Content related to computer security.
31
votes
5answers
17k views
Allow setuid on shell scripts
The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor:
> cat setuid-test.c
#include <stdio.h>
#include <unistd.h>
int ...
69
votes
7answers
7k views
Which is the safest way to get root privileges: sudo, su or login?
I would like to have the root account in safety even if my unprivileged user is compromised.
On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
7
votes
1answer
424 views
Log every invocation of every SUID program?
I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
5
votes
2answers
1k views
Hide processes from other users based on groups (under Linux)?
Is it possible to configure process hiding for certain user groups under a linux system?
For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc.
...
30
votes
2answers
9k views
Why is there a big delay after entering a wrong password?
I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
9
votes
5answers
698 views
Monitoring activity on my computer.
So recently I found that someone has been using my computer without consent, browsing folders, etc....
I could change all my passwords straight away, but I'm curious as the what the intruding party ...
10
votes
11answers
903 views
Concern about logging in as root overrated?
For personal linux on my personal notebooks, I've usually set my environment to autologin as root even under X or lower runlevels. I've found my workflow is very pleasant and fast, without any ...
3
votes
1answer
858 views
I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?
I installed 'linux-patch-grsecurity2' and it has some sort of interface.
~$ sudo gradm2
gradm 2.1.14
grsecurity administration program
Usage: gradm [option] ...
Examples:
gradm -P
...
25
votes
4answers
2k views
Is there any way to keep a command from being added to your history?
Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
7
votes
4answers
298 views
Books/Guides for Securing a Server
I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). The problem is that I'm ...
17
votes
7answers
7k views
What's the difference between /sbin/nologin and /bin/false
Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
10
votes
2answers
2k views
What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?
I am planning to go back to Linux as a Desktop machine.
I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server.
What would be a good, ...
23
votes
4answers
749 views
Execution of possibly harmful program on Linux
I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it.
I was thinking ...
11
votes
3answers
4k views
How should one set up full-disk encryption on OpenBSD?
Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux?
I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...
8
votes
7answers
2k views
How do I encrypt git on my server?
Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring ...
11
votes
3answers
280 views
What specific vulnerabilities am I creating by disabling the sudo password?
Here are some instructions on how to disable your sudo password. These carry the following warning
If you disable the sudo password for your account, you will seriously compromise the security of ...
10
votes
2answers
826 views
How to safely pass variables to root-enabled scripts?
This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
9
votes
7answers
1k views
What's the best way to format a HDD in Linux in order to leave no trace?
I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
15
votes
4answers
592 views
Is there any way attacker could use mkdir to compromise a system?
I'm setting up a restricted user account for user ricardo, a troublesome user on my system. I want to grant him the right to make directories using sudo, which he sometimes needs to do. I'm ...
6
votes
4answers
1k views
How to best encrypt and decrypt a directory via the command line or script?
I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line.
Ideally, ...
12
votes
1answer
3k views
Why are the first 1024 ports restricted to the root user only?
This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
10
votes
4answers
5k views
How do I recursively shred an entire directory tree?
I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding.
How can I shred an entire directory tree ...
10
votes
5answers
914 views
Best way to do full disk encryption?
I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
3
votes
2answers
2k views
SSH key-based authentication: known_hosts vs authorized_keys
I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong…
Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
1
vote
4answers
477 views
How to guarantee the integrity of an OS?
In information security, integrity
means that data cannot be modified
undetectably.
This answer raised my interest, of course, I want to guarantee the integrity of my OS, outlined here. ...
13
votes
3answers
268 views
Securely delete files on btrfs filesystem
Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk.
...
10
votes
3answers
2k views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 ...
8
votes
2answers
3k views
How can I determine if someone's SSH key contains an empty passphrase?
Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers.
We're concerned that some of these people use an unencrypted ...
5
votes
1answer
747 views
Lock screen w/ slock after a certain time?
I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)?
Thanks!
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
3
votes
3answers
370 views
Unix users, groups, and permissions
I don't understand unix users, groups, permissions, etc. For example, things managed by the chmod, chgrp, usermod, groupadd, etc. commands. How do all these things work?
