Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

17
votes
3answers
7k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
2
votes
1answer
15 views

NOEXEC and RESTRICT in sudoers

I understand the script below has a serious problem, and NOEXEC and RESTRICT are not enough as a solution to this. user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf However, I still have some ...
72
votes
6answers
42k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
0
votes
0answers
37 views

Is my webcam driver being used to hack my computer?

I'm seeing this in the journal: Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (II) Using input driver 'evdev' for 'TOSHIBA Web Camera' Mar 27 14:01:02 user-PC gdm-Xorg-:0[424]: (**) TOSHIBA Web Camera: ...
5
votes
2answers
394 views

How are mutually untrusted app's files protected in Linux

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they ...
2
votes
2answers
337 views

RHEL 7 (CentOS 7) security / ssh / sshd_config advise requested

I am not a sysadmin and try to create a more or less secure web server (LAMP based CentOS 7). I read several tutorials about setup an initial CentOS 7 droplet and got everything running fine. ...
6
votes
1answer
3k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
1
vote
1answer
29 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...
1
vote
2answers
30 views

Encrypted FileSystem in VirtualBox

I'm looking for any information regarding how secure an encrypted Linux file system is when contained in a VirtualBox virtual drive on a Windows host? Specifically I'm looking for answers to the ...
1
vote
1answer
534 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
2
votes
2answers
52 views

Per user tmpfs directories

Using the shared /tmp directory is known to have lead to many security vulnerabilities when predictable filenames have been used. And randomly generated names aren't really nice looking. I am ...
0
votes
0answers
13 views

Is user/filesystem access separation of services enough to have well secured data of services?

I'm about to publish some of my projects. So, I'm gonna to re-install my VPS and do it properly. I'll have running on it Apache server(websites are made using Ruby and Python), databases. I'll also ...
1
vote
1answer
33 views

How do I run a program without network access? [duplicate]

I am making a program that scrapes information from some web services. I want to test how my program reacts when it can't reach the web service, like if the web service is down or if the local ...
0
votes
1answer
38 views

unknown command “vftovp” in linux command history [ Is my linux box compromised? ]

I have Slackware linux system configured with ssh remote access. While observing the command history, I discovered that there is one unknown command executed from my linux box "vftovp". I certainly ...
10
votes
2answers
186 views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
0
votes
0answers
20 views

why do we have same chains in different tables of “iptables firewall” in linux?

why do we have same chains in different tables of "iptables firewall"? Like for example: we have "output" chain in filter table, nat table & mangle table.
3
votes
0answers
43 views

Is there a technical reason why ssh-agent lacks a sudo-like inactivity/idle timeout feature?

There are some brief discussions about the existing ssh-agent -t feature at [1], and there was a post as far back as 2001 on debian-devel [2] wishing for an inactivity timeout feature. There's a ...
1
vote
0answers
19 views

Are External API's secure? [closed]

I'm new to java. So please someone explain me if we can use external API's in my work? Are they secure to use?
9
votes
6answers
43k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
1
vote
4answers
45 views

Can administrating task of 'root' be divided to the several of “more powerful” users?

Unlike root (which is able to do everything) is it possible to have multiple administrators assigned to manage only part of a system? For example, one system could have 3 administrators: ...
0
votes
1answer
26 views

Compare Linux configuration with default

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version? My current system is Debian, ...
5
votes
1answer
35 views

Find out which kernel source files were used when kernel was compiled

I am compiling the Linux kernel for my specific hardware and I only select the drivers/options which I really need. This is in contrast to a typical distribution kernel, where they compile almost ...
13
votes
4answers
1k views

How to retrieve IP addresses of possible ssh attackers?

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records. However, there are two possible record types - for valid / invalid user. It complicates my ...
1
vote
1answer
792 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
2
votes
2answers
473 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
0
votes
2answers
63 views

How to protect against data leak?

