Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

9
votes
3answers
269 views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
6
votes
1answer
1k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
4
votes
3answers
682 views

Any disk encryption that locks itself for some time after a number of failed attempts?

Is there any way to have your disk/partition/file encrypted (in Linux or as a hardware encryption; no Windows here) in such way that it locks itself for say 10 minutes after say 3 failed unlock ...
1
vote
0answers
10 views

Finding out the script causing MySQL failed connections

I see lot of lines in mysql.log Connect Access denied for user 'M'@'localhost' (using password: NO) I am sure I don't have such a user on my system. I need to figure out what script is ...
0
votes
1answer
113 views

GHOST: glibc gethostbyname buffer overflow

https://rhn.redhat.com/errata/RHSA-2015-0092.html I can see md5sums of the packages, but cannot download them and my package manager says I'm up-to-date. [root@notebook log]# grep glibc-2 yum.log | ...
3
votes
2answers
26 views

How is the visibility of a file-system mount limited?

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
0
votes
0answers
17 views

Secure Apache Root on CentOS 7 [on hold]

I'm setting up a new web server on CentOS 7. One of my tasks is securing the server. So I started wtth web root (apache httpd). First by following this tutorial: ...
67
votes
6answers
39k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
1
vote
1answer
47 views

unix system with malware

I have a CENTOS server that is infected with malware: top shows there's an unknown process that's consuming all the CPUs, if you kill it, it respawns with a different name. what's the best way to ...
103
votes
9answers
9k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
3
votes
0answers
23 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
6
votes
2answers
56 views

Linux graphical password dialog trick security

When we run a command by sudo, the password is asked [sudo] password for user If the sudo is not typed the password should not be asked. If asked, I would assume it as a fraud by the application. ...
0
votes
0answers
6 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
42
votes
1answer
966 views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
6
votes
2answers
101 views

Run Ubuntu Security Updates every Saturday only

A clients wants to enable automatic security updates on their 12.04 box, but it has to be once per week, on saturday only. (Why I don't know) When I do dpkg-reconfigure -plow unattended-upgrades it's ...
4
votes
2answers
2k views

Sign a module after kernel compilation

I've built a kernel in tmpfs, then I rebooted. Now I see a message when I compile the 3rd party module, NO SIGN [M] XXXX.ko How can I get it signed? The key pair generated during rpmbuild is lost ...
2
votes
1answer
30 views

NIS and /etc/passwd

Shadow passwords are to be avoided in a NIS server, as suggested in this guide at paragraph 7.6. So: in a NIS server (a Unix or Unix-like system), should all the users be migrated to /etc/passwd from ...
22
votes
1answer
1k views

Can another program on X capture my root password while I type it in a virtual terminal?

Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account ...
3
votes
1answer
559 views

How to generate just a key with openssl

I run this command to generate a CSR and a new key with openssl: openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout ...
0
votes
1answer
13 views

How to restrict restrict remopte administration software to one domain name?

I currently have a server hosting a number of website on a debian server. I understand that all my domain names share the same IP so any of them will grant me access through SSH, but i was wondering ...
1
vote
1answer
32 views

Finding out if my system is being used as a bot by looking at ifconfig?

Recently, I have often been suspicious that my router (a linux box) might have been used as a bot for spam blowout or something of that quality because I may have misconfigured my iptables rules by ...
1
vote
1answer
486 views

Make bluetooth device invisible / disable incoming pairing

I am using the bluez package for my bluetooth usb dongle on ubuntu server. I want to be able to initiate bluetooth connection from the dongle to a device, however a device itself shall not be able to ...
0
votes
1answer
33 views

How to run unattended-upgrades not daily but every few hours

By default unattended-upgrades runs with cron.daily, that is at most on a daily basis. This can be a lot of time for attackers. I'd like to run it every 4 hours, how can I do this?
1
vote
1answer
49 views

What considerations would I need when configuring iptables?

Synopsis I am looking at learning more about Server Administration. I have been running my own web server for a few years although many things were set-up by my friend and now I wish to learn more ...
2
votes
1answer
106 views

RHEL 7 (CentOS 7) security / ssh / sshd_config advise requested

I am not a sysadmin and try to create a more or less secure web server (LAMP based CentOS 7). I read several tutorials about setup an initial CentOS 7 droplet and got everything running fine. ...
-1
votes
0answers
11 views

Secure mailing [open panel]

I'm a total noobie in the security subject, and I'm not sure what it really takes to have a secure mailing service. I've installed Open panel, which has postfix (among other services) mailing server. ...
1
vote
1answer
751 views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
0
votes
0answers
41 views

Sudo User: Not able to see the home directory of other users

I created sudo user hrsupport with following commands: hrsupport ALL=ALL, NOPASSWD: /bin/chown, /bin/chmod, /bin/chgrp, /scripts/pkgacct, /scripts/restorepkg How can I achieve this The hrsupport ...
0
votes
3answers
37 views

/etc/passwd permissions and GECOS field

The default permissions on Ubuntu (or even some BSD) distributions for the /etc/passwd file are 644. It is pointed out in questions like this that /etc/passwd is a sort of user database and it is ...
0
votes
0answers
128 views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - ...
1
vote
0answers
19 views

How do I securely automate inputting passwords?

