Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

2
votes
2answers
776 views

Which distributions maintain a kernel package with grsecurity support

I know that I can apply the grsecurity patches by compiling my own kernel. This is not a big deal to do it once, but too complex to have regular and easy kernel image updates. So I am looking for ...
2
votes
2answers
786 views

securely automating a script which requires a key to do its task

I have a script that downloads bank transactions to store in a database. To get these transactions requires a password for each account. The database is encrypted and requires a key to access it. All ...
0
votes
2answers
670 views

How to import the official Tor GPG keys?

I am trying to install the latest Tor Browser Bundle on Arch Linux: $ makepkg --syncdeps --install [...] ==> Verifying source file signatures with gpg... tor-browser-linux64-4.0.8_en-US.tar.xz ...
20
votes
4answers
8k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
2
votes
0answers
28 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
2
votes
1answer
51 views

Restrict user script execution

I have a game engine running on a Debian server. The game involves bots, which are coded in Python by the players. A player write a bot in Python Upon validation, the code is sent to the server A ...
10
votes
3answers
596 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
3
votes
0answers
985 views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user ...
20
votes
4answers
9k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
1
vote
0answers
20 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
2
votes
1answer
34 views

How to use network interface as non-root user on Android? [closed]

I want to communicate between my Android device and my Linux box over IP through the USB network interface mode. I have connected my Android device to my Linux box with and put the Android device ...
4
votes
1answer
50 views

Is it possible to add a password to moving or copying specific files on Linux?

I have a directory setup very nicely(i.e organized with READMEs and easy navigation etc.). I would like people to be able to access the files in this directory maybe even copy them to their own ...
2
votes
1answer
30 views

Wipe a Solaris Disk

Looking for something similar to Eraser for Solaris 9-10-11 Anything?
0
votes
0answers
14 views

Error while building Libxcrypt

I am building the libxcrypt package on my OBS and I am getting the following error: [ 37s] crypt_util.c:268:1: error: type defaults to 'int' in type name [-Werror=implicit-int] [ 37s] ...
26
votes
2answers
8k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
1
vote
1answer
899 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
0answers
38 views

What are some basic indicators that your unit (Unix/Linux system) is hacked? What are specific, basic, preventive measures that need to be made? [closed]

This question is separated for three separate systems (Unix/Linux, Windows, Mac/Apple). A link will be posted to redirect here for other systems if this question/post is deemed valid or ...
0
votes
1answer
83 views

Custom Kernel to Disable SATA and USB Devices

I am setting up diskless clients that will run on an internal network. I have disabled SATA and USB ports using a BIOS locked with a password, but this is easy to get around by using the jumper to ...
1
vote
0answers
10 views

Libgcrypt warning: MD5 used - FIPS mode inactivated

Last week I enabled the openSSH FIPS 140-2 module on Server "A", and that system works flawlessly (including tsql queries to a SQL Server instance). I recently enabled the openSSH FIPS 140-2 module ...
2
votes
1answer
44 views

What are the disadvantages of using config file (source) for passwords in bash scripts

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, ...
16
votes
2answers
512 views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...
2
votes
0answers
19 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
1
vote
1answer
40 views

How can I lock my screen automatically if internet connection is lost?

I will sometimes remote into my work computer from home using TeamViewer. Obviously I have to unlock the screensaver to use the GUI. When I'm done, I'll lock the screen either from the desktop or via ...
2
votes
2answers
34 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
2
votes
0answers
638 views

Intel Advanced-N 6235 wireless monitor mode problem

As far as I know, iwlwifi drivers (and this particular wireless card) support monitor mode. The only requirement is to install the latest driver from ...
5
votes
1answer
697 views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in ...
1
vote
1answer
687 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
1
vote
2answers
29 views

User verification

Suppose I've writen a setuid root executable and I want it to verify that the user is not a script by asking the user to provide his/her password (granted, users might save their password and use that ...
3
votes
1answer
35 views

Same salt/hash value in /etc/shadow

Looking in /etc/shadow, I can see several users that have the exact same salt and hash value (and thus password). How could the system end up like this? Does this mean the password was not ...
2
votes
4answers
4k views

