Content related to computer security.

learn more… | top users | synonyms

4
votes
3answers
239 views

Linux executable sandboxing?

I'm running a service that allows users to submit code which is compiled and executed on the server. At the moment I'm using Moe and while it works fine for C and C++ code, I've been having some ...
4
votes
3answers
223 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...
4
votes
2answers
68 views

What are the methods to protect home folder files from other applications runing as the same user?

I would like to enforce the security access of some files in my Home folder. My concern is about processes running with the same privileges as me having access to those files. I've been wondering ...
4
votes
3answers
127 views

restrict student account permissions, give faculty access

I have set up two user groups, students and faculty on Ubuntu 12.04 and created a number of students and faculty accounts. The problem is a student can currently see & read all of the files of a ...
4
votes
1answer
59 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
4
votes
2answers
377 views

How to identify a process which has no pid?

I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid : netstat -antlp | grep 45136 tcp 0 0 ...
4
votes
1answer
51 views

TCP wrapper “except” option

I configured the /etc/hosts.allow at the machine 192.168.122.50 with the following option. sshd : ALL EXCEPT 192.168.122.1 and tried ssh root@192.168.122.50 from the machine 192.168.122.1 and I was ...
4
votes
2answers
2k views

How to find out out WHEN an user account was locked

With passwd -S user_name one can find out, if an account is locked, but is there a way to find out when it was locked and who it locked? Further links: http://serverfault.com/a/485760/78439 Disable ...
4
votes
2answers
780 views

Arch: Is “SigLevel = Never” the only convenient way?

The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf. Its not supposed to be the right way, but I don't seem to be able ...
4
votes
1answer
1k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
4
votes
2answers
1k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
4
votes
1answer
104 views

Is there any point in using `sudo` when you are the sole user of your machine?

I'd like to know if there is any reason why I should use sudo instead of su, taking into account that I am the owner and sole user of my machine (and hence have root access whenever I want). Also, in ...
4
votes
2answers
99 views

Is there something like one-time sudo?

Is there a way to have a one-time sudo account? My use-case is the following. I have an Ubuntu station with no remote ssh allowed to that machine. The machine generally serves as a public-use ...
4
votes
2answers
151 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
4
votes
2answers
1k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
4
votes
6answers
412 views

Any program like `sudo` to gain root by having two users enter a password?

I run a server which is used by a group of individuals for e-mail, mailing lists, personal web homes etc. I thought about ways to provide root access for other members to allow them handling problems ...
4
votes
1answer
781 views

Linux - why is kernel.shmall so low by default?

I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments. This page is typical of the info that I've found about shmall/shmmax: ...
4
votes
1answer
47 views

What is not accessible from userspace?

I read somewhere (3.1.3) that there's a high ring (supervisor mode) and a low ring (user mode) and that some "things" can be run only from the highest ring. What do they mean by "things"? I'd guess ...
4
votes
1answer
415 views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...
4
votes
1answer
823 views

How to configure permissions to allow apache to securely have access to a file in a shared environment?

This is a follow up question from my previous, but I felt it might be more Linux based. http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file ...
4
votes
2answers
495 views

How to set secure permissions for multiple users and multiple websites?

On a Gentoo 3.2.12 server with apache2+php, there are several websites running: /www /website1 /website2 ...etc The apache user should have read-only access to all the websites. There ...
4
votes
1answer
2k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
4
votes
1answer
131 views

Mount and automount and security problems

Are there any security problems related with (auto)mounting device?
4
votes
1answer
174 views

How do I know which files will be included in a linux kernel before I build it?

I am working on a project that includes building an old kernel version of linux. This is fine, but I still need to patch the kernel of all previously found security vulnerabilities based on CVEs. I ...
4
votes
1answer
1k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
4
votes
1answer
80 views

Where are passwords stored and how are they encrypted in OS X?

