Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

4
votes
2answers
144 views

Finding the logs in a hacked server. [closed]

My server has been hacked and the hacker managed to ssh as root (I know, horrible mistake on my part). What files should I be looking for to discover the origin of the attack? (At least their IP). ...
4
votes
1answer
1k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
4
votes
2answers
2k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
4
votes
2answers
452 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
4
votes
3answers
658 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
4
votes
2answers
313 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
4
votes
2answers
94 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
4
votes
3answers
870 views

Is it impossible to run as `root` if the machine isn't rooted?

By default, the user of the device does not have access to certain root objects (e.g. the /data directory). Even though these objects are off-limits, however, it would seem to me that these objects ...
4
votes
6answers
431 views

Any program like `sudo` to gain root by having two users enter a password?

I run a server which is used by a group of individuals for e-mail, mailing lists, personal web homes etc. I thought about ways to provide root access for other members to allow them handling problems ...
4
votes
2answers
1k views

rkhunter warn me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
4
votes
1answer
204 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
4
votes
1answer
440 views

How can I secure my Ubuntu 13.04 to prevent network attacks? [closed]

Is there a way I could protect my pc computer from being hacked in an event where the internet conection will be opened? Thing is I am going to Campus Party Colombia 2013 and I was sugested to format ...
4
votes
3answers
498 views

Why is PATH reset in a sudo command?

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH ...
4
votes
1answer
101 views

Are there any security risks when mounting as root?

Are there any security related risks when mounting with root privileges compared to mounting with regular users? I have a script which does some ecryptfs mounting with non-root privileges (by design), ...
4
votes
3answers
194 views

Can someone execute a malware by just inserting a flash disk?

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
4
votes
3answers
312 views

Is a command's stdout to the terminal being logged?

I am interested in learning whether a command's output to the terminal is logged somewhere. Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
4
votes
2answers
212 views

Shredding everything: files/folders and corresponding filenames

Using find, it is easy to shred a directory's contents recursively (as discussed in this question). However, sometimes the filenames on their own carry sensitive information already. Is there a way to ...
4
votes
3answers
261 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
3answers
238 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...
4
votes
1answer
72 views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...
4
votes
2answers
95 views

What are the methods to protect home folder files from other applications runing as the same user?

I would like to enforce the security access of some files in my Home folder. My concern is about processes running with the same privileges as me having access to those files. I've been wondering ...
4
votes
3answers
172 views

restrict student account permissions, give faculty access

I have set up two user groups, students and faculty on Ubuntu 12.04 and created a number of students and faculty accounts. The problem is a student can currently see & read all of the files of a ...
4
votes
1answer
71 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
4
votes
2answers
1k views

How to identify a process which has no pid?

I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid : netstat -antlp | grep 45136 tcp 0 0 ...
4
votes
1answer
61 views

TCP wrapper “except” option

I configured the /etc/hosts.allow at the machine 192.168.122.50 with the following option. sshd : ALL EXCEPT 192.168.122.1 and tried ssh root@192.168.122.50 from the machine 192.168.122.1 and I was ...
4
votes
2answers
3k views

How to find out out WHEN an user account was locked

With passwd -S user_name one can find out, if an account is locked, but is there a way to find out when it was locked and who it locked? Further links: http://serverfault.com/a/485760/78439 Disable ...
4
votes
2answers
851 views

Arch: Is “SigLevel = Never” the only convenient way?

The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf. Its not supposed to be the right way, but I don't seem to be able ...
4
votes
1answer
1k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
4
votes
1answer
131 views

Is there any point in using `sudo` when you are the sole user of your machine?

I'd like to know if there is any reason why I should use sudo instead of su, taking into account that I am the owner and sole user of my machine (and hence have root access whenever I want). Also, in ...
4
votes
2answers
126 views

Is there something like one-time sudo?

Is there a way to have a one-time sudo account? My use-case is the following. I have an Ubuntu station with no remote ssh allowed to that machine. The machine generally serves as a public-use ...
4
votes
2answers
186 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
4
votes
1answer
1k views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
4
votes
2answers
1k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
4
votes
1answer
804 views

Linux - why is kernel.shmall so low by default?

I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments. This page is typical of the info that I've found about shmall/shmmax: ...
4
votes
1answer
42 views

Why doesn't GCM HTTPS work with nginx?

Since these two are using GCM (Galois/Counter Mode): www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384 www.google.com: ECDHE-RSA-AES128-GCM-SHA256 We wanted to make our webserver's HTTPS connection ...
4
votes
1answer
92 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
4
votes
1answer
216 views

kernel: disabling /dev/kmem and /dev/mem

I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
4
votes
1answer
61 views

What is not accessible from userspace?

I read somewhere (3.1.3) that there's a high ring (supervisor mode) and a low ring (user mode) and that some "things" can be run only from the highest ring. What do they mean by "things"? I'd guess ...
4
votes
1answer
498 views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...
4
votes
1answer
349 views

Why do SELinux policies require a system restart?

When changing SELinux policies, I've been reading that you're required to restart the system. What changes would require this? Are there certain policy changes that would not require a restart?
4
votes
2answers
690 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
4
votes
1answer
134 views

Mount and automount and security problems

Are there any security problems related with (auto)mounting device?
4
votes
1answer
178 views

How do I know which files will be included in a linux kernel before I build it?

I am working on a project that includes building an old kernel version of linux. This is fine, but I still need to patch the kernel of all previously found security vulnerabilities based on CVEs. I ...
4
votes
1answer
1k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
4
votes
1answer
127 views

How can I run keychain in a way that only has the first shell prompt for keys on startup?

I open multiple shell tabs when I start KDE, and I've just added keychain to my ~/.shellrc the problem is that all the tabs prompt for key passwords when I login. This is quite annoying to do this. Is ...
4
votes
1answer
89 views

Where are passwords stored and how are they encrypted in OS X?

I know that on a Linux system passwords are stored in /etc/shadow and are salted and encrypted using a one way hashing algorithm like MD5, SHA-256 or SHA-512. It looks like there is no /etc/shadow ...
4
votes
3answers
1k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
4
votes
1answer
248 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
4
votes
2answers
4k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
4
votes
1answer
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...