Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
1answer
29 views

Information leaks out of encrypted file system

If I only encrypt the home directory, what are some common ways for information to leak out to the unencrypted part of the file system? Aside from the obvious problems like swap space files in /tmp ...
0
votes
1answer
18 views

Steps to follow when you run untrusted program with elevated priviledges

I had a fail regarding the security of my pc. I torrented a version of MATLAB from pirate bay and then tried to execute the installation script. The script ran without asking for a password so I ...
1
vote
0answers
17 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
0
votes
0answers
12 views

How to set usb stick's ntfs filesystem's attribute to readonly in linux

I know how to set readonly attribute to ntfs filesystem of a usb device by using diskpart tool in windows. attributes disk set readonly but how to set readonly attribute to the same usb device ...
0
votes
0answers
13 views

What are the minimal MySQL grants for the debian-sys-maint user? [migrated]

What are the minimal privileges that debian-sys-maint@localhost needs for the mysql service to work correctly? This answer on ServerFault suggests granting RELOAD only, but this is incorrect, as it ...
15
votes
3answers
31k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
4
votes
2answers
1k views

Does this threat still exist: Linux keylogger without root privileges

http://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real Or it's long gone as most of the new distros implement SELinux by default
8
votes
4answers
5k views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
0
votes
1answer
18 views

How to reinstall the password of Grub?

I have Debian 8 OS , i protect my grub with a password to prevent the boot from a CD and retrieve my password. And the automatic establishment of the recovery entry is removed. Is there a solution to ...
4
votes
1answer
17 views

LXC: Are downloaded templates verified?

Debian 8.3, LXC 1:1.0.6-6+deb8u2 When LXC downloads the base packages for a Debian container, are the packages verified? Verifying a Debian CD involves comparing signed checksum files against the ...
4
votes
2answers
86 views

Debian Lenny Server Compromised - No Sign Of Intrusion Point?

I have a server, it's outdated running Debian Lenny, and yes I know that is probably half the problem. It also has PHPMyAdmin and ProFTPd. Again, I get it, all bad signs. But for the life of me, I ...
29
votes
4answers
2k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
0
votes
1answer
20 views

Creating Encrypted Tunnel Between 2 Lans

I have 2 LANs and one of them is connected to the internet and I need to connect them together. Normally, a single cat6 cable is enough for connection however, this cable is going through a public ...
12
votes
3answers
7k views

How come no core dump is create when an application has SUID set?

I setup my environment to create a core dump of everything that crashes, however when I run an program with SUID set on a different user than the executing user it doesn't create a core dump. Any ...
1
vote
1answer
24 views

Linux TOTP vs SSH Keys

I am in the middle of a security upgrade task and have been reading a lot of articles around SSH security. I have a question around what is the better method of securing SSH by using SSH Keys or TOTP? ...
1
vote
0answers
24 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing ...
4
votes
2answers
2k views

Is there a way to report incorrect login attempts in Ubuntu 12.10?

I am concerned with some people trying to access my laptop while I am away in my work place. Therefore I was wondering if is there a way to set up kind of automatically monitor and report wrong ...
4
votes
1answer
67 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
4
votes
0answers
16 views

Reassemble images forwarded though Linux router? [migrated]

In 2003-2004 I used a Linux app that reassembled images from HTTP traffic forwarded through a Linux router, displaying them live. Just a command line app that threw up an X window, showing the images ...
1
vote
5answers
251 views

Can I stop SElinux from working?

I suspect that SElinux is backdoor and I want to stop it from working on my system. I want to stop it and delete it from the system also if that is possible. Questions How can I delete it without ...
-1
votes
2answers
40 views

Need the sshd server be run in root privilege for a password-less login? [closed]

I mean: if the sshd is't being run in root account, then how can it let the remote ssh client run shell or other command in root account ? if sshd call the login command, then the user could login ...
0
votes
1answer
20 views

fail2ban ip blocked, yet still login attempts

everything seems ok, iptables shows its blocked, yet I still get auth attempts I have configured fail2ban # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1/8 bantime ...
2
votes
1answer
1k views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
3
votes
3answers
1k views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
3
votes
4answers
104 views

Why does mknod require root privileges?

I noticed that the mknod command required root privileges when a creating a node other than a regular file, FIFO or a Unix socket. Why is that? How can a regular user harm a system or compromise ...
4
votes
1answer
35 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
3
votes
1answer
26 views

What are the drawbacks of using policy_any in openssl.cnf?

