Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

5
votes
1answer
240 views

Secure access to remote SSH tunnel

So I wish to be able to access my Raspberry Pi (which I keep at home behind a firewall) remotely. One option is to use a static IP address, but as a poor student I don't want to fork out for one, and ...
5
votes
1answer
593 views

Ubuntu: If anyone can get a root prompt without password, isn't that compromising the gnome keyring?

I've been looking for this for quite a while now but couldn't find a satisfying answer. My scenario: I'm using encfs to encrypt a few directories in my home folder. To make it easier to access I set ...
5
votes
1answer
602 views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...
5
votes
1answer
3k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
5
votes
4answers
472 views

Allowing rename but not moving to other directory

Users can upload/delete/rename files via vsftp server and everything works well except they can also move files across directories. Is it possible to allow renaming of files but disallow moving them ...
5
votes
1answer
989 views

Which home directory should 'nobody' have?

I'm messing around with Tiger security audits on my CentOS box, ensuring the server is fit for being online, well as close as it can get anyway. I noticed a warning about the user nobody having / as ...
5
votes
1answer
174 views

OpenBSD and limiting login to local only like in FreeBSD's login.access(5)

I am using OpenBSD as my desktop. I don't want to login to my machine remotely, and I don't want anyone else to login remotely. In FreeBSD there is a file called login.access(5) that can be used to ...
5
votes
2answers
1k views

Can KWallet manage my ssh passwords?

I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill ...
5
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
5
votes
0answers
76 views

Does Android's implementation of SELinux's M.A.C. inhibit root apps with root privileges from accessing app data? [closed]

Starting with Android 4.4 SELinux's MAC is enforced. Does this mean that if an app somehow can get installed and exploit the kernel to get root privileges, that MAC will still prevent that app with ...
5
votes
1answer
60 views

Can swap be encrypted per user?

The problem arises for a multiuser computer with encrypted swap, as to how to allow each user to hibernate and resume from hibernation without compromising the security of the other users. I'm ...
5
votes
1answer
282 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
5
votes
1answer
36 views

Need More Information About KDE Job Notification

I installed Debian 7.2 on a new laptop a couple of days ago, and now I'm getting a strange job notification every once in a while. It just says the following: Source: ...
4
votes
3answers
1k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
4
votes
2answers
329 views

What does “Do you expect to run the X Windows System?” do when installing OpenBSD?

When installing OpenBSD 5.1, I got the question: Do you expect to run the X Windows System? What change does the installer make to my system if I say "yes"? I know what X Windows is, but I don't ...
4
votes
2answers
191 views

Why rejection of password is much slower than acceptance of it? [duplicate]

In both my Linux and OSX machines when I type in the password to login, a correct password is accepted immediately. However, if I type a wrong password, checking process takes much longer. How is ...
4
votes
3answers
527 views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
4
votes
2answers
3k views

How do you protect a plain text credentials file with the username and password?

I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass. [not recommended] put the ...
4
votes
5answers
156 views

Hiding work in account with multiple users

I'm currently working on an assignment in a cluster programming class. The class has been given an account on the cluster, so we can ssh in and do our work. The problem is that the one account is ...
4
votes
4answers
336 views

SSH to untrusted machine

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
4
votes
3answers
386 views

Something like pwgen-win for linux?

Is there some kind of pwd generator for Linux that has a nice GUI and options like this one for Windows? I know that there is pwgen, but as far as I know it does not support mouse/keyboard entropy and ...
4
votes
2answers
675 views

Purpose of using setuid() in SUID programs

I wonder that an SUID program like passwd is using the setuid() function call. Why does it drop root privileges? Against what types of attack does this help? Buffer-overflow?
4
votes
1answer
232 views

What's the best way to configure shared filesystem directories? (beyond standard unix perms)

I have multiple users on my system. I'd like to have shared directories like music, video. pictures etc. The problems is that I want users to be able to write any new files to any directory, but not ...
4
votes
2answers
206 views

Finding the logs in a hacked server. [closed]

My server has been hacked and the hacker managed to ssh as root (I know, horrible mistake on my part). What files should I be looking for to discover the origin of the attack? (At least their IP). ...
4
votes
3answers
553 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
4
votes
1answer
1k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
4
votes
2answers
2k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
4
votes
3answers
797 views

Running Viber as another user while using “mine” X Server's microphine and speakers

I run Fedora with GNOME and recently installed Viber for linux. It's very good and all is working just fine. As Viber is not open-source software, I decided to run it as another user to make sure ...
4
votes
2answers
393 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
4
votes
2answers
102 views

Fully seperate two accounts without installing seperate operating systems?

Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install ...
4
votes
3answers
1k views

Is it impossible to run as `root` if the machine isn't rooted?

By default, the user of the device does not have access to certain root objects (e.g. the /data directory). Even though these objects are off-limits, however, it would seem to me that these objects ...
4
votes
6answers
464 views

Any program like `sudo` to gain root by having two users enter a password?

I run a server which is used by a group of individuals for e-mail, mailing lists, personal web homes etc. I thought about ways to provide root access for other members to allow them handling problems ...
4
votes
1answer
149 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
4
votes
2answers
110 views

What are the methods to protect home folder files from other applications runing as the same user?

I would like to enforce the security access of some files in my Home folder. My concern is about processes running with the same privileges as me having access to those files. I've been wondering ...
4
votes
1answer
404 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
4
votes
1answer
655 views

How can I secure my Ubuntu 13.04 to prevent network attacks? [closed]

Is there a way I could protect my pc computer from being hacked in an event where the internet conection will be opened? Thing is I am going to Campus Party Colombia 2013 and I was sugested to format ...
4
votes
3answers
1k views

Why is PATH reset in a sudo command?

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH ...
4
votes
1answer
2k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
4
votes
2answers
150 views

Linux Kernel limit access to root with a button?

Is it possible to limit the access to a root account from within the kernel? I mean that if I press a button then the system detects the button being pressed and then allows access to the root ...
4
votes
1answer
114 views

Are there any security risks when mounting as root?

Are there any security related risks when mounting with root privileges compared to mounting with regular users? I have a script which does some ecryptfs mounting with non-root privileges (by design), ...
4
votes
2answers
6k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
4
votes
3answers
198 views

Can someone execute a malware by just inserting a flash disk?

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any ...
4
votes
3answers
433 views

Is a command's stdout to the terminal being logged?

I am interested in learning whether a command's output to the terminal is logged somewhere. Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
4
votes
2answers
258 views

Shredding everything: files/folders and corresponding filenames

Using find, it is easy to shred a directory's contents recursively (as discussed in this question). However, sometimes the filenames on their own carry sensitive information already. Is there a way to ...
4
votes
3answers
291 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
3answers
245 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...
4
votes
3answers
4k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
4
votes
1answer
44 views

Preserve evidence of intrusion / deleted executable?

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, ...
4
votes
3answers
89 views

How to securely delete a directory without leaving a trace?

I already know that using shred will overwrite my files in such a way that leaves them unrecoverable. However shred can't be used to hide directories. Error Message: failed to open for writing: ...
4
votes
1answer
364 views

STIG (Security Technical Implementation Guides) automation

Has anyone here found the best way to STIG a version of RHEL 6.x automatically? The other answers I have found are either out of date or do not completely STIG the machine. Even an image that has a ...