Hot answers tagged

95

The concern is whether your password is recorded in the authentication log. If you're logging in on a text console under Linux, and you pressed Ctrl+C at the password prompt, then no log entry is generated. At least, this is true for Ubuntu 14.04 or Debian jessie with SysVinit, and probably for other Linux distributions; I haven't checked whether this is ...


34

You don't need the paranoia at all. GNU tar — and in fact any well-written tar program produced in the past 30 years or so — will refuse to extract files in the tarball that begin with a slash or that contain .. elements, by default. You have to go out of your way to force modern tar programs to extract such potentially-malicious tarballs: both GNU and BSD ...


19

Debian has security tracker which shows status of the CVE's in all supported releases. Here is your: https://security-tracker.debian.org/tracker/CVE-2015-8041 You can check it is fixed in version 2.3-1+deb8u3. The fix was probably backported to the older version, which prevents breaking other things with rebase to new version in stable release (point of ...


18

With GNU tar, it's simply tar -xvf untrusted_file.tar in an empty directory. GNU tar automatically strips a leading / member names when extracting, unless explicitly not told otherwise with the --absolute-names option. GNU tar also detects when the use of ../ would cause a file to be extracted outside of the toplevel directory and puts those files in the ...


14

First off, sudo all by itself, doesn't send any emails or create warning messages, other than logging your unsuccessful attempt to the log. People who observe these logs and correlate events (most probably using a scripted log watcher), see that some user id, which happened to be yours this time, is trying to gain root access where he/she is not permitted. ...


11

Found the details here: The -exec action causes another program to be run. It passes to the program the name of the file which is being considered at the time. The invoked program will typically then perform some action on that file. Once again, there is a race condition which can be exploited here. We shall take as a specific example the command ...


7

I was trying to follow some linux instructions that involved sudo This is the threat. A user who doesn't know or understand what he or she is entering into their terminal with sudo privileges can cause very bad things to happen very quickly. It sounds like the admin didn't really explain to you that trying to sudo isn't really the issue, (in theory you ...


6

To cover a few points the other answers haven't: First, look what's in the file before you extract it: tar -tvf untrusted_tar_file.tar If there's anything in there you don't trust or want to extract, don't extract the tarball. Second, extract the tarball as a non-root user that only has write access to the one directory you're extracting the tarball ...


5

dm-crypt is a transparent disk encryption subsystem. That being said, it's better suited to encrypt disks and partitions. It can encrypt files, but they have to be mapped as devices for this to work. If you want to encrypt only one file, GnuPG could be a better tool. Example: gpg -c filename See Also: nixCraft: Linux: HowTo Encrypt And Decrypt Files ...


4

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright. $ sudo lastb [sudo] password ...


3

As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...


3

My personal favourite is: create a Raid1 Software Raid (mdadm) do regular incremental backups do weekly full-backups. The software raid1 protects you from online-faults, such that the volume is active ALWAYS, as long as one drive is okay. The software raid automatically syncs the contents between the drives, so you always have the up-to-date data ...


3

I can't speak to your specific situation; you'll have to ask your sysadmin why they chose to yell at you. But I can tell you why sudo reports these incidents: Because there is no legitimate reason for them to happen. You do not have root. You should know that you don't have root (and if somehow you don't, you can check with sudo -l). You have no business ...


3

If your hardware is not physically secure, nothing you do in software will give you physical security. Don't bother encrypting unless you have a separate, secure location for the key. Full disk encryption on a computer is useful when someone types in the (password to derive the) key at boot time. Full disk encryption can also be done if the key is on a ...


3

Yes, to a limited extent. But you don't have to. There's a package called unattended-upgrades that will do it for you. Description-en: automatic installation of security upgrades This package can download and install security upgrades automatically and unattended, taking care to only install packages from the configured APT source, and checking for dpkg ...


2

At step 1, try also doing this: systemctl disable firewalld.service systemctl stop stops the service immediately, but leaves it configured to start again whenever it would usually do so (i.e. on boot). systemctl disable removes it from the boot process. To stop it immediately and prevent it starting on next boot, run both. systemctl status ...


2

Removing access to other commands than su, will not inherently make your system more secure. First off you will not be able to prevent internal commands from running if you assign the user to known shell, except likes of rbash but rbash itself is a little more permissive and allow user to run some commands. If you can make a peace with that, you can use ...


2

If sudo is configured to send email and if the mailbox file hypothetical failed sudoers email goes to (or if the MTA is broken, the mail queue) is not or seldom monitored, and if a malicious local user is given sufficient time, and if disk usage on /var is not monitored, then a malicious local user may be able to fill that partition with mailbox or mailqueue ...


2

If you are neither God nor the Pope, you're not infallible, so prone to make mistakes. ;-) Therefore I would create 2 users: A user that can read everything but not change anything: adduser NormalUserName An "Admin" user that needs the sudo command to change anything. adduser AdminUserName adduser AdminUserName adm adduser AdminUserName cdrom adduser ...


2

A bug that allow a remote individual to crash the software (DoS) isn't exactly at the same level of risk as what we normally think of when we talk about "vulnerabilities". I wouldn't call this a "vulnerable" package; otherwise, you're elevating any bug that can cause the program to crash to a security "vulnerability". Also, it's not clear to me whether ...


2

Kees Cook implemented a sysctl to fill this need in early 2009. As documented in Documentation/sysctl/kernel.txt: modules_disabled: A toggle value indicating if modules are allowed to be loaded in an otherwise modular kernel. This toggle defaults to off (0), but can be set true (1). Once true, modules can be neither loaded nor unloaded, and ...


2

nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...


2

You can generate the NtPasswordHash (aka NTLM password hash) yourself as follows: echo -n plaintext_password_here | iconv -t utf16le | openssl md4 Prefix it with "hash:" in the wpa_supplicant.conf file, i.e. password=hash:6602f435f01b9173889a8d3b9bdcfd0b


1

I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...


1

If you put proxy settings in /etc/environment then every process running on the system will have access to the password. If you only want the proxy settings for your user then put the settings in a file that's read when you log in, typically ~/.profile. If you don't want the password to be readable by someone who steals the disk, encrypt your home ...


1

RAID1 will destroy everything in the case you make a mistake or a virus decides to destroy your files. But, it makes it easy to fix actual hard drive failures. rsync will cause downtime in the (very common) case that your primary hard drive fails, because you have to transfer the data back (or at least swap out the drives). But, it makes it easy to recover ...


1

Yes, it's always a very good idea to have an unprivileged account on the system to use when you do not need admin privileges. On systems with X Window (e.g. KDE, GNOME) this is practically mandatory. If you have console-only access it is recommended anyway to have it -- even if you're working all the time as admin. In fact, you should block remote ssh ...


1

The document you're reading is from the last century. I don't remember any system I've used this century that didn't use cookies (described in §8 of the document). With cookies, the first thing an application needs to do when it connects to the X server is to present the “cookie”, which is a password that's randomly generated when the server starts and ...


1

If you handle sensitive data and need high security I would think that a distribution focused on that specific goal would be worth to look into. One of those distributions is Tails which is based on Debian Stable. However Tails is normally only used as a "live system" instead of installing it to hard disk. What do you exactly want when you are asking for ...


1

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host and guest are simultaneously connected to internet via single USB modem. Usually virtual box (Vmware or other) creates its own own virtual subnetwork, ...



Only top voted, non community-wiki answers of a minimum length are eligible