Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

-1
votes
2answers
25 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
38 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...
6
votes
7answers
298 views

File protection in Unix

Is there a way to protect a file in such a way that even root cannot delete it or rewrite it after creating it? I have a file which is created by root under /var/log/ and I want to restrict all users ...
2
votes
2answers
717 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
2
votes
0answers
20 views

how to prevent procmail listening to the world [closed]

This is part of a larger effort to try and ensure my server is not infected and spamming the internet with spam emails I had a friend take a look at the server and he said "Your procmail is open to ...
10
votes
2answers
3k views

Test whether Linux binary is compiled as position independent code

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization ...
7
votes
1answer
112 views

Blocking SSH Brute Force attacks on IPv6

I recently had to work with some servers that have an IPv6 connection and I was surprised to find out that fail2ban does not have IPv6 support, neither does denyhosts. Searching on google I found that ...
2
votes
1answer
37 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
1
vote
0answers
16 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I have stucked up on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting ...
5
votes
2answers
66 views

Why does password prompt lag slightly after typing the username in tty?

I have a this kind of behavior & I don't know how to fix it or even how to search a fix for it since I don't know how would I even call it. Here's what's happening: The first time I boot, when I ...
1
vote
1answer
881 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
3
votes
1answer
32 views

security model of Linux password entry

Whenever a Windows application wants to do something requiring administrator privileges, my screen goes black and a prompt comes up, asking if I want to grant administrator privileges. I understand ...
1
vote
0answers
15 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...
-2
votes
2answers
45 views

How to prevent selected users from using “newgrp” with a password

I'd like to know how can I avoid add some users to a group? I need to avoid some users join to a group --I want to lock a group from some users, not all. Details lgroupmod -L dba ==> This ...
8
votes
2answers
5k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
0
votes
1answer
284 views

rkhunter warnings about a script and a hidden directory

When I run a scan with rkhunter I get 2 warnings. I checked the log file and warnings are as the following: Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...
0
votes
1answer
112 views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
0
votes
1answer
71 views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
1
vote
3answers
697 views

Check that fail2ban is running?

I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is ...
1
vote
2answers
35 views

eCryptFS and FIPS 140-2

I've searched high and low for information on whether eCryptFS encryption is FIPS 140-2 compliant. I've found information on other filesystem or block encryption and their FIPS compliance I presume ...
5
votes
1answer
640 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
1
vote
1answer
635 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
0
votes
1answer
3k views

fopen: $JOHN/dynamic.conf: No such file or directory

I have an unshadowed db.txt file: [root@SERVER ~]# rpm -qa | grep -i john john-1.7.9-1.el6.rf.x86_64 [root@SERVER ~]# head -1 /etc/issue Scientific Linux release 6.3 (Carbon) [root@SERVER ~]# cat ...
2
votes
1answer
50 views

Things to check after a untrusted USB device was mounted

Suppose you plugged an untrusted usb-stick into your linux machine (as user) and browsed and copied some files, perhaps using a graphical interface. After the usb-stick is removed (and not available ...
52
votes
3answers
13k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
8
votes
3answers
345 views

Trap: can't su as root, can't change group to wheel, ssh as root prohibited

Is this a trap? I made these steps in FreeBSD 10: 1) ssh as root prohibited 2) logged as user 3) su as root 4) as root chsh changed name of user "user" to "luser" 5) exit from ...
3
votes
1answer
98 views

OS X FileVault 2 duress password

I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after ...
54
votes
2answers
2k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
0
votes
1answer
34 views

How can I configure my server to avoid information leakage from the SERVER header of its HTTP response

I have a centos 7 server with apache v2.4.6 php 5.4.16 and OpenSSL 1.0.1e-fips installed. I was just doing a scan to it to see how secure my server is. I found out that my server is giving out ...
1
vote
6answers
229 views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
0
votes
1answer
25 views

Strange commands on FTP logs

I'm battling with wordpress security problems and sometimes even I have tried everything my server sends spam by some hacker. I have checked my FTP log and I found this code ...
1
vote
1answer
41 views

How the kernel can prevent a malicious program to operate?

If I write an x86 assembly program that tries to fetch and analyse all the addressable memory space. How the kernel can prevent this operation to be done? I am more familiar with small CPU ...
21
votes
4answers
64k views

SSH login with clear text password as a parameter?

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I won't have access to ...
2
votes
2answers
1k views

AIX 6.1 — Without root can I get the last failed login for a user i have access to?

I know the information is in the security files but I don't have access and it's more work then I want to do to go to our Unix admins to get the information (everytime the account gets locked which is ...
0
votes
0answers
18 views

How to access boot: invite?

I'd like to simply try a root pawd reset, by entering linux single whan systems display boot: when booting. But my Mint system goes directly to user home prompt. Tks
4
votes
5answers
20k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
1
vote
2answers
38 views

Prevent certain lines of a script to run as root

Suppose I am writing a shell script that requires root privileges to run, for example- #!/bin/sh ip -s -s neigh flush all ufw enable How can I prevent certain lines of code to be run as root, i.e. ...
1
vote
1answer
30 views

How to trap an event when a file with a specific content (given by e.g. checksum) was created on the local file system?

I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by ...
14
votes
3answers
7k views

How should one set up full-disk encryption on OpenBSD?

Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux? I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...
0
votes
0answers
21 views

Encrypt some folder and hide key in Linux

I work on a Debian system (Mint actually). I'd like to encrypt some folders and files, for instance: the one with OpenVPN configuration and keys, and be able to decrypt it on the fly. My problem: ...
2
votes
1answer
77 views

How to safely transmit a password over SSH for a remote command to use

On the local server, I have a program that stores the password in the predefined environment variable (SPECIAL_PASSWORD). On the remote server I have a program that reads and uses a password from a ...
5
votes
1answer
275 views

SELinux is preventing /opt/google/chrome/nacl_helper from getattr access on the file /etc/passwd

Is this a bug or a real security concern? It appears to have been discussed but I still don't understand why this is happening and what is being done to address the root cause (I am not going to ...
1
vote
3answers
319 views

how to record all who that login to my linux machines and records them

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine yum install audit kit installation from: ...
2
votes
2answers
33 views

How can I set up a secure LAMP stack on CentOS?

I have been using linux for years, but I need some clarification on what are probably pretty basic principles to how the OS works, but I definitely need clarification due to security concerns. I am ...
12
votes
3answers
27k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
42
votes
4answers
7k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
2
votes
1answer
68 views

How to Mark Traffic using IPtables?

I'm trying to mark traffic, How shall I write following code in terms of IPtables? /ip firewall mangle> add chain=prerouting src-address=10.1.1.1/32 action=mark-connection \ ...
2
votes
1answer
35 views

What is the difference between the FreeBSD flags, immutable and unlink?

What are the differences or similarities among the FreeBSD flags, simmutable/uimmutable and sunlink/uunlink? Reading man chflags, I see these flags: schg, schange, simmutable set the system ...
1
vote
4answers
14k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
1
vote
0answers
58 views

nmap doesn't detect opened port [closed]

I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and I can get connected as well with the telnet ...