Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

6
votes
2answers
301 views

Is there any issue to put / as a home directory of root user from security point of view?

Is there any issue to put / as a home directory of root user from security point of view instead of /root
6
votes
3answers
195 views

What bad things could happen if we don't use sudoedit?

We know it's safer* to use sudoedit, but what bad things can happen if we have the following in sudoers? Cmnd_Alias FOO = /bin/ed, /usr/bin/ed, /usr/bin/vi foouser LOCALHOST = NOPASSWD: NOEXEC: FOO ...
6
votes
4answers
4k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
6
votes
2answers
1k views

Deleting users with nologin shell

On a security audit performed on our production Linux servers , we were asked to remove nobody user if no application are using it. I checked and could see that there are no files owned by 'nobody' ...
6
votes
2answers
822 views

Why did SDF switch from NetBSD to Linux?

I personally don't have much experience, but I was reading about SDF, and at one point the article mentions that SDF migrated to Linux in 1997, but due to the large number of malicious attacks it ...
6
votes
4answers
376 views

Is it possible to use pendrive as key for Linux system

I want to give high security for my linux box. So i planed to use my pen drive as key for my linux box. How can i do it ?
6
votes
1answer
1k views

Security of an encrypted (dm-crypt & LUKS) Ubuntu 12.04 installed by somebody else?

Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation. Suppose also that I have somebody (e.g. my vendor) else set this up ...
6
votes
2answers
848 views

Is it possible (and a good idea) to do `pw lock root` on FreeBSD?

I have set up sudo on my FreeBSD server. As I now never want to log in as root anymore, I was wondering whether I should do sudo pw lock root. My questions are: Is this possible, without forever ...
6
votes
1answer
2k views

Monitoring filesystem activity

Say, I have a program, and I want to monitor its filesystem activity (what files/directories are created/modified/deleted etc.) This program may be capable of spawning further processes, and thus, I ...
6
votes
3answers
533 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
2answers
290 views

Lock some accounts during some time periods

Is it possible to lock some accounts in order to be accessible only during specific time periods? For instance the account joe should only be accessible during office hours.
6
votes
1answer
10k views

How to check if port forwarding is enabled?

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled. The thing that is not clear to me is this: should I ...
6
votes
1answer
620 views

Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage. Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be ...
6
votes
1answer
272 views

Does fail2ban offer any additional protection to SSH if password login is already turned off?

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions. The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
6
votes
1answer
2k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
6
votes
3answers
2k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
6
votes
2answers
236 views

Why does password prompt lag slightly after typing the username in tty?

I have this kind of behavior and I don't know how to fix it or even how to search a fix for it since I don't know how would I even call it. Here's what's happening: The first time I boot, when I ...
6
votes
4answers
718 views

How to log into database via script securely?

I am wondering about whether it is acceptable (security-wise) to have database login credentials (user/pass) set in an environment variable or passed in as a command-line parameter? Both of these ...
6
votes
3answers
4k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
6
votes
2answers
765 views

Can a user brute-force a directory listing without having read permission on the directory?

I noticed that when a user is working in a directory to which he does not have read permission that using cd produces different error messages, depending on whether or not a subdirectory exists: $ ls ...
6
votes
1answer
894 views

/etc/passwd sql with bash access

I just got a CentOS VPS and was reviewing the passwd file and saw this: mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash Is bash necessary for mysql?
6
votes
2answers
1k views

Optimize performance for encrypted disk

Recently I tried to copy 200GB to a 1TB external / USB2 / encrypted disk and it took 36 hours. The same copy when the disk was not encrypted took no longer than 1 hour. I am using dm-crypt (LUKS) ...
6
votes
2answers
2k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that ...
6
votes
1answer
2k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
6
votes
1answer
59 views

Can someone give an example as to why I'd want to induce a kernel panic using auditd?

We recently implemented some auditd rules in response to an external security audit. My colleague offered some input on them and suggested adding -f 2 to /etc/audit.rules. I can't think of an instance ...
6
votes
1answer
286 views

How safe is sudo when running from root to run an application as a less privileged user?

Lets say I am logged in at a root terminal and I run something like the following command: sudo -u '#1000' dbus-launch chromium Are there any potential security issues I should be worried about? ...
6
votes
1answer
1k views

Save password in bash script for multiple queries

I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be ...
6
votes
1answer
1k views

What are EXT4 Security Labels?

During Gentoo installation of Gnome keyring, I am told to switch on EXT4 Security Labels, which is described in the kernel documentation by: Security labels support alternative access control ...
6
votes
2answers
224 views

Linux graphical password dialog trick security

When we run a command by sudo, the password is asked [sudo] password for user If the sudo is not typed the password should not be asked. If asked, I would assume it as a fraud by the application. ...
6
votes
1answer
136 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
6
votes
1answer
381 views

Any random password results in successful login on tty

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type... I tried to reset password for ...
6
votes
2answers
2k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
5
votes
6answers
721 views

What is the threat of a user trying to sudo without permission?

I was sshing into a certain computing system that I use. I was trying to follow some Linux instructions that involved sudo, and tried a few times to enter the password unsuccessfully, before realizing ...
5
votes
4answers
1k views

How sudo/root-ness detection works

Programs that make changes system-wide require sudo unless I am already the root user. Now, the question is: how exactly does the system figure out that I am (not) root? Does it: Check to see if ...
5
votes
3answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
5
votes
2answers
501 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
5
votes
2answers
3k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem someUser@1.2.3.4:~/files.tgz . Warning: ...
5
votes
1answer
599 views

Linux Server Hacked

I received e-mails from Google saying that my websites are hacked. This is the e-mail. Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently ...
5
votes
4answers
10k views

File permission execute only

How can I set file to be executable only to other users but not readable/writable, the reason for this I'm executing something with my username but I don't want to give out the password. I tried : ...
5
votes
2answers
884 views

make a 2nd root?

I was thinking, maybe i'd like to disable passwords for the root user and only use keys to log in. and if i need to login without keys have a 2nd user that is like root in everyway except has a ...
5
votes
1answer
2k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
5
votes
3answers
401 views

Preventing binary planting attacks in Linux

If a user account on a Linux machine is compromised, clearly, all files owned by that user are compromised. Unfortunately, if the compromised user also has sudo privileges, it seems that binary ...
5
votes
3answers
2k views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
5
votes
2answers
586 views

Writing a “telnet server” type program that uses SSH instead of telnet

So people have written server programs using telnet in which the user simply does telnet server.com and this connects them to the server program, which then provides them with a textual program they ...
5
votes
2answers
127 views

Is it more dangerous to connect to the net as root?

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user? I have been suspecting for a while that by making a connection as ...
5
votes
5answers
27k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
5
votes
3answers
7k views

what is OS hardening in linux or unix?

The term OS hardening itself is misleading/vague to me as i am reading to understand it online here. It seems to me that its something related to making linux/unix box more secure.
5
votes
3answers
217 views

I'm moving up from managed hosting to a VPS. What do I need to know?

I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux and I'm not afraid of ...
5
votes
3answers
527 views

Unix users, groups, and permissions

I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?
5
votes
3answers
3k views

How to clear terminal after logging out?

Currently on my laptop when I log out I can still see traces of my last activities (in tty). How can I tell it (Gentoo) to clear the screen before logging out?