Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

learn more… | top users | synonyms

122
votes
9answers
13k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
108
votes
2answers
18k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
107
votes
7answers
69k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
101
votes
8answers
18k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
87
votes
3answers
3k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
86
votes
3answers
19k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
73
votes
8answers
80k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
68
votes
2answers
8k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
65
votes
20answers
11k views

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a ...
60
votes
3answers
15k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
57
votes
6answers
5k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
53
votes
5answers
45k views

What is the point of sshd “UseDNS” option?

I know what it does, but i don't know why. What attack(s) does it prevent ? Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
53
votes
4answers
13k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
51
votes
4answers
7k views

Is there any way to keep a command from being added to your history?

Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
43
votes
7answers
25k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
40
votes
2answers
6k views

Is it safe to give out my SSH public key for work?

I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the .ssh/...
38
votes
10answers
13k views

How to trigger a system self destruct with a certain password is entered

How do I configure my system to destroy all personal data when a certain password is entered? The motivation behind this being NSA stuff. I imagine there being three primary usage cases. At login, ...
35
votes
4answers
124k views

SSH login with clear text password as a parameter? [duplicate]

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I won't have access to ...
33
votes
4answers
2k views

Why can't I execute shutdown when the permission is rwxr-xr-x?

I'm in /sbin and I see that shutdown has permissions rwxr-xr-x. Doesn't this mean that anyone can execute it?
32
votes
7answers
9k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
32
votes
3answers
11k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
31
votes
4answers
2k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
31
votes
2answers
90k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
30
votes
8answers
2k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
29
votes
3answers
3k views

Why shouldn't someone use passwords in the command line?

Why do people fear writing passwords in the command line? The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
29
votes
4answers
1k views

Execution of possibly harmful program on Linux

I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it. I was thinking ...
29
votes
1answer
19k views

Why are the first 1024 ports restricted to the root user only?

This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
27
votes
3answers
3k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
27
votes
3answers
14k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
26
votes
1answer
762 views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
25
votes
6answers
4k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd....
25
votes
6answers
31k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
23
votes
4answers
1k views

Is there any way attacker could use mkdir to compromise a system?

I'm setting up a restricted user account for user ricardo, a troublesome user on my system. I want to grant him the right to make directories using sudo, which he sometimes needs to do. I'm ...
23
votes
1answer
1k views

Can another program on X capture my root password while I type it in a virtual terminal?

Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account ...
22
votes
3answers
68k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
22
votes
3answers
7k views

Why does the 'bin' user need a login shell?

During an audit of /var/log/auth.log on one of my public webservers, I found this: Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=...
21
votes
11answers
7k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
21
votes
3answers
1k views

Can other users view the arguments passed to a command?

If I invoke a command with arguments like so: bob@bob-pc:~$ command -arg1 -arg2 ...can other users view the arguments passed to the command?
21
votes
5answers
3k views

Does installing and using Wine open up your Linux platform to Windows viruses?

Just wondering if installing Wine might open up a fairly solid Linux desktop to the world of Windows viruses. Any confirmed reports about that? Would you then install a Windows antivirus product ...
21
votes
5answers
13k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
20
votes
3answers
5k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons ...
20
votes
4answers
43k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
19
votes
6answers
91k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
19
votes
2answers
3k views

How to avoid escape sequence attacks in terminals?

Reading the details of CVE-2009-4487 (which is about the danger of escape sequences in log files) I am a bit surprised. To quote CVE-2009-4487: nginx 0.7.64 writes data to a log file without ...
19
votes
3answers
2k views

Securely delete files on btrfs filesystem

Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk. ...
18
votes
7answers
15k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
18
votes
4answers
12k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
18
votes
3answers
2k views

Is it secure to leave a root shell running in detached screen session?

I'm curious about the security of leaving a root shell running inside a detached screen session. I typically never do this. Aside from the potential of my non-root user account being compromised (...
18
votes
2answers
6k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
17
votes
2answers
956 views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...