Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

19
votes
7answers
91k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
0
votes
0answers
18 views

Encrypt directory on Linux

I need to create an encrypted directory (to be then filled with files and subdirectories) in a Linux ext4 filesystem, accessible to just one user. It should be: visible (just the root) from the non-...
0
votes
1answer
18 views

Unix winbind groupmap

i got Linux server (SLES 12) joined in Windows AD with winbind and samba services. I got unix group "mqm" and windows AD group "67uts-mq-admins". I want to map windows AD to unix group with "net ...
1
vote
0answers
18 views

Iptables restrict all, allow multiple specified users to destination port

This great answer tells me how to prohibit all users from connecting to remote host on specified (in this case 25) port, except one user: iptables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p ...
0
votes
2answers
2k views
0
votes
1answer
50 views

Remote docker over ssh tunnel

I have been testing docker. Due to strict firewall policy that blocks all ports except the ones necessary, I bind my docker clients to local ports and use ssh tunnels to access them remotely for the ...
4
votes
2answers
79 views

Linux root access recovery by booting on the console

This is my first question so bear with me please. So I have a concept in mind that I can't quite grasp. Very recently I recovered a root password for a Debian server by booting into single user mode. ...
0
votes
1answer
31 views

I am facing huge attack of layer 7 on port 3306 can anyone help me?

I am facing huge attack of layer 7 on port 3306 can anyone help me? my iptables rules are good too 184 9568 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ...
-7
votes
0answers
45 views

something very strange happend to my linux [closed]

i would like to ask you about a thing which is related to Ubuntu's security. I have been using ubuntu for a long time but i has never happend to me before the thing is: 2 days ago when i was ...
1
vote
0answers
44 views

Greenbone/OpenVAS not starting tasks after reboot

I have Greenbone and OpenVAS installed on a Fedora machine. Configuration was OK and everything was working fine. After a reboot every attempt to start a task results in the browser waiting forever ...
1
vote
2answers
150 views

Script samba password but securely

I want to script the addition on a samba user and the password. I have seen solutions similar to the one here Piping password to smbpasswd echo -ne "$PASS\n$PASS\n" | smbpasswd -a -s $LOGIN but ...
5
votes
1answer
1k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
1
vote
1answer
46 views

Executables in /usr/bin not showing for permissioned users [closed]

I installed xvfb-run using yum under root, and I can see the executable in /usr/bin with the permissions -rwxr-xr-x. When I login under a different usr which falls into the 'other' permissions, the ...
0
votes
1answer
2k views

What is the security impact of not using tls-remote with OpenVPN

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like ...
1
vote
2answers
477 views

SSH key for HTTP

Is it possible to set something up like SSH Keys for http traffic, so that a browser must have the matching key in order to access?
0
votes
1answer
52 views

Should virtual host files contain two <directory> directives? [closed]

We've heard that a good security practice is to reset everything in the virtual host to allow nothing, then have another directive to allow specific access - something like this: <VirtualHost *:80&...
0
votes
1answer
19 views

How to restrict restrict remote administration software to one domain name?

I currently have a server hosting a number of websites on a debian server. I understand that all my domain names share the same IP so any of them will grant me access through SSH, but I was wondering ...
1
vote
1answer
434 views

Breaking out of a docker container

Are there any security risks with allowing users to run docker and mount files he has access to? We have shared network mount where all users home directories reside and we basically don't want ...
0
votes
1answer
136 views

Calling php function from /var/www/folder (as www-user), which is located in a file in /var (or any folder) (with root permissions?)

I wrote a script which "walks" through /var/www/xyz and scans folders and more. The folders are all 'user-bound', so the permissions for a single folder there are set to the specific user. Running ...
2
votes
1answer
319 views

modsecurity rule for blocking wordpress / joomla admin login - others

I have an old rule for ModSecurity 1.x to block admin brute force attacks, and only allow them in the internal network. When I migrated to 2.x, it stopped working. Also the networking ipmatch rules ...
1
vote
1answer
389 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
2
votes
1answer
496 views

How to move the /var/www directory to a USB HDD?

I have a default OpenBSD 5.1 install. How Can I enabled httpd, OK. QUESTION: How can I use the /dev/sd0a on /mnt/usbhdd type ffs (local, nodev) instead of the default "/var/www" directory? What ...
21
votes
11answers
7k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
0
votes
1answer
13 views

Hash sum of partitions that haven't been mounted changes every time after a live usb run

I have a Live USB with puppy linux on it. Here's menu entry in Grub2 for Puppy: menuentry "Puppy Linux 6.0.5 tahrpup" { insmod ext2 search --no-floppy --fs-uuid --set=root 0641378e-...
7
votes
2answers
3k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem someUser@1.2.3.4:~/files.tgz . Warning: ...
2
votes
1answer
49 views

