Content related to computer security.
72
votes
7answers
7k views
Which is the safest way to get root privileges: sudo, su or login?
I would like to have the root account in safety even if my unprivileged user is compromised.
On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
33
votes
5answers
18k views
Allow setuid on shell scripts
The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor:
> cat setuid-test.c
#include <stdio.h>
#include <unistd.h>
int ...
31
votes
2answers
10k views
Why is there a big delay after entering a wrong password?
I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
26
votes
4answers
2k views
Is there any way to keep a command from being added to your history?
Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
24
votes
3answers
1k views
Why shouldn't someone use passwords in the command line?
Why do people fear writing passwords in the command line?
The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
24
votes
4answers
761 views
Execution of possibly harmful program on Linux
I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it.
I was thinking ...
24
votes
1answer
458 views
What would be the best way to work around this glibc problem?
I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc).
Infact, the only binary I have left is ...
19
votes
7answers
8k views
What's the difference between /sbin/nologin and /bin/false
Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
19
votes
3answers
718 views
Can other users view the arguments passed to a command?
If I invoke a command with arguments like so:
bob@bob-pc:~$ command -arg1 -arg2
...can other users view the arguments passed to the command?
19
votes
1answer
4k views
Mutt: how to safely store password?
My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt?
set imap_user = "username@gmail.com"
set ...
17
votes
3answers
789 views
Is it secure to leave a root shell running in detached screen session?
I'm curious about the security of leaving a root shell running inside a detached screen session. I typically never do this.
Aside from the potential of my non-root user account being compromised ...
16
votes
10answers
930 views
How to create strong passwords in Linux?
I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
16
votes
4answers
608 views
Is there any way attacker could use mkdir to compromise a system?
I'm setting up a restricted user account for user ricardo, a troublesome user on my system. I want to grant him the right to make directories using sudo, which he sometimes needs to do. I'm ...
16
votes
1answer
634 views
Is it safe to give out my SSH public key for work?
I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the ...
16
votes
5answers
990 views
Does installing and using Wine open up your Linux platform to windows virus'?
Just wondering if installing wine might open up a fairly solid linux desktop to the world of windows virus'. Any confirmed reports about that?
Would you then install a windows antivirus product ...
13
votes
8answers
1k views
How can we limit the impact of ssh probes?
My webserver is constantly attacked by various IP addresses. They try five passwords and then change the IP address.
I have done various lockdowns like using ssh-keys and not permitting passwords, ...
13
votes
4answers
2k views
How to detect and remove a Linux trojan?
I recently (re)stumbled upon this:
Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd)
Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
13
votes
1answer
4k views
Why are the first 1024 ports restricted to the root user only?
This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
13
votes
3answers
305 views
Securely delete files on btrfs filesystem
Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk.
...
11
votes
3answers
292 views
What specific vulnerabilities am I creating by disabling the sudo password?
Here are some instructions on how to disable your sudo password. These carry the following warning
If you disable the sudo password for your account, you will seriously compromise the security of ...
11
votes
4answers
2k views
What are the pros/cons of the various methods to block brute force SSH attacks?
There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example:
DenyHosts
Sshguard
fail2ban
What are the pros/cons ...
11
votes
2answers
295 views
How can I be sure that a directory or file is actually deleted?
I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later.
How can I ensure that a directory I had deleted will actually be removed from the disk? Are ...
11
votes
3answers
5k views
How should one set up full-disk encryption on OpenBSD?
Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux?
I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...
11
votes
3answers
340 views
Prompt user on Linux security denial
Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
10
votes
11answers
910 views
Concern about logging in as root overrated?
For personal linux on my personal notebooks, I've usually set my environment to autologin as root even under X or lower runlevels. I've found my workflow is very pleasant and fast, without any ...
10
votes
4answers
1k views
Why do we need a firewall if no programs are running on your ports?
When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if ...
10
votes
7answers
526 views
10
votes
4answers
5k views
How do I recursively shred an entire directory tree?
I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding.
How can I shred an entire directory tree ...
10
votes
6answers
464 views
Which linux distro's package repositories are secure and which are not?
Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure ...
10
votes
5answers
929 views
Best way to do full disk encryption?
I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
10
votes
2answers
903 views
How to safely pass variables to root-enabled scripts?
This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
10
votes
1answer
159 views
Can entropy consumption at program start be prevented?
I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program ...
10
votes
3answers
2k views
Why does the 'bin' user need a login shell?
During an audit of /var/log/auth.log on one of my public webservers, I found this:
Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 ...
10
votes
3answers
833 views
Can SSH passwords be sniffed out over Wi-Fi?
When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).
10
votes
2answers
2k views
What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?
I am planning to go back to Linux as a Desktop machine.
I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server.
What would be a good, ...
10
votes
1answer
594 views
Why aren't the Fedora GPG keys signed?
Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https.
For example the checksum ...
10
votes
2answers
523 views
How do I prevent programs from sniffing keystrokes to su/gksu?
I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
9
votes
7answers
1k views
What's the best way to format a HDD in Linux in order to leave no trace?
I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
9
votes
4answers
651 views
How exactly do people “crack” Unix/Linux Systems?
No im not looking to become a cracker or something like that, but Im trying to figure out the process (more from a programming perspective).
So im assuming (guessing) a cracker's main goal is to gain ...
9
votes
3answers
770 views
Is it safe to close shell just by clicking “X” or using “ctrl+d”?
Is it safe to close shell just by clicking "X" or using "ctrl+d" while logged in as root with su or is it safer to close it by typing "exit"? Is there any difference (security-wise) at all or is it ...
9
votes
2answers
1k views
Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?
I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
9
votes
5answers
702 views
Monitoring activity on my computer.
So recently I found that someone has been using my computer without consent, browsing folders, etc....
I could change all my passwords straight away, but I'm curious as the what the intruding party ...
8
votes
4answers
132 views
What is Linux for SET FILE/ERASE_ON_DELETE?
In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment:
$ SET ...
8
votes
2answers
3k views
How can I determine if someone's SSH key contains an empty passphrase?
Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers.
We're concerned that some of these people use an unencrypted ...
8
votes
3answers
329 views
Physically break into box? (Memory & disk)
I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it ...
8
votes
2answers
2k views
How come no core dump is create when an application has SUID set?
I setup my environment to create a core dump of everything that crashes, however when I run an program with SUID set on a different user than the executing user it doesn't create a core dump. Any ...
8
votes
3answers
2k views
What is the point of sshd “UseDNS” option?
I know what it does, but i don't know why. What attack(s) does it prevent ?
Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
8
votes
1answer
150 views
Does ssh-agent store my passphrase?
Is it possible to determine the passphrases of private keys added to ssh-agent?
I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
8
votes
7answers
2k views
How do I encrypt git on my server?
Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring ...
8
votes
4answers
217 views
Good practice to use same SSH keypair on multiple machines?
I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...