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them. However our boss is concerned that someone (upon ...
-4
votes
1answer
41 views

How to know su password

You already know my question. I don't have su authority. So I want to know su password. I really(x100) don't know how to find it. I tried change direction(/etc/pam.d/su) and tried to delete auth ...
1
vote
1answer
26 views

Is it possible to scan a website for repeated images?

Is it possible to determine how many times a website is using an image (specifically one that is hosted on the domain), and on what pages? Is there a command line tool, for example, that scans every ...
1
vote
0answers
37 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...
2
votes
1answer
33 views

Where do my keypresses go ?

Scenario (Ubuntu 14.04.2) : I wake Ubuntu from suspend. I know (from past experience) that it only takes 2 or 3 seconds for the lock screen to become available. My monitor, however, takes longer - ...
1
vote
1answer
39 views

Firefox in Docker, failed in isolation

While experimenting with docker, I realized I can run a browser in a container for improved security. I managed to start with a clean Docker Fedora, in which I installed the openssh-daemon package. ...
0
votes
1answer
44 views

FreeBSD 10: Do I need jails?

I'm in the process of setting up a FreeBSD 10 server with just some services on a KVM server: NGINX webserver w PHP-FPM 2 domains, 3 subdomains Mailserver 3 Email addresses MySQL (or other) ...
4
votes
3answers
3k views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
4
votes
0answers
55 views

SSH server listening on multiple ports with passwordless access not allowing connections to second port

I have my Synology NAS running an SSH server listening on the default port 22 and I set up passwordless authentication with a public/private key and a passphrase: From sshd_config: ...
1
vote
1answer
37 views

Is it possible to mount a file with different ownership/permissions?

I have been experimenting with privilege escalation using the mount command and would like to know if it is possible to create a suid file owned by root without having access to any external device. ...
44
votes
1answer
1k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
0
votes
1answer
22 views

FreeBSD 10 and ZFS: Methods for encrypting files

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver. I'm really new to FreeBSD in general (coming from Debian Linux). I installed the system choosing ZFS with encrypted root volume ...
1
vote
0answers
52 views

md5 password hash

I'm looking to create a md5 hash to use in /etc/shadow. Someone suggested using grub-crypt. Every time I put the same password in I get a different hash. [root@endpoint ~]# grub-crypt --md5 Password: ...
2
votes
4answers
63 views

can a super user steal passwords from other users with keylogging?

First, before I get answers containing information that I already know, yes, I'm aware that the superuser can reset passwords, and yes, I know that the superuser can log in as other users without ...
104
votes
9answers
10k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
0
votes
2answers
35 views

Is this an argument that Linux security is not impenetrable?

From what I understand, the biggest and probably only line of defense against unauthorized software (viruses and worms) from being installed on the system is to simply not allow it unless an admin ...
-1
votes
3answers
56 views

Is linux secure? [duplicate]

Is linux free from almost all security vulnerabilities when compared with windows? If there are so, can i install any patches to fix them? Thanks in advance.
12
votes
1answer
5k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
5
votes
1answer
387 views

Linux Server Hacked

I received e-mails from Google saying that my websites are hacked. This is the e-mail. Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently ...
2
votes
1answer
125 views

Why is “nodev” in /etc/fstab so important? How can character devices be used for hacking?

I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous. If I have a USB stick with a bash executable that has setuid ...
2
votes
3answers
1k views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA revelations and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I ...
0
votes
1answer
17 views

Can I use the sudoers function without enabling the suid bit?

I mounted all my FS with nosuid option and removed the suid/sgid bit from all my files. The question: It looks like I breaked sudo. It doesn't work anymore, no matter what I try to set in ...
0
votes
2answers
50 views

How to get a grsecurity kernel on Debian Wheezy using the linux-patch-grsecurity2 package?

There is a package linux-patch-grsecurity2. But it seems to be lacking documentation. How to make use of linux-patch-grsecurity2 to get a grsecurity enabled kernel?
14
votes
3answers
481 views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
0
votes
1answer
12 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...