I would like to automate an SSH connection so that I wouldn't have to enter password and I am not allowed to use authorized_keys. I was thinking about making an expect script but I don't know where I ...
0
votes
0answers
24 views

Network Manager losing saved vpn passwords in Mint 17

my vpn is setup in the network manager, and the passwords are saved in there. however, those passwords are disappearing, they will be there for several days, and then be gone. what could be causing ...
2
votes
4answers
59 views

How can I lock myself out of a linux box with iptables?

In the Securing Debian Howto I read (about iptables): The tools can easily be misused, causing enormous amounts of grief by completely crippling network access to a system. It is not terribly ...
3
votes
1answer
28 views

Protecting process's envvars from exposure

From I've read about current best practices for developing web applications (such as the Twelve Factor guide), the recommended approach for storing configuration data is within environment variables. ...
15
votes
3answers
1k views

Why change default ssh port?

I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
1
vote
1answer
23 views

What if I add a user to a supplementary group?

I am using debian 7.0 and I added "debian-transmission" to the group "pi" with: usermod -a -G pi debian-transmission I made this change because transmission was not able to write the pi mounted ...
2
votes
1answer
55 views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
4
votes
2answers
2k views

How can I configure SELinux when the semanage command isn't found?

I'm having a very hard time configuring SELinux to allow Sending mail. Looking into selinux documentation I've found I can manage ports via the semanage command, but the command can't be found. Is ...
0
votes
0answers
3 views

Help hooking sys_recvmsg to hide a socket from ss (educational rootkit) [migrated]

My question is this. After hooking, finding the nlmsghdr structures, finding the inet_diag_req structures, I change the port number in a inet_diag_req struct (to 56666). Then copy the message from ...
2
votes
5answers
16k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
1
vote
0answers
17 views

List all files with only arbitrary file path read, but no directory listing nor sudo [migrated]

I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo. To fully exploit this, I would like to know which files exist in each directory ...
0
votes
0answers
193 views

Teach tripwire or AIDE about renamed files

In my /etc directory there is something I do with files. Let us say that I am looking at /etc/passwd. What I do when it will be modified is to copy it over, in the following sense. I have a hierarchy ...
3
votes
2answers
744 views

Is TRESOR included in the latest kernel?

Did TRESOR get included in the mainline Linux kernel? Where would I look to find out? Is there any documentation describing its use? Reading about cold boot attacks on Wikipedia makes me think TRESOR ...
3
votes
0answers
441 views

Is there any DLP solution for linux? [closed]

I'm looking for a DLP (Data Leak Prevention) solution for linux environments. I know OpenDLP, but it's only a way to Prevent Clear-text file, and source codes from malicious access. There are lots of ...
0
votes
1answer
60 views

hydra verification before stopping

I am getting false positives when I try a penetration test on my local service with hydra: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post ...
0
votes
0answers
19 views

httpd and mod_security woth OWASP's dos rules

I'm trying to setup the mod_security on my httpd web server. I have followed the basic steps yum install mod_security I put the modsecurity_crs_10_setup.conf in the /etc/httpd/modsecurity.d I put ...
1
vote
1answer
29 views

Reason for security repositories in Debian?

In /etc/apt/sources.list(lists APT data sources) file there are two repositories listed for security updates: deb http://security.debian.org/ wheezy/updates main contrib non-free deb-src ...
0
votes
2answers
60 views

What does this host means ' ::1 '

To secure my mysql server, I checked the list of users : mysql> SELECT User,Host,Password FROM mysql.user; +------------------+-----------+-------------------------------------------+ | User ...
2
votes
2answers
532 views

setuid programs don't seem to run setuid in TinyCore Linux

I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file ...
1
vote
1answer
69 views

Will I receive critical security updates if I lock CentOS yum to a specific repo version?

We run Citrix XenServer as our virtualisation platform. Presently we're right up to date with our XenServer service packs and hotfixes i.e. we're running XenServer 6.2SP1 with the SP1015 update ...