I know that on a Linux system passwords are stored in /etc/shadow and are salted and encrypted using a one way hashing algorithm like MD5, SHA-256 or SHA-512. It looks like there is no /etc/shadow ...
4
votes
3answers
820 views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
4
votes
1answer
239 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
4
votes
2answers
3k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
4
votes
1answer
115 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
4
votes
1answer
87 views

Tomoyo Linux: Have a private folder, that can't be read by default

Is it possible to specify folders, eg: /home/$user/private that can not be listed, read or written to by any application in the default profile 0, but only with programs where I specify this as ...
4
votes
1answer
150 views

Why Nmap fragmented scan on Linux is only working from virtual environment?

OLD QUESTION AND TITLE (Look further down for the updated question): Why Nmap fragmented scan is only working on Backtrack? I spent quite a few hours today trying to capture and study some ...
4
votes
2answers
257 views

How to lock a directory?

I want to block any kind of access to a certain directory unless a password is provided. It could be my root or account password. The directory is residing on an NTFS partition, and this method needs ...
3
votes
3answers
257 views

Securely feeding a program with a password

After understanding the problem with using a password in the command line, I need to find a way of feeding a program with a password without it being a problem (without the password being recorded ...
3
votes
4answers
206 views

Internet SSH Server Security Considerations

What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?
3
votes
3answers
281 views

True HTTPS? How?

/Using Google Chrome/ if i visit: https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg then the: ...
3
votes
5answers
351 views

Protect folder from sudoers

Is there an ability to not allow sudoers view your folder (only you and root can access folder)?
3
votes
3answers
274 views

Setting execution right to whole directory - is it good or bad idea?

I have a zip file containing lot of files and directories for a certain application which should be running on Linux. Some files needs to be set as executable, but the zip file format afaik does not ...
3
votes
2answers
1k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
3
votes
3answers
545 views

Is encrypting your web browsing via SSH to localhost useful?

For example, if I did an ssh -X to localhost and invoked Firefox, would that be enough to be considered safe browsing, like if done on some public wifi?
3
votes
4answers
2k views

File permission execute only

How can I set file to be executable only to other users but not readable/writable, the reason for this I'm executing something with my username but I don't want to give out the password. I tried : ...
3
votes
2answers
395 views

Is it possible for a CentOS system on EC2 to not have a bootloader?

I'm attempting to look for grub: [root /]# find / -iname "*grub*" /sbin/grubby /usr/share/man/man8/grubby.8.gz /usr/share/vim/vim70/syntax/grub.vim /usr/share/vim/vim70/ftplugin/grub.vim ...
3
votes
3answers
2k views

How secure is Ubuntu in Virtualbox on Windows host?

I have the most recent version of Ubuntu in Virtualbox on Windows 7 host. How secure will that be? I mean if I get malware on windows how will that affect the Ubuntu system I am working on?
3
votes
2answers
112 views

SSH when to use public key and password?

I think I understand the difference between Public Key authentication and Password. But how do I decide which one to use and which one is most secure in what situation? Can anybody give me some real ...
3
votes
3answers
311 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
3
votes
2answers
49 views

Process in user mode switch to kernel mode. Then the process will have root privileges?

According to http://www.linfo.org/kernel_mode.html in paragraph 7: When a user process runs a portion of the kernel code via a system call, the process temporarily becomes a kernel process and is ...
3
votes
1answer
82 views

Has my machine been compromised?

I have a bunch of lines in my machine if I use "ps aux". Here are the lines: samp 8413 0.0 0.0 968 564 ? S 12:28 0:00 ./ssh 150 samp 8419 0.0 0.0 956 380 ? ...
3
votes
2answers
288 views

how to know the type of symmetric encryption used by ssh?

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?. I have looked in ...
3
votes
2answers
781 views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
3
votes
1answer
286 views

Why is it a bad idea to run as root? [duplicate]

Possible Duplicate: Concern about logging in as root overrated? I often hear that it's a bad idea to use root for general use. Why is this a bad idea?