Questions tagged [security]
Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.
2,661
questions
1
vote
1
answer
2k
views
After disabling weak ssh ciphers I cannot ssh in at all
My goal is to disable weak ssh ciphers on a linux machine (specifically Lubuntu 14.10--yes, old, there are hardware compatibility reasons that it cannot be changed right now).
First thing, I checked ...
1
vote
0
answers
21
views
Handling the putty SSH Warning Potential Security Breach (changed host key)
Scenario:
Linux server, allowing users to connect via SSH using the putty-0.80.exe ssh client on Windows 10.
Work environment, 100+ users mostly NOT computer savvy
Linux Server updated from Redhat-7 ...
5
votes
4
answers
3k
views
From a security standpoint, why should unused software be deleted? [closed]
I read the Wikipedia article on Unix security and the first sentence under "services" used to say that unused software should be deleted. I could not think of a reason, can you help me?
0
votes
0
answers
23
views
How to set up 'git push remote master' to automatically update files on production web server?
I have my website running on a remote server with gunicorn/nginx. The nginx runs from /var/www directory and its owned by root:www-data
drwxrwxr-x 5 root www-data 4096 Apr 8 17:32 www
I also ...
0
votes
1
answer
28
views
Why do some repositories configured in /etc/apt/sources.list.d/ not have a signed-by= set? - Is that a problem?
Most third-party repositories configured in /etc/apt/sources.list.d have a signing key configured like this for example: deb [signed-by=/etc/apt/keyrings/lutris.gpg] https://.
However, some like the ...
1
vote
2
answers
2k
views
Debian Bullseye - Disable Console TTY Login for Root
how does one restrict logging into the TTY consoles as 'root' in Debian 11 (bullseye)? In past versions I would empty the contents of /etc/securetty and that would prevent a direct login as 'root' ...
1
vote
1
answer
3k
views
Rocky Linux 9 not accepting SFTP connections from old Dreamweaver version (no matching host key type found. Their offer: ssh-rsa,ssh-dss)
Running Rocky Linux 9 on server and I am trying to connect by password, not by key...
It works when connecting with Putty on port 22, but when I try to connect with an old Dreamweaver version, ...
1
vote
1
answer
420
views
How to get a working clock on Debian? Clock is off by a couple minutes (time accuracy)
How to get a working clock in Debian 9 with KDE? My clock is almost 10 minutes slow on multiple of my machines running Debian 9 with KDE and (re)setting the timezone via tzselect didn't work.
(I ...
30
votes
2
answers
31k
views
Where to find logs/information about unattended-upgrades (apt)?
Where can I find infos about when the unattend updates/upgrades run and what ist done (or IF something was done)?
I want to enable the unattended-upgrades (for security updates) on a debian virtual ...
0
votes
1
answer
45
views
LUKS encryption: Hide disk unlock target on boot
I would like to hide the device name of the LUKS-encrypted disk that is supposed to be unlocked during boot on Kali Purple.
Currently whenever I boot my system there is a password prompt and below a ...
0
votes
1
answer
40
views
Are all packages necessarily reproducible on GUIX?
By default, what will happen if I try to install a package with GUIX and it's not bit-for-bit reproducible?
I'm very concerned about the state of package managers in 2024 (and the risks of supply ...
3
votes
2
answers
111
views
Is it possible to find out when a user changed their password?
Or to see which user caused the security notice that /etc/spwd.db was changed?
4
votes
1
answer
3k
views
firewalld port still open after removing port and services
I have created a script to install and configured firewalld on Centos 7.
Most of the rules have worked correctly, but the SSH port still shows as Open when running a nmap scan. I know this is not a ...
0
votes
1
answer
14
views
Safety of thunderbird credentials with Firefox and websites with file-browsing scripts on Linux
I'd like to set up an instance of Thunderbird on a Fedora VM (with a VPN). I want it to use ONLY an alias I have set up with the email providers.
But I will still have to use my real credentials to ...
0
votes
0
answers
17
views
dm-verity: development flag to allow changes
I have two partitions; on for the root file system and one for my application. I've set up dm-verity for the rootfs, but not for the appfs. Sometime I want to add something to the rootfs without ...
