Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

0
votes
0answers
2 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...
1
vote
1answer
17 views

Reason for security repositories in Debian?

In /etc/apt/sources.list(lists APT data sources) file there are two repositories listed for security updates: deb http://security.debian.org/ wheezy/updates main contrib non-free deb-src ...
0
votes
3answers
42 views

What does this host means ' ::1 '

To secure my mysql server, I checked the list of users : mysql> SELECT User,Host,Password FROM mysql.user; +------------------+-----------+-------------------------------------------+ | User ...
2
votes
2answers
514 views

setuid programs don't seem to run setuid in TinyCore Linux

I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file ...
1
vote
1answer
22 views

Will I receive critical security updates if I lock CentOS yum to a specific repo version?

We run Citrix XenServer as our virtualisation platform. Presently we're right up to date with our XenServer service packs and hotfixes i.e. we're running XenServer 6.2SP1 with the SP1015 update ...
0
votes
1answer
18 views

Custom Kernel to Disable SATA and USB Devices

I am setting up diskless clients that will run on an internal network. I have disabled SATA and USB ports using a BIOS locked with a password, but this is easy to get around by using the jumper to ...
2
votes
1answer
17 views

what does Xserver access control mean

What meaning does Xserver access control have, when the Xserver is started with tcp disabled: /usr/bin/X11/X -nolisten tcp AFAIU, Xserver can be used to allow remote network connection. But, if it ...
1
vote
1answer
37 views

Use sudo from another programm

I was wondering it is safe or an acceptable practice to use sudo to run an application from another one. For example, Let's say I have an application that uses a configuration file to do its work and, ...
9
votes
1answer
243 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
1
vote
2answers
47 views

Is system call the only way that a user program can intentionally affect the state of a Linux kernel?

I think there are several ways that a user program can intentionally affect the state of a Linux kernel. By invoking a system call; By invoking mmap() and writing the memory that has been mapped to ...
1
vote
0answers
7 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
0
votes
2answers
26 views

How to instablock IP based on root SSH login

I have had this setup before by a friend of mine but it got lost in a reinstall. Basically what happened was, whenever someone would directly SSH to my server as root their IP would get blocked, you ...
34
votes
1answer
758 views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
6
votes
1answer
147 views

Some basic questions about Linux kernel's security [closed]

I don't know much about Linux kernel, and I have some questions. What is the main purpose of separating kernel memory from user-space memory? To make sure that a user application cannot do anything ...
1
vote
0answers
13 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
5
votes
1answer
2k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap ...
0
votes
1answer
25 views

Disallow change of init kernel parameter

is there any way to disallow changing init parameter on boot time? I want to prevent situation when someone reboot my server, edit grub entry and get access without password. Maybe some kernel ...
1
vote
1answer
459 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
2answers
33 views

Lightweight SSH-only distro (< 128 MiB RAM) [closed]

I am looking to set up an SSH entry point into my network via a lightweight Linux or BSD setup. The purpose of the distro will be to allow SSH access into the rest of the internal network—that's it. ...
0
votes
0answers
22 views

Investigate compromise on Fedora 20

I am running Fedora 20, and I just discovered that a client's server was logged in to back on October 9th from my ip address, and an erroneous ftp account was created on each of his cpanel ...
3
votes
2answers
161 views

How does the 'passwd' command gain root user permissions?

How does Linux know that it has to give euid 0 (uid of root) to only certain process like passwd, setuid, etc. If a process can gain root permissions, will it not lead to potential security breaches ...
-1
votes
1answer
17 views

acedemic projects related to linux virtualization and security [closed]

I am B.tech student iam totally confused with the topic virtualization. but i selected linux virtualization security as a project in my college. please guide me. i tried in google but i found so many ...
0
votes
1answer
114 views

OpenVAS 7 not working after apt-get update - Failed to receive data: A TLS packet with unexpected length was received

The problem started when my Kali installation updated OpenVAS to v7: My admin username for the web service stopped working so I could no longer log in. I have tried everything I can think of to fix ...
34
votes
4answers
5k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
1
vote
1answer
730 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
1answer
32 views

Assp won't start

I tried to install ASSP (Anti-Spam SMTP Proxy Server),but when I try to start it I get the following: $ perl assp.pl Perl version 5.012003 (5.12.3) is at least recommended to run ASSP 2.4.3 (14313) ...
1
vote
0answers
22 views

How can I set a group policy to all access on all folders except one?

I am currently making a test environment where users will be going through a network administration course with different levels they must complete. Due to the nature of the course, we want to give ...
2
votes
1answer
150 views

A window asking me to enter my ssh passphrase is popping up randomly. Why?

