Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

4
votes
0answers
51 views

SSH server listening on multiple ports with passwordless access not allowing connections to second port

I have my Synology NAS running an SSH server listening on the default port 22 and I set up passwordless authentication with a public/private key and a passphrase: From sshd_config: ...
3
votes
0answers
40 views

Is there a technical reason why ssh-agent lacks a sudo-like inactivity/idle timeout feature?

There are some brief discussions about the existing ssh-agent -t feature at [1], and there was a post as far back as 2001 on debian-devel [2] wishing for an inactivity timeout feature. There's a ...
3
votes
0answers
71 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
2
votes
0answers
36 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
2
votes
0answers
34 views

Are there risks to auto-login/passwordless login other than physical access control?

Does auto-login/passwordless login leave the computer in exactly that same state as it would be after manually logging in, or does it create security risks of a type other than physical access ...
2
votes
0answers
60 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the ...
2
votes
0answers
234 views

Cannot connect to ssh server

I am having trouble connecting to my ssh server. It responds with a lengthy error message about no network etc. but it is the last message that concerns me: Sometimes, such troubles can be caused ...
2
votes
0answers
519 views

Intel Advanced-N 6235 wireless monitor mode problem

As far as I know, iwlwifi drivers (and this particular wireless card) support monitor mode. The only requirement is to install the latest driver from ...
2
votes
0answers
102 views

CUPS and printer security

I would like some help on securing a networked printer. Specifically, I'm interested in the following: 1) Preventing unauthorized access to the printer: I would like only certain laptops that connect ...
2
votes
0answers
140 views

Ubuntu : puppet f5 device config : Partition '' doesn't exist

This is a Puppet question that I've posted on the PuppetLabs forums with no response. I'm also posting here because I'm hoping that with a wider audience I might find someone knowledgeable re Puppet ...
2
votes
0answers
119 views

Understanding getlogin spoofing

My question is in three (or so) related parts: 1) My understanding is that getlogin() will effectively return the auid associated with the process and so isn't actually changable by the user. Is that ...
2
votes
0answers
209 views

How many rings does OpenBSD use?

Usually a Windows/Linux operating system uses afaik max 2 rings But how many rings does OpenBSD use?
2
votes
0answers
119 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName ...
2
votes
0answers
885 views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user ...
1
vote
0answers
33 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...
1
vote
0answers
50 views

md5 password hash

I'm looking to create a md5 hash to use in /etc/shadow. Someone suggested using grub-crypt. Every time I put the same password in I get a different hash. [root@endpoint ~]# grub-crypt --md5 Password: ...
1
vote
0answers
13 views

Finding out the script causing MySQL failed connections

I see lot of lines in mysql.log Connect Access denied for user 'M'@'localhost' (using password: NO) I am sure I don't have such a user on my system. I need to figure out what script is ...
1
vote
0answers
25 views

How do I securely automate inputting passwords?

I would like to automate an SSH connection so that I wouldn't have to enter password and I am not allowed to use authorized_keys. I was thinking about making an expect script but I don't know where I ...
1
vote
0answers
27 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
1
vote
0answers
29 views

How can I set a group policy to all access on all folders except one?

I am currently making a test environment where users will be going through a network administration course with different levels they must complete. Due to the nature of the course, we want to give ...
1
vote
0answers
41 views

Is there a solution for scanning webserver files for malicious code?

I have seen several times people move code into web servers now that had malicious code embedded into their HTML, php and other documents. These then get served up from the new server until they are ...
1
vote
0answers
80 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
1
vote
0answers
65 views

Files associated with Thunderbird - Security mechanism for local storage

I am trying to know how Thunderbird stores the mails, associated files in the local machine. I use Ubuntu 13.10 and Thunderbird 24.6.0. When I see in the local profile folder in the location in ...
1
vote
0answers
23 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
1
vote
0answers
85 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
1
vote
0answers
72 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
1
vote
0answers
17 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
1
vote
0answers
72 views

Limit program execution to a list of arguments

I would like that my Unix users can only run a specific command insecurecommand with a controlled list of arguments stored in a file. The only solution I have found at this time is to : Create a ...
1
vote
0answers
17 views

backupninja: password outside config file

I would like to use a dup rule in backupninja to make an encrypted remote backup. The configuration file format includes entries for the encryption and ftp password. I would like to move them out of ...
1
vote
0answers
68 views

What information is sent from client to the server when a SSH connection is established?

