Tag Info

Hot answers tagged

15

You could use something like this: grep "Failed password for" /var/log/auth.log | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \ | sort | uniq -c It greps for the string Failed password for and extracts (-o) the ip address. It is sorted, and uniq counts the number of occurences. The output would then look like this (with your example as input file): 1 ...


15

The literal answer is that there is no such thing as an untrusted application running under your account. If you want to run an untrusted application, run it under a different account or in a virtual machine. Typical desktop operating systems such as Unix and Windows and typical mobile operating systems such as Android and iOS have different security ...


13

The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in. By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before ...


11

Olivier D is almost correct, but you must set POSIXLY_CORRECT=1 before running unset. POSIX has a notion of Special Built-ins, and bash supports this. unset is one such builtin. Search for SPECIAL_BUILTIN in builtins/*.c in the bash source for a list, it includes set, unset, export, eval and source. $ unset() { echo muahaha-unset; } $ unset unset ...


9

Because access to the underlying device is controlled only by file permissions by default, so if your USB stick contains a POSIX filesystem with a world-writable device node corresponding to a real device in the system, you can use that device node to access the corresponding device as a "plain" user. Imagine a device corresponding to one of the audio ...


6

It might be a bloated solution but i suggest you look at installing something like Fail2Ban It is made for this kind of logging + adds the bonus of being able to add (temporary) rules in your firewall to block repeating offenders. Be sure to whitelist your own ip's though, i managed to lock myself out temporarily on a few occasions


5

I realize if someone controls your environment you're probably screwed anyway Yes, that. If you run a script in an unknown environment, all manner of things can go wrong, starting with LD_PRELOAD causing the shell process to execute arbitrary code before it even reads your script. Attempting to protect against a hostile environment from inside the ...


5

It's very difficult, and more of a policy decision than a technical one IMO. There's just too many workarounds to 'get data from one place to another'. You could disallow copy, but how would you prevent cat $file > /usb/$file? Simply not possible to do exhaustively. I would suggest therefore you instead disallow workstation access to files, and ...


3

No, you can't. If they can read the files they can copy them. EDIT: I've been thinking about it and maybe you can do something. If those files should only be accessed by a couple of programs (You said something about CAD files) maybe you can set the program owner to a new user (let's say CADuser) and change the permissions of all those files so that only ...


3

You can use pam-tmpdir for this. It creates a directory for each user that logs in, at the start of their PAM session. See How to remount filesystem at logout? for a little more context... In Debian, Ubuntu and derivatives it's available in libpam-tmpdir.


3

As a follow-up of my comment: Run the following command on one shell. You can make a shell script of it or demonize with the -d option. inotifywait -m -r -e open --format '%f' /kernel_sources/directory/in_use/ -o /home/user/kernel_build.log On other shell, execute make The log file /home/user/kernel_build.log will have a list of the files that have been ...


3

Nothing running under X is isolated from other programs running under X. A program running on an X server, using the X11 protocol, can check which other windows are open. There are several other security issues with X11. When configuring sshd, I've only ever seen recommendations for turning access through X off, never on. Wayland is supposed to be an ...


3

First, anyone who claims Linux (or any other non-toy OS) is impenetrable is foolish, at best. Some are harder to penetrate than others (OpenBSD is famous for being one of the harder ones); many (including Linux, and even Windows Server) can be secure if maintained by competent admins with sufficient organizational support (enough time, resources, etc.). The ...


3

Linux is a very secure system, however it isn't full free of vulnerabilities. There are malware known as rootkits that can get to a Unix/Linux system and steal information, destoy data,etc. However for rootkits being successful the system must be insecure / bad managed, just because a Linux system is as secure as its administrator is aware of security. ...


2

Requirements for which I will offer solutions, as bullet points: Passwordless root console login Passwordless root remote login from pre-authorised users Passwordless remote login for specified accounts from pre-authorised users Passwordless remote login for any account from pre-authorised users The following examples are based on Debian, since that's ...


2

It's not possible to switch to an arbitrary user / group without superuser access. Utilities like su and sudo switch to root via the suid bit and then enforce whatever privilege system they're designed to provide. It's unlikely that there were any files with a suid/sgid bit that didn't require it, so you broke stuff across the board. There are probably still ...


