Hot answers tagged

5

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright. $ sudo lastb [sudo] password ...


4

No, you have little control over how the private keys are configured, and you can't detect / enforce any passphrase requirement on them. You also can't limit the size of the keys without modifying the OpenSSH source itself (i.e. there is no configuration option to achieve a minimum key length limit). You can limit the type of public keys accepted using the ...


3

Sounds like a huge pain to me. I don't think you're actually gaining anything in security, either, as those (a) can only be written as root, so already likely game over if someone can write to them; (b) likely load a bunch of shared libraries, which aren't being checked. The sudoers manpage says the option "may be useful in situations where the user ...


3

It's possible for a user on the system (or a monitoring program that captures ps output) to see the password as a parameter to the groupadd process -- if the user or monitor "happens" to run ps while the groupadd process is running. The risk of that happening is small (the groupadd process will likely finish running fairly quickly), but non-zero. See an ...


3

This is normal. To understand it, let's see how file descriptors work and how they are passed between processes. You mentioned that you are using GLib.spawn_async() to spawn the shell script. That function, presumably, creates a pipe to be used for sending data into the child's stdin (or perhaps you create the pipe yourself and pass it to the function). To ...


3

As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...


3

They are described quite well in the standard AIX documentation. fsize : Identifies the soft limit for the largest file a user's process can create or extend. core : Specifies the soft limit for the largest core file a user's process can create. cpu : Sets the soft limit for the largest amount of system unit time (in seconds) that a user's process ...


3

It might be worth looking at the Filesystem Hierarchy Standard which describes what the various filesystems are generally for (from a standards perspective, not everyone has to follow it), which will let you know where personalised data might be stored. However, the short answer is - anywhere an application wants to store it, and has permission to store it. ...


3

No. The mount options trump all. That's what they're for: to ensure that nothing ever gets executed directly from that filesystem. To counter noexec, you can run most programs indirectly by invoking their launcher: If the program is a script (starting with a shebang), invoke the interpreter and pass it the script as its first argument. If the program is a ...


2

If you put proxy settings in /etc/environment then every process running on the system will have access to the password. If you only want the proxy settings for your user then put the settings in a file that's read when you log in, typically ~/.profile. If you don't want the password to be readable by someone who steals the disk, encrypt your home ...


2

nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...


2

The bash command history will be saved in the location specified by the $HISTFILE environment variable. Normally it will be in ${HOME}/.bash_history.


2

A PGP-signed list of hashes is available, covering all the release files. The PGP key used to sign this is well connected in the web of trust.


2

The easiest and most portable way to see "hidden commands" is probably using cat -v For instance, I might run "cat -v" and paste into that terminal to see the nonprinting characters. Further reading: How can I see what my keyboard sends? (ncurses FAQ)


2

You could do cat -v /usr/bin/vi to have it print the unprintable characters as ASCII representations, not as actual control characters that the terminal may try to process. Does that solve your problem?


2

You have pam_google_authenticator.so enabled in /etc/pam.d/common-auth. common-auth is included in (almost) every other file in /etc/pam.d/ - that's its purpose, to provide common authentication rules for programs that use pam. If you don't want every program to use google 2-factor auth, delete it from /etc/pam.d/common-auth.


1

No! The basic problem is that .profile is only read after you are succesfully logged in! At that point a full shell is already running, and most shells are made to serve the user, not to stop them from doing whatever they like. Let's see for example: # echo -en "echo byebye; exit" > ~foo/.profile # ssh foo@localhost foo@localhost's password: [...] ...


1

If you allow running almost any binary in the system binary directories, with arbitrary arguments, you almost certainly have allowed arbitrary access. Among other things, if you allow running an editor with arbitrary arguments, or mv, or a shell like bash, or a package manager like dpkg, or any program that supports writing data to files, then someone could ...


1

Your example code does not drop privileges! It can freely elevate privileges again by calling seteuid(euid). If you can ptrace it then you can make it call seteuid(euid) and thus execute privileged code. Are you asking this because you thought ptrace was read-only? No, it isn't: strace is just one thing you can do with it; ptrace allows the tracer to ...


1

Use the audit package to accomplish this task. Ensure the auditd service is running, and set to start on boot chkconfig auditd on Set a watch on the required file to be monitored by using the auditctl command : For e.g auditctl -w /etc/hosts -p war -k monitor-hosts That is: auditctl : the command used to add entries to the audit database. -w : Insert ...


1

It may depend on which distribution you are using, but in Fedora (and therefore in most or all Fedora-derived distributions including Red Hat Enterprise Linux and CentOS) the selinux-policy-targeted package includes a postinstall script with restorecon and fixfiles commands, so it should not be necessary.


1

It is usually in the .bash_history file located in the home directory For the root, .bash_history is located in the /root folder. You may use #find / -type f -name .bash_history #Run as root to see the .bash_history files for all users.


1

The example you give is not just an example. This is a major system upgrade. You better wait for 16.04.1 which is probably more stable. Upgrading from 14.04 to 16.04 is not just an upgrade. If you have 14.04, and it installs a new kernel like 3.2.34 to 3.2.35, you can wait I guess. Well maybe there is a security update in the old kernel, then you can see ...


1

Elasticsearch is not secure when open to the internet btw. Not sure if yours is, just thought I should point that out. "Using a firewall is always important. The elasticsearch http module was not designed to be exposed to untrusted networks as it doesn't provide authorization neither authentication mechanisms. By default, elasticsearch listens on two ...


1

This is definitely an attack. Someone managed to a) drop a file onto your server (possibly via poorly configured apache) b) execute that file You should do: a) mount the /tmp partition with the noexec - option b) reboot the server c) run a malware scan on the complete host while offline d) if that does not help : REINSTALL from scratch To get to the ...


1

I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...


1

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host and guest are simultaneously connected to internet via single USB modem. Usually virtual box (Vmware or other) creates its own own virtual subnetwork, ...



Only top voted, non community-wiki answers of a minimum length are eligible