9
votes
1
answer
3k
views
gdm greeter configuration: Exclude all *except* for one specific user
I have Googled this one and tried so many combinations, with no success.
I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
1
vote
1
answer
2k
views
GUFW or Firestarter in Fedora
Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
1
vote
0
answers
71
views
Two users logged in when connected to internet
I am on Debian 12.5.
I am worried, because on my system I always see two users logged in immediately after I enable internet connection! Otherwise I can only see one user logged in.
Could this be a ...
4
votes
1
answer
360
views
Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?
My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
0
votes
2
answers
26
views
pkexec asking for password multiple times
I have an application foo that starts other applications
(bar and baz) under the hood.
I start foo using pkexec
and I have written a policy file for foo with:
<allow_any>yes</allow_any>
&...
0
votes
0
answers
25
views
Does bash explicitly allow commands like passwd, su, etc., to run in setuid while disabling other custom binaries? [duplicate]
I know that /bin/bash has certain built-in protections that prevent the abuse of the Set-UID mechanism. So if I create a custom binary and execute it, it won't run with SUID 0 (refer the below image). ...
0
votes
1
answer
28
views
Error when rebuilding SELinux policy after adding rule to type enforcement (.te) file
I am going through this guide which allows me to create a custom SELinux policy for an application and restrict unconfined access to the kernel system files.
On Step 9, I need to add a rule to the ...
1
vote
1
answer
45
views
Permission denied when opening a file in gdb
I'm implementing some CTF challenges. The flags are in some text files, that get read from the programs. To protect the flags I have changed the owner of the files, but have set the setuid to the ...
45
votes
2
answers
62k
views
Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2
My wpa_supplicant.conf looks like this:
network={
ssid="Some name"
scan_ssid=1
key_mgmt=WPA-EAP
eap=PEAP
identity="my-user-id"
password="(clear text password here)"
ca_cert="/usr/share/...
1
vote
2
answers
427
views
why there is no output of lsattr and how to resolve it
The normal output of lsattr is below
# lsattr /etc/fstab
---------------- /etc/fstab
but I have a host ,when I run lsattr, there is no output display to me, just like below.
my os version is centos ...
1
vote
1
answer
4k
views
How to implement security profiles during installation of CentOS 8?
I am new to the Linux environment and I found CentOS to be a stable and secure operating system. I do not have much knowledge about the security profiles and how well do they protect the operating ...
0
votes
2
answers
81
views
Run shellcode as root in a buffer overflow attack?
I'm trying to exploit the following code:
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv){
char buffer[100];
strcpy(buffer, argv[1]);
return 0;
}
with ...
0
votes
1
answer
54
views
Is a MITM attack possible in this scenario?
OS is Debian. Imagine I have my own apt repo set up inside a private network.
This repo is set up to provide a single package to other servers on this network.
I can easily create a signing key for my ...
3
votes
2
answers
2k
views
Any better alternative to chroot on an OpenVZ VPS?
Are there any better alternative to chroot environment?
I'm thinking about running nginx on a jailed environment.
BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no.
(I think that prevents ...
1
vote
1
answer
3k
views
Failed NVMe M.2 SSD, broken filesystem, unwriteable; can I wipe it anyway?
My Samsung 970 EVO M.2 500GB SSD (MZ-V7E500BW) suddenly failed yesterday during a power outage.
I now have a warning during POST ("WARNING! Please back up your data and replace your hard disk ...
0
votes
0
answers
16
views
Identification of processes that are not terminated by logging out
I'm trying to better understand how to terminate all undesired processes and start a Linux session fresh. By "undesired", I mean any processes left over from applications that have crashed.
...
2
votes
0
answers
35
views
Prevent process from performing network scan
On a linux 20.04 LTS, I'm trying to stop a process from entering promiscuous mode and/or from scanning my network. To be more specific, I'll have to install LsAgent from LANSWEEPER in a company's ...
25
votes
4
answers
2k
views
How to safely use gawk's -i option or @include directive?
Using gawk -i inplace some-awk-code some-file (or @include "inplace" within an awk script) to edit a file in-place (or any other extension) is a security vulnerability.
Why?
How do I work ...