2
votes
2answers
584 views
Preventing access to TTY when X is killed
Assume I start an X server manually from a virtual console /dev/tty1 with xinit or startx, with the line id:3:initdefault: set in /etc/inittab. The X server gets run and put on another virtual ...
2
votes
1answer
1k views
Linux: LUKS and multiple hard drives
I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM).
I think the basic ...
2
votes
1answer
990 views
Encrypt files using gpg (and them symetric encrypting the key) - is it a normal thing to do in the *nix world?
I read a lot of articles about using gpg to encrypt email, but I would like to use it to encrypt some files - mainly a bunch of *.isos. I'm going to describe what I thought I would do, so you can ...
1
vote
0answers
48 views
How to add my own created certificate authority to system trusted repositories
I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf.
Yet I can't find anything similar on the ...
5
votes
1answer
555 views
Why root's default shell is configured differently with other normal user account's default shell?
As I know, root's default shell is configured csh and normal user's default shell is sh in FreeBSD. And in Ubuntu, root is dash, normal user is bash. (refer: What's the Ubuntu's default shell?)
Why ...
4
votes
3answers
103 views
Effectivity of shred on different file systems
man shred warns that the command is not useful on file systems that don't overwrite in-place. I don't have much knowledge about the current and upcoming file systems, but I would suspect that many of ...
3
votes
1answer
73 views
How does having /dev/fd make running shell scripts under sudo safe?
At the end of the man page for sudo, there's the following remark:
Running shell scripts via sudo can expose the same kernel bugs that
make setuid shell scripts unsafe on some operating systems ...
3
votes
1answer
346 views
How to configure permissions to allow apache to securely have access to a file in a shared environment?
This is a follow up question from my previous, but I felt it might be more Linux based.
http://serverfault.com/questions/414207/how-to-set-linux-permissions-to-allow-apache-to-have-access-to-a-file
...
3
votes
2answers
434 views
If you SSH into another computer, how to access other X displays?
This is a query based on personal use. A troll in our local network had downloaded Crikey, the key-event simulator. He used it to simulate events on other computers, leading to unwanted things. For ...
3
votes
3answers
227 views
Setting execution right to whole directory - is it good or bad idea?
I have a zip file containing lot of files and directories for a certain application which should be running on Linux. Some files needs to be set as executable, but the zip file format afaik does not ...
3
votes
2answers
571 views
What directories/file permissions should i ensure are set?
I have a similar question about default software configuration. For this question i would like to ask
What directories/file permissions should i ensure are set?
Aprrently Is it normal to get ...
3
votes
1answer
177 views
Is there a standard way to configure what policy iptables loads on startup under Debian?
I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration.
One thing I'd like to configure is a default packet filtering policy. ...
2
votes
3answers
163 views
How can I securely login remotely to my Linux box over the internet?
I'm pretty much a Linux beginner, but this question has been on my mind. What's the simplest, most secure way to connect to my computer at home from work or from the library, &c? I'm running Mint ...
2
votes
3answers
373 views
Stracing su and ssh shows the password. Is this a security flaw or am I missing something?
I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the ...
2
votes
1answer
772 views
iptables rule to allow access to internet
I made default policy of my machine-
iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL
INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
2
votes
1answer
288 views
Debian unstable chroot security issues
This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot.
When doing this, ...
2
votes
3answers
901 views
Private VLAN's under Linux?
http://blog.ine.com/2008/07/14/private-vlans-revisited/
Has anyone tried private vlan's under Linux? Any experiences with them? My real question is does anybody have howtos regarding this?
1
vote
1answer
118 views
Default configuration I need to change?
A few days ago I installed a new linux os. Today i realize /root has o+r (755) so EVERYONE is able to see my root sql password in /root/.my.cnf. I freaked out and simply changed /root to 750.
My ...
1
vote
2answers
109 views
How would you create a user with the HOME_DIR field in /etc/passwd completely blank?
Closest I can come is:
useradd --home / -r --shell /sbin/nologin someuser
But this creates an entry into /etc/htpasswd that looks something like this:
someuser:x:100:100::/:/sbin/nologin
I want ...
