Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

5
votes
0answers
100 views

Taking a picture with a laptop webcam after entering an incorrect password

I'd like to set up my laptop so that if a wrong password is entered when the screen is locked, a picture is taken using the laptop's webcam. I examined xlock (from xlockmore package), but there is no ...
4
votes
0answers
61 views

Exploit in bash script parameter possible?

I want to pass an e-mail address from a web form to a bash script. I'm using the following regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}/ Is this sufficient? Or could one embed an exploit?...
4
votes
0answers
49 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this case,...
3
votes
0answers
32 views

Can't disable TLSv1 and RC4-SHA

I need to remove TLSv1 and RC4-SHA support in Centos 7. I have these lines in my ssl.conf SSLProtocol +TLSv1.2 +TLSv1.1 -TLSv1 SSLCompression off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-ECDSA-...
3
votes
0answers
41 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
3
votes
0answers
157 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
3
votes
0answers
44 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
3
votes
0answers
72 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I have stucked up on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting ...
3
votes
0answers
118 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the following:...
3
votes
0answers
244 views

How many rings does OpenBSD use?

Usually a Windows/Linux operating system uses afaik max 2 rings But how many rings does OpenBSD use?
3
votes
0answers
1k views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user login,...
2
votes
0answers
16 views

What are the most restrictive external firewall / DNS listening port settings I can have for my DNS server (internal clients only)

This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services). This is about the externally-facing side ...
2
votes
0answers
47 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (...
2
votes
0answers
30 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
2
votes
0answers
38 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
0answers
43 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
2
votes
0answers
266 views

Where to put the SElinux policy to allow acpid shutdown the system?

I'm using Centos7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
2
votes
0answers
165 views

Security of sudo not asking for a password after the first time

After using sudo and entering a password to do so, sudo remembers that we have entered a password and we do not have to enter a password the next time we use it. I am concerned about the possibility ...
2
votes
0answers
37 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...
2
votes
0answers
32 views

Tails OS:Network Filtering Syntax to Allow I2PBrowser to listen at localhost:6666, Then Allow TorBrowser User to Connect to it

I've had a bit of experience in Linux, but I'm still learning and brand new. I've been able to proxy Tor right into I2P on a normal Debian Wheezy installation successfully. My process involves ...
2
votes
0answers
226 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...
2
votes
0answers
175 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
2
votes
0answers
44 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access control?...
2
votes
0answers
223 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
2
votes
0answers
563 views

Cannot connect to ssh server

I am having trouble connecting to my ssh server. It responds with a lengthy error message about no network etc. but it is the last message that concerns me: Sometimes, such troubles can be caused ...
2
votes
0answers
89 views

What information is sent from client to the server when a SSH connection is established?

So let's say I'm on machine A and connect to machine B, and then from there I connect to machine C (with three different usernames). So the SSH connections are: A (john) --> B (eli) --> C(bill) ...
2
votes
0answers
30 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
2
votes
0answers
665 views

How to secure Apache/MySql/PHPMyAdmin against brute force/dictionary attacks? (Fail2ban?)

I'm wanting to run a publicly accessible server for web hosting. I'm interested in preventing brute force attacks made against PHPMyAdmin or any other form of authentication process I may include in ...
2
votes
0answers
883 views

Intel Advanced-N 6235 wireless monitor mode problem

As far as I know, iwlwifi drivers (and this particular wireless card) support monitor mode. The only requirement is to install the latest driver from http://wireless.kernel.org/en/users/Drivers/...
2
votes
0answers
179 views

Ubuntu : puppet f5 device config : Partition '' doesn't exist

This is a Puppet question that I've posted on the PuppetLabs forums with no response. I'm also posting here because I'm hoping that with a wider audience I might find someone knowledgeable re Puppet ...
2
votes
0answers
144 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
2
votes
0answers
133 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude me,...
2
votes
0answers
428 views

Information about the 1630/master app

When I run $ sudo netstat -a --programs | grep LISTENING | grep 1630 I will get this output. Do you know what good are processes running under this app name? Why they I running on my system and if ...
2
votes
0answers
130 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName 255.255....
1
vote
0answers
23 views

Encrypt directory on Linux

I need to create an encrypted directory (to be then filled with files and subdirectories) in a Linux ext4 filesystem, accessible to just one user. It should be: visible (just the root) from the non-...
1
vote
0answers
22 views

Iptables restrict all, allow multiple specified users to destination port

This great answer tells me how to prohibit all users from connecting to remote host on specified (in this case 25) port, except one user: iptables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p ...
1
vote
0answers
31 views

How to reboot a server with a LUKS encrypted partition

I have a CentOS 6 VM on which I used the following shell script for installing and configuring MongoDB to use a secondary LUKS (dm-crypt) encrypted disk for its database files: #!/bin/bash -e # Set ...
1
vote
0answers
8 views

Looking for a tool similar to the Security Advisor plugin for WHM that can run on CentOS 7 without WHM

The startup I'm working at is setting up some new CentOS 7 servers that will host a mobile application, and some of the data is sensitive, thus, the servers need to be secured to the best of our ...
1
vote
0answers
10 views

openvassd hanging

I have a problem with openvassd hanging while starting: connect(6, {sa_family=AF_LOCAL, sun_path="/tmp/redis.sock"}, 110) = 0 fcntl64(6, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) ...
1
vote
0answers
46 views

Greenbone/OpenVAS not starting tasks after reboot

I have Greenbone and OpenVAS installed on a Fedora machine. Configuration was OK and everything was working fine. After a reboot every attempt to start a task results in the browser waiting forever ...
1
vote
0answers
23 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
1
vote
0answers
55 views

Automatically manage whitelisting (e.g. in tinyproxy) of dynamic IPs?

I have a VPS that runs tinyproxy for private use, and another that runs nginx for development. Is there a protocol/daemon that I can use to automate whitelisting for my dynamic IP? So that tinyproxy ...
1
vote
0answers
34 views

Selinux inode security struct allocation

i'm trying to understand allocation of inode_security_struct in Selinux. I looked for a source code of selinux and there is only one allocation of this struct on line 230 in hooks.c file. This ...
1
vote
0answers
136 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
1
vote
0answers
35 views

BeEf Famework Kali-2 configuration

I am running Kali-2(rolling 1 latest) in Vmware workstation 12. I have forwarded my ports and am using NAT. The beef framework links only seem to work within the local network. Any specific reason? ...
1
vote
0answers
27 views

apply proper security labels during filesystem restore

When restoring a filesystem on a separate system (i.e., possibly a different system than the one where the filesystem was originally mounted and in use), I would like to apply the correct security ...
1
vote
0answers
54 views

dirmngr does not start with proper home directory unless it is restarted

I am trying to follow these guidelines for gpg best practices: https://help.riseup.net/en/security/message-security/openpgp/best-practices but I am having trouble with dirmngr, which handles all ...
1
vote
0answers
15 views

Need Help to Solve Screenlock Bypass Issue for Expired User Account

I have created a script that I deploy to my children's computers via Salt. The script implements allowed working hours and has worked well, but one of my children have found a way of bypassing this ...
1
vote
0answers
21 views

Benefit of using multiple checksums for a group in AIDE

What are the benefits to having all md checksum functions specified for a group when running AIDE? For example, what is the difference between defining the first line and the second line with less md ...
1
vote
0answers
70 views

Is this a Hacker? What to do?

My sites are hosted in a shared server at Hostgator. Server details: uname -a Linux xxxx.hostgator.com x.xx.x.x86_64 #1 SMP Fri May 1 18:21:30 CDT 2015 x86_64 x86_64 x86_64 GNU/Linux I was curious ...