0
votes
1
answer
53
views
Heavy UDP/sunrpc network usage to unknown IP addresses
In the last week or so, my network monitory has indicated that my desktop computer has started periodically sending ~0.7MB/s out over my ethernet connection (eno).
I understand very little about ...
24
votes
3
answers
4k
views
How do I explicitly and safely force the use of a built-in command in bash
There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd.
However, in light of shellshock et al and ...
0
votes
1
answer
69
views
Totally Legit Signing Key <[email protected]>
I run:
gpg --list-keys
I get:
pub rsa1024 2014-01-26 [C]
<REMOVED>
uid [ unknown] Totally Legit Signing Key <[email protected]>
Can this be dangerous? What is this? ...
141
votes
8
answers
494k
views
How can I monitor all outgoing requests/connections from my machine?
My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places.
...
1
vote
0
answers
126
views
Need to fully understand 'violates PodSecurity "baseline:latest": hostPath volumes'
We have been running Kubernetes 1.13 for quite a while in onprem clusters. We're now upgrading them to 1.24.
There is one service that attempted to deploy on the new cluster that is failing with the ...
0
votes
1
answer
24
views
Detecting used API calls for an application
I need to run a proprietary C++ application under Linux and I need to understand if it contains any functions outside advertised features.
Is there a way to list all the API calls that the application ...
0
votes
0
answers
33
views
Is it possible to encrypt traffic if I have only CA certificate?
I have simple secure (I guess) Mosquitto server described in my previous question.
Client machine has no any keys or certificate installed except single ca.crt certificate file generated and taken ...
-5
votes
1
answer
65
views
What's the deal with gitlab (and github?) security? [closed]
I just wanted to raise an issue (ie. report a bug) in some software package hosted on gitlab. I have a github account, but not a gitlab one.
Whenever I log in from a new device (github), I need to &...
0
votes
2
answers
58
views
How to check permissions of a non sudoers user with full root access?
doas is a sudo-like command recently packaged in Debian 12, Ubuntu Jammy (universe) and some other Linux distros.
A non sudoers user (doasuser) can be added to /etc/doas.conf to be granted root access....
13
votes
9
answers
102k
views
Helo command rejected: need fully-qualified hostname Error
My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then
My customers get this error they can't send emails.
404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
0
votes
1
answer
2k
views
How to decapsule GRE (ERSPAN Type II) on Ubuntu 18.04 LTS?
I have an Ubunutu 18.04 LTS server that is receiving ERSPAN traffic sent from several sources.
For those not familiar with ERSPAN it uses GRE tunneling to achieve this, wrapping the original L3 ...
1
vote
1
answer
103
views
How can I read the RID of a CDRW or DVDRW on Linux?
This question is inspired by this answer on SuperUser by Proger_Cbsk.
The RID is the Recorder IDentification. It uniquely identifies the drive that wrote the CD/DVD.
What software if anything can read ...
-3
votes
1
answer
160
views
Is there a way to enforce 2FA for all users on the SSH server on the Unix PAM Subsystem?
Is there a way to enforce two-factor authentication (2FA)
for all users on the SSH server on the Unix PAM Subsystem?
0
votes
1
answer
245
views
Nessus is reporting false positives for Debian 12
We've recently added some new Debian 12 servers to our usual Centos/Rocky estate, and Nessus is scanning via ssh and is reporting critical vulns on our Debian vms.
However, the systems are patched up ...
0
votes
0
answers
35
views
GUWF and firewall malfunctioning?
I keep adding IP addresses to the built-in Linux Mint "firewall" program (which is "GUWF" relabeled "firewall") and it worked for a while ... but now it doesn't look like ...
275
votes
4
answers
52k
views
Security implications of forgetting to quote a variable in bash/POSIX shells
If you've been following unix.stackexchange.com for a while, you
should hopefully know by now that leaving a variable
unquoted in list context (as in echo $var) in Bourne/POSIX
shells (zsh being the ...
0
votes
2
answers
50
views
Setting up a particular security arrangement
I need to set up a particular security arrangement on an Oracle 8 system.
There will be some users which will be added to a unix group.
These users should not be sudoers/in the wheel group, and ...