and user for some applications?

Most of the time, when installing a program from source it is recommended to create a new user and a new group and give /usr/local/<myapp> the recently created user and group ownership. Why is ...
5
votes
2answers
532 views

Writing a “telnet server” type program that uses SSH instead of telnet

So people have written server programs using telnet in which the user simply does telnet server.com and this connects them to the server program, which then provides them with a textual program they ...
5
votes
2answers
125 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
5
votes
1answer
1k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
5
votes
3answers
216 views

I'm moving up from managed hosting to a VPS. What do I need to know?

I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux and I'm not afraid of ...
5
votes
3answers
519 views

Unix users, groups, and permissions

I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?
5
votes
3answers
2k views

How to clear terminal after logging out?

Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?
5
votes
4answers
367 views

Is it possible to use pendrive as key for Linux system

I want to give high security for my linux box. So i planed to use my pen drive as key for my linux box. How can i do it ?
5
votes
2answers
419 views

Why ssh-agent group ownership is not root

Trying to understand why ssh-agent has sgid bit and found this post ssh-agent has sgid I have another question, why the group ownership of ssh-agent is nobody not root? What is the reason behind it? ...
5
votes
2answers
1k views

Process in user mode switch to kernel mode. Then the process will have root privileges?

According to http://www.linfo.org/kernel_mode.html in paragraph 7: When a user process runs a portion of the kernel code via a system call, the process temporarily becomes a kernel process and is ...
5
votes
7answers
514 views

Are there additional ways to protect SSH connections besides firewall and RSA Keys?

Sometimes I don't have a static IP and need to administrate my web server remotely. I'm looking for any additional layers of protection I could add to make opening port 22 safer. Currently I have ...
5
votes
2answers
6k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
5
votes
2answers
2k views

Preventing access to TTY when X is killed

Assume I start an X server manually from a virtual console /dev/tty1 with xinit or startx, with the line id:3:initdefault: set in /etc/inittab. The X server gets run and put on another virtual ...
5
votes
2answers
133 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
5
votes
4answers
5k views

Force Firefox to remember passwords on particular sites

Usually, when I log into a website with username and password, Firefox asks whether it should remember the login details. When I click yes, next time I visit the website, the username and password ...
5
votes
3answers
1k views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
5
votes
2answers
622 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
5
votes
3answers
369 views

Effectivity of shred on different file systems

man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
5
votes
1answer
1k views

SSH Public key comment separator

I've created a SSH authentication key (with ssh-keygen) in two different servers, both with a useful comment, but the public key of one server has == between the key and the comment, while the other ...
5
votes
1answer
6k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
5
votes
2answers
485 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
5
votes
1answer
190 views

Is it safe for my ssh user to be given passwordless sudo for `apt-get update` and `apt-get upgrade`?

I have an SSH standard user account on my personal server, and it has sudo access (via its password). I ssh in using a public key, so I don't have to type in the account password to log in. Is it ...
5
votes
1answer
1k views

Monitoring filesystem activity

Say, I have a program, and I want to monitor its filesystem activity (what files/directories are created/modified/deleted etc.) This program may be capable of spawning further processes, and thus, I ...
5
votes
1answer
914 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
5
votes
3answers
300 views

Are sudo and gksudo safe?

I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes). Now let's ...
5
votes
1answer
135 views

How does the kernel prevent a malicious program from reading all of physical RAM?

If I write a program that tries to read memory at every possible address, and I run it on a "full" Unix, it will not be able to access all of the physical RAM. But how does the operating system ...