So let's say I'm on machine A and connect to machine B, and then from there I connect to machine C (with three different usernames). So the SSH connections are: A (john) --> B (eli) --> C(bill) ...
1
vote
0answers
18 views

AppArmor: make it ask me for decision to allow/disallow

I'm having fun writing AppArmor profile for firefox. I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions ...
1
vote
0answers
37 views

I'm wondering about CUPS security. What can I do?

I run Debian Wheezy on a old Acer Aspire One ZG5 model netbook as a server. I have a printer shared to all my other systems and I'm worried about security. On the server I have IPtables set up to ...
1
vote
0answers
88 views

What keys are generated during Debian 7.4 (Wheezy) installation?

We are concerned lest /dev/random (or /dev/urandom) be hit too early in the installation process for adequate entropy to be developed. In a basic Debian 7.4 installation (SSH Server and basic ...
1
vote
0answers
170 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
1
vote
0answers
338 views

Unable to set capability CAP_SETFCAP by user

The question is about capabilities. I need to allow user to set capabilities using setcap. When I call it by root all goes fine, eg $ sudo setcap cap_dac_override,cap_dac_read_search+ep ./bin_file $ ...
1
vote
0answers
381 views

How to secure Apache/MySql/PHPMyAdmin against brute force/dictionary attacks? (Fail2ban?)

I'm wanting to run a publicly accessible server for web hosting. I'm interested in preventing brute force attacks made against PHPMyAdmin or any other form of authentication process I may include in ...
1
vote
0answers
132 views

Assigning an identity to an IPsec policy in Linux

Page 36 of RFC2367 (PF_KEYv2 Key Management API) states that when the kernel needs an IPsec security association for an outbound packet, but does not have one, it will ask the key management daemon ...
1
vote
0answers
324 views

maldet and possible false positives?

I have been using maldet for many months and it's worked fine up until now. As of about a week ago, it is detecting a mass {HEX}PHP.Bypassshell in nearly every PHP file. I even downloaded a clean copy ...
1
vote
0answers
155 views

Reverse ssh-agent forwarding and unlocking remote keys with your local keys

So the following two things should both be possible to do with ssh the question is just how difficult they would be and I'm hoping someone can give me an easy answer. 1) Suppose I have several ...
1
vote
0answers
44 views

ufw in laptop running Ubuntu

I installed ufw and enabled it. The status is: Status: active Logging: on (low) Default: deny (incoming), deny (outgoing) New profiles: skip But, I am able to navigate the web, get emails and ...
1
vote
0answers
380 views

How to add my own created certificate authority to system trusted repositories

I was told that I can add my created CA to trusted repositories/authorities in my system instead of adding it from browser and configuring in in ssl.conf. Yet I can't find anything similar on the ...
1
vote
0answers
125 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude ...
1
vote
0answers
631 views

Using Metasploit with 3G USB modem

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host ...
1
vote
0answers
88 views

Running Tomcat MySQL and Apache under a group

I am trying to set up a web server at home using Ubuntu, but prefer my bash scripts to be platform agnostic hence why I am asking here. I also dislike apt-get everything. I am trying to create a ...
1
vote
0answers
1k views

Symbolic link to a socket

From a security point of view, is it safe to create a symbolic link to a socket file? The following bits of context refer to the deployment of a web application on a shared hosting service. $ ls -al ...
1
vote
0answers
272 views

Information about the 1630/master app

When I run $ sudo netstat -a --programs | grep LISTENING | grep 1630 I will get this output. Do you know what good are processes running under this app name? Why they I running on my system and if ...
1
vote
0answers
495 views

How to make dnsmasq avoid DNS cache poisoning?

Some domain gets DNS cache poisoning if dnsmasq is the nameserver. But the problem is gone if switch to BIND (named). Is there a easy configuration of dnsmasq so that DNS cache poisoning can be ...
0
votes
0answers
13 views

Is user/filesystem access separation of services enough to have well secured data of services?

I'm about to publish some of my projects. So, I'm gonna to re-install my VPS and do it properly. I'll have running on it Apache server(websites are made using Ruby and Python), databases. I'll also ...
0
votes
0answers
19 views

why do we have same chains in different tables of “iptables firewall” in linux?

why do we have same chains in different tables of "iptables firewall"? Like for example: we have "output" chain in filter table, nat table & mangle table.
0
votes
0answers
15 views

Returning from a sleep the desktop displays shortly (before entering password), privacy issue

OS: Linux mint 17.1 Cinnamon 64-bit Cinnamon version 2.4.6 Intel Celeron: 900 @ 2.20Ghzx1 Memory 2 Gb Graphics Card: Intel Mobile 4 series integrated When I return to my computer after it has been ...