2

You have to have someone have access to the root account to provide additional privileges. Beyond that, you can use sudo to limit effect areas of control for other administrators without giving them root. But overall, what you're describing seems to be more of a political / training issue than a technical issue. Hire the right staff, and they won't get in ...


2

There was such a way, but you needed to have prepared for it already. (Kind of like how the fire insurance people won't sell you a new policy for a smoking hull.) The two most common programs that do this are AIDE and Tripwire. They scan your system, build a database of what's there, and let you save that off to some durable storage medium off-machine, so ...


2

I guess we are talking about YOUR system here. Since you own the system the fastest way would be to change it. If you are in the sudoers, you can sudo bash and then passwd to change root password. If you're not, start your system with any live CD you have around, mount the drive where your system is in /mnt for instance, chroot to /mnt or where you ...


2

So what I think you want to do is get a list of listening ports and then remove them from the "Local Address:Port" column of ss output, I'm using \s{2} in the grep to attempt to only match on the "Local Address:Port" column. Normally I might try to use the filtering functionality of ss, like with ss -tn state established '(sport != :<port1> and sport ...


2

It's really up to you. The benefit of setting up jails is that you're going to separate security issues that come up between the jails, as well as making it easier to upgrade and manage them separately, which can increase reliability. The downside of setting up the jails of course is that you have to learn it, it's a bit of management overhead, etc. ...


2

You have several options like adding the host you want to connect to into the /etc/hosts file: vi /etc/hosts, add: 10.0.0.1 host.where.i.want.to.connect.to make sure that 10.0.0.1 is an IP address which does not exist in your network. Using this method you are overriding the resolving of the host you have configured in your my_program.rb application. If ...


2

TL;DR: It's probably just a typo. Long answer As a quick search shows, vftovp could be a tool in the TeX suite to convert a virtual font metric to a virtual property list. So, the original tool would not be something to be concerned of. Two questions are remaining: Who executed this tool on your machine? Is the binary on your system really this TeX ...


2

I like Gilles's answer but there's another aspect to consider: A principle of unix is that each program is supposed to "do one thing well". Programs weren't supposed to get so big and complicated that the user wouldn't be able to predict the result of running one. If a proper unix program touches a file, it's because you told it to touch that file. The ...


1

The simple fact is that if a person can arbitrarily install programs then they probably can install a program that will run under root privileges, so they could install programs that would grant them other types of access. IE any person who can install or modify something that is run as root, is or can easily become root. If you want to separate out your ...


1

sudo has ways to give users access to some, but not all, commands through sudo. You can use the visudo command to safely edit the /etc/sudoers file, with some syntax checking before the file is really saved. Inside the file, you can add a line like mike ALL=(root) /usr/bin/aptitude, /usr/bin/apt-get to give mike access to aptitude and apt-get through sudo, ...


1

It depends on how users change their passwords. If they just use passwd it's not hard for root user to replace an actual passwd binary with a compromised equivalent. Most people don't have a habit of obsessive checking whether passwd is a binary or a shell script or whether it comes from a legitimate source. But finally, the most important thing is that ...


1

Yes, of course. The superuser can replace the programs that read the user's password (login, passwd, …) by versions that do their job, plus write the password out to a log. The superuser can also replace the kernel by a kernel that modifies the way programs like ls, md5sum, lsof, etc. work so that they report the modified programs looking like the normal ...


1

You stipulate that you are allowed to run sudo mount with any arguments. In that case, unless I misunderstand your question, it seems to be trivially easy to gain root access: just create a disk image that contains a setuid-root binary and mount it with sudo mount -o loop! After all, anyone can create a disk image, it's just bytes... To prove it, here's a ...


1

Just recently I came over the issue with my Company's apt repository. The problem was that if we use standard http transport anybody else can get package easily. As Company is packaging its own proprietary software and does not want to share it with everybody, http transport becomes a problem. Not a tragedy but a problem. There is couple of ways how to ...



Only top voted, non community-wiki answers of a minimum length are eligible