Allow paswordless user to change to another passwordless user

I have two users dev and tomcat neither of them have a password. How can I allow dev 1 do su - tomcat without having him having to enter any credentials? 1 connects with ssh keyfile
-2
votes
1answer
58 views

Bash Code Injection Vulnerability On Linux

Found a new bug in Linux System, a bash code injection vulnerability. The solution to this is the update the bash package. yum update bash My Question is "do I need to reboot the system"? ...
2
votes
0answers
25 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
3
votes
1answer
2k views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
2
votes
2answers
49 views

How to defend against a Live USB computer hack

A Linux installation can be simply hacked by using a live USB/CD, gaining root access on the live distro, chrooting to the target filesystem and running passwd root. One can use grub too. There may be ...
2
votes
1answer
39 views

Is granting unattended-upgrade command to non-sudo users safe?

I have found out that I give get a non-sudo user access to certain commands with the sudo privileges. However, my plan to allow them to run apt-get dist-upgrade the system is not safe because they ...
4
votes
1answer
132 views

Unexplained files found in home folder

For background information, I'm running openSUSE 13.2 and KDE 5. Today I found a number of unexplained files and folders in my home folder which state they've been edited 3 days ago. I do not ...
2
votes
2answers
407 views

Hiding an encrypted folder in a shared system without root access (unshare -m)

I'm a graduate student trying to use a cluster at my university. These machines are shared, so I want to protect the source code I use (I signed a NDA, so I'm scared about publishing the code by ...
-1
votes
2answers
31 views

How to make an existing directory (and sub-directories) to be suddenly writable by ROOT ONLY?

Let's say i have a directory, at: /tmp/uploads/ And inside got several recursive directories and files created by DIFFERENT USERS before. So now, suddenly how do i make that above directory to be ...
-2
votes
1answer
51 views

How to make a NON-WRITABLE directory?

Actually i'm aware of a "PHP Web Folder". There seems to be some potentials of incoming attacks. So that i want to make sure this whole directory is READ-ONLY (Only writable by ROOT). Let's say the ...
6
votes
7answers
306 views

File protection in Unix

Is there a way to protect a file in such a way that even root cannot delete it or rewrite it after creating it? I have a file which is created by root under /var/log/ and I want to restrict all users ...
2
votes
0answers
20 views

how to prevent procmail listening to the world [closed]

This is part of a larger effort to try and ensure my server is not infected and spamming the internet with spam emails I had a friend take a look at the server and he said "Your procmail is open to ...
10
votes
2answers
3k views

Test whether Linux binary is compiled as position independent code

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization ...
8
votes
1answer
163 views

Blocking SSH Brute Force attacks on IPv6

I recently had to work with some servers that have an IPv6 connection and I was surprised to find out that fail2ban does not have IPv6 support, neither does denyhosts. Searching on google I found that ...
2
votes
1answer
53 views

Running sudo restricted commands by creating soft link

I have sudo access to one of our test machines and the following are the commands restricted for me: user_sree@sel8585:~> sudo -l user_sree's password: User user_sree may run the following ...
1
vote
0answers
26 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I have stucked up on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting ...
5
votes
2answers
80 views

Why does password prompt lag slightly after typing the username in tty?

I have a this kind of behavior & I don't know how to fix it or even how to search a fix for it since I don't know how would I even call it. Here's what's happening: The first time I boot, when I ...
3
votes
1answer
39 views

security model of Linux password entry

Whenever a Windows application wants to do something requiring administrator privileges, my screen goes black and a prompt comes up, asking if I want to grant administrator privileges. I understand ...
-2
votes
2answers
55 views

How to prevent selected users from using “newgrp” with a password [closed]

I'd like to know how can I avoid add some users to a group? I need to avoid some users join to a group --I want to lock a group from some users, not all. Details lgroupmod -L dba ==> This ...
9
votes
2answers
6k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
0
votes
1answer
307 views

rkhunter warnings about a script and a hidden directory

When I run a scan with rkhunter I get 2 warnings. I checked the log file and warnings are as the following: Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: ...