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it ...
3
votes
2answers
230 views

SSH Bash Jail Session

I've seen some game tunneling service providers that jails the customer's account to a Information screen upon login and any input is ignored. Ctrl+C closes the SSH session, and disconnecting. This ...
2
votes
1answer
44 views

enable echo service and linux security loophole issues

in order to enable the echo service we need to add the echo lines as the following example : more /etc/inetd.conf echo stream tcp nowait root internal echo dgram udp wait root ...
12
votes
2answers
200 views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...
2
votes
2answers
28 views

Securely making an SSH connection from a public computer

Today, I had to remotely connect to my debian computer at home to fix an issue with a VPN server. I was using my iPhone with an SSH client to fix the issue, but I had a hard time due to the small ...
4
votes
2answers
193 views

Why rejection of password is much slower than acceptance of it? [duplicate]

In both my Linux and OSX machines when I type in the password to login, a correct password is accepted immediately. However, if I type a wrong password, checking process takes much longer. How is ...
2
votes
3answers
4k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
4
votes
1answer
30 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
0
votes
0answers
33 views

Reading Suricata log files with Barnyard or Wireshark

I have Suricata 2.0.3 running on CentOS 6.5. It generates files that I cannot read. I have read that two options for reading the log files (in unified format) are barnyard and WireShark. I ...
3
votes
1answer
394 views

Is there any DLP solution for linux?

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
5
votes
1answer
1k views

Which home directory should 'nobody' have?

I'm messing around with Tiger security audits on my CentOS box, ensuring the server is fit for being online, well as close as it can get anyway. I noticed a warning about the user nobody having / as ...
4
votes
2answers
632 views

How can I use Skype with lxc?

Under Scientific-linux? https://en.wikipedia.org/wiki/LXC I just want to separate Skype, because I don't trust it. We are using it only to call/chat with people, no file transfers!
1
vote
3answers
294 views

Taking away a User's Read/Write/Execute Permission

So I have a user that is able to go in /etc and read files like httpd.conf. I would like to deny that user access to any critical locations such as /etc, /var and so on. What would be the best way ...
1
vote
1answer
32 views

Cluster Lock Manager without TCP/IP

I have 2 linux sharing same SAN disk LUN. There are many cluster files systems to manage lock/unlock. But all of them are using a seperate TCP/IP comminication. But I need a cluster lock manager ...
1
vote
1answer
28 views

user-level guide to maintaining Debian package update security? [closed]

Recently I listened to an interview with Kim Zetter (audio download here) on cybercrime/warfare, particularly Stuxnet and Flame. While listening to the discussion of how Flame exploited Windows ...
1
vote
1answer
24 views

How can I go about tracking down DNS queries?

I was looking at the dnsmasq logs on a router I run and noticed that there are requests to a particular url on a regular basis. This was happening while the only client connected to the network was my ...
4
votes
3answers
5k views

Fork bomb on a Mac?

I just learned about a fork bomb, an interesting type of a denial of service attack. Wikipedia (and a few other places) suggest using :(){ :|:& };: on UNIX machines to fork the process an infine ...
1
vote
1answer
28 views

rkhunter reports /sbin/ip has changed

I am using rkhunter 1.4.2 on CentOS 6.5. A message, in /var/log/rkhunter.log is Warning: The file properties have changed: [09:40:35] File: /sbin/ip [09:40:35] Current size: 247396 ...
1
vote
1answer
42 views

IP Camera with embedded Linux

I have purchased an IP Camera from Ebay (http://www.ebay.com/itm/151349669865). When I read the description of the camera, it said it has an embedded linux in it. I though that I will be able to ...
5
votes
2answers
55 views

Permissions depending on how you login: ssh/su/sudo

As user I have access to a remote linux machine where I can: sudo su - other_user Among other things, this allows me to add my own public key to authorized_keys for other_user, which effectively ...
5
votes
2answers
470 views

Why is 8 numbers considered a “strong” password?

Just curious as to why 8 numbers are accepted as a password in linux (CentOS if it matters) and not 8 characters on a non-dictionary word. It's 10 vs 26 per digit after all. (52 counting CaSe ...
2
votes
1answer
21 views

Parentals Controls? [closed]

How do we implement parental controls? We have a customer with multiple retail locations and one computer at each. They switched to Ubuntu to lock down the computers, but many of the employees are ...
0
votes
0answers
26 views

How do I force a command to be run on local login?

I was wondering how do I force a command on login of a linux system? (debian 7). This is for a 2FA authentication command. I am asking for a local login.. not ssh.