Possible attack against VNC Server

Recently I started to have some problems with my Linux machine. So I have this Linux VPS machine with VNC server installed and I just connect to it by using VNC viewer. Recently the VNC server/...
5
votes
0answers
96 views

Taking a picture with a laptop webcam after entering an incorrect password

I'd like to set up my laptop so that if a wrong password is entered when the screen is locked, a picture is taken using the laptop's webcam. I examined xlock (from xlockmore package), but there is no ...
4
votes
1answer
762 views

In my secure log there is a new group added that I'm unsure about after adding semanage

I installed semanage onto my CentOS 6.2 box and I was going through my secure log after the install and noticed this entry: Aug 31 22:12:17 xxxx groupadd[12929]: group added to /etc/group: name=cgred,...
3
votes
0answers
30 views

Can't disable TLSv1 and RC4-SHA

I need to remove TLSv1 and RC4-SHA support in Centos 7. I have these lines in my ssl.conf SSLProtocol +TLSv1.2 +TLSv1.1 -TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-ECDSA-...
1
vote
0answers
31 views

How to reboot a server with a LUKS encrypted partition

I have a CentOS 6 VM on which I used the following shell script for installing and configuring MongoDB to use a secondary LUKS (dm-crypt) encrypted disk for its database files: #!/bin/bash -e # Set ...
0
votes
0answers
11 views

removal of cleartext passwords from clogin.rc file of RANCID

We are trying to avoid the usage of cleartext passwords in .cloginrc file of RANCID by using CyberArk API which provide passwords ondemand . API is capable to made available passwords of accounts been ...
0
votes
0answers
23 views

How does reboot run without root password on the console? Can I get this to happen with other programs? [duplicate]

I login at the graphical console terminal on basically stock RHEL Linux 6, and type reboot in the command window. The system reboots without being asked for a password eventhough I am not the root ...
0
votes
0answers
6 views

parsing audit logs of rootsh

We're using rootsh for auditing users privileged shells. This unfortunately means they want to push the problem of auditing up to infosec, but here in infosec, the logs are not very readable. E.g., ...
107
votes
7answers
69k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
0
votes
1answer
41 views

How to turn off stack protector in linux kernel easily? [duplicate]

I wrote a simple module for the Linux Kernel and it has a stack buffer overflow vulnerability. I want to exploit the module, but I have to turn off the stack protector in the kernel first. How could I ...
0
votes
1answer
46 views

How can I make Linux as secure as possible? [closed]

I am relatively new to Linux, and I love it. With the rise of Windows 10 I am getting more concerned about my privacy and the risks of using an unsecured system. My question is three fold Which ...
5
votes
4answers
2k views

Stracing su and ssh shows the password. Is this a security flaw or am I missing something?

I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
0
votes
1answer
42 views

Debian Security Updates

If I am running an 'unsupported' version of Linux, which is based on Debian, is there any way that I can still get the updates from debian systems as they are released? OR am I stuck waiting on the ...
0
votes
1answer
101 views

Mediawiki support has been dropped in Debian stable (jessie). What's the alternative?

Yesterday, Debian removed Mediawiki from its stable distribution: Removed packages ---------------- The following packages were removed due to circumstances beyond our control: +--------------------...
0
votes
0answers
7 views

Git + Nginx - Is it safe to have https auth for cloning and pushing to repo, while remove any auth from gitweb block?

I have following nginx configuration on Ubuntu 14.04 to use together with git httpd backend and gitweb to anonymous browse of repo and push/clone with authentication. Is it safe to use such or I ...
18
votes
7answers
15k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
1
vote
1answer
22 views

How to extract RSA keys from Apache

I am testing some old vulnerabilities related to SSL/TLS, and would like to know how to extract temporary RSA keys from Apache. The particular vulnerability I am testing is the FREAK attack. I ...
2
votes
0answers
16 views

What are the most restrictive external firewall / DNS listening port settings I can have for my DNS server (internal clients only)

This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services). This is about the externally-facing side ...
0
votes
0answers
9 views

Send new login & logout logs to a database

I want to know how to send new login and logout logs to a database. I know that last command outputs the "lasts" login info. But, I found the following problems? How to filter to only get new logs? ...
3
votes
1answer
47 views

How does chsh prevent users from changing another user's shell?

I know chsh is used to change a user's login shell by modifying /etc/passwd. So, in principle anyone could run this command and change another user's default shell but that is not allowed. How is ...
1
vote
0answers
8 views

Looking for a tool similar to the Security Advisor plugin for WHM that can run on CentOS 7 without WHM

The startup I'm working at is setting up some new CentOS 7 servers that will host a mobile application, and some of the data is sensitive, thus, the servers need to be secured to the best of our ...
1
vote
1answer
27 views

Globally writable files and user-based process jailing

I want to be able to generically pick a certain executable (potentially malicious) x and run it (from an admin account) with write access restricted to certain directories (dynamically deduced) "${...
87
votes
3answers
3k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...