As given in this document, we may use policy_any to ignore most of the fields of subject in certificate request. There must be some drawbacks of ignoring such fields, would it may lead to some ...
1
vote
1answer
868 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
2answers
219 views

Editing my /etc/hosts.deny

I'm being trolled by China, and don't know why I can't block their request to my server. //host.deny ALL: item.taobao.com ALL: 117.25.128.* But when I watch the error log on my webserver tail -f ...
21
votes
5answers
3k views

Does installing and using Wine open up your Linux platform to Windows viruses?

Just wondering if installing Wine might open up a fairly solid Linux desktop to the world of Windows viruses. Any confirmed reports about that? Would you then install a Windows antivirus product ...
53
votes
6answers
5k views

Why does reboot and poweroff require root privileges?

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
0
votes
3answers
47 views

What additional privileges does the root user have over a standard user? [closed]

What additional privileges does the root user have over a standard user in Linux?
0
votes
1answer
24 views

Is sudo useful to protect my data from malwares?

I'm considering creating a separate account for browsing, and launching my browser with sudo -u browseraccount {firefox,chromium,etc}. I wonder if this can prevent a malware (especially ransomwares) ...
107
votes
2answers
17k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
1
vote
2answers
55 views

Is it evil to link to a crontab?

I think about doing something like: sudo ln -s ~/myCustomCrontab /var/spool/cron/crontabs/username because I'd like to have all customized files in my home directory. Possible risks I can think of ...
0
votes
1answer
51 views

What are the right permissions to set to make files unreadable unless it's my main user accessing them?

Basically I didn't encrypt my Linux (Debian) partition when installing it. However I found a way to encrypt at least home folder so in theory I could put everything there which I want to make sure ...
5
votes
1answer
926 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
1
vote
0answers
35 views

Is insecure to give users permissions to apps in /opt? [duplicate]

I'm working with some apps (the best example i can give is Firefox Developer Edition) that i put in the /opt folder. These apps work perfectly until they need to apply and update, and that's because ...
0
votes
1answer
2k views

What is the security impact of not using tls-remote with OpenVPN

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like ...
0
votes
0answers
51 views

Does running fcgiwrap with nginx give the same added security as creating a new php-fpm pool for every site by hand?

Here's the nginx + fcgiwrap configuration I'm talking about. I don't understand what the main differences are between this kind of a fcgiwrap configuration and a nginx + php-fpm configuration. They ...
0
votes
0answers
21 views

How to get informed about EVERY incoming ssh connection (e.g. with no remote command specified)

The case I'm used to set up automatic reverse ssh tunnels to remote computers via my server with cron. Usually I use the following entry: @reboot sleep 300 && ssh -MNf -R xxx22:host:22 ...
14
votes
5answers
1k views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...
0
votes
1answer
17 views

Hide/Encrypt application configuration

Is there any way to hide/crypt software config files (services such as Apache web server , Varnish and so on) from boss and others?
1
vote
0answers
15 views

dirmngr does not start with proper home directory unless it is restarted

I am trying to follow these guidelines for gpg best practices: https://help.riseup.net/en/security/message-security/openpgp/best-practices but I am having trouble with dirmngr, which handles all ...
0
votes
1answer
24 views

Can't access web sites when running iptables script!

I have wrote script for protecting my machine: #!/bin/bash ssh=1.1.1.1 http='1.1.1.1 2.2.2.2' # Clear any previous rules. iptables -F # Default drop policy. iptables -P INPUT DROP iptables -P ...
32
votes
7answers
8k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
0
votes
1answer
31 views

How to protect from chrooting to its linux partition and how to chroot it after using the protection?

I am currently using archlinux, It is possible to boot on an archlinux installation iso for instance, to mount my current archlinux partition and my boot partition and then to use arch-chroot. Then I ...
1
vote
1answer
39 views

Managing iptables for specific ips and ports

I disable firewall like so: #!/bin/bash iptables -F iptables -X iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT Update I also enable my firewall: #!/bin/bash ...
1
vote
2answers
39 views

Storing application passwords in central location

Is there any secure local service that one should use for storing and retrieving organization wide application passwords? Most of the time we need authentication information in our scripts to run some ...
70
votes
1answer
2k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...