Hot answers tagged

10

This answer assumes that $1 is allowed to include subdirectories. If you are interested in the simpler case where $1 should be a simple directory name, then see one of the other answers. Wildcards are not expanded when in double-quotes. Since $1 is in double-quotes, wildcards are not a problem. Both ../ and symlinks can obscure the real location of a ...


7

If you only want to delete a file in /home/charlesingalls (and not a file in a subdirectory) then it's easy: just check that the argument doesn't contain a /. case "$1" in */*) echo 1>&2 "Refusing to remove a file in another directory"; exit 2;; *) rm -f /home/charlesingalls/"$1";; esac This runs rm even if the argument is . or .. or empty, but ...


5

Just make sure that the arguments passed to eval are not coming from external input or that if they are, you've sanitized them before hand. As in, don't do: n=0 .... n=((n + 1)) eval "var$n=$1" $n is under your control, the content of $1 is not. If $1 is foo;reboot for instance, eval will receive the var3=foo;reboot code to interpret and that will run ...


4

There is no way to verify that a binary package does what the source says it should do (it's an unsolvable problem both in theory and in practice). However, if you know how the binary package was produced, you may be able to be certain that it was the result of compiling the source code. This requires trusting: the compilation tools (not just compilers as ...


4

I'd amend your list of criteria for protecting a script a little. Given this - or a similar - entry in /etc/sudoers: www-data ALL=(ALL) NOPASSWD: /usr/local/sbin/mycommand we can state that the script: must be writeable only by the root user must be readable and executable by the root user must be in a hierarchy of directories that can only be written ...


4

Named pipe approach. As root, run mkfifo -m 666 /tmp/foo /tmp/readpipe.sh & And can, as user www-data then write to the pipe echo test >>/tmp/foo readpipe.sh in its simplest form (perl with taint would be better) : #!/bin/sh while read A </tmp/foo do echo received $A done


3

Things that can affect the setuid program Let's consider some ways the calling user could affect the behavior of the setuid process. I'll divide the things to consider in three groups: 1) the program itself, 2) the input to the program, and 3) the environment it runs in. The binary: If the unprivileged user can modify the binary that will be run, that ...


2

another option is AIDE (advanced intrusion detection environment). It is free and you can get started pretty easy with one of the sample config files.


2

You have the linux audit system for that, I don't know if it's installed by default on debian but you ca install it by: $ sudo apt-get install auditd audispd-plugins From there you need to configure it, the configuration file is /etc/audit/audit.rules, a rule for your purpose would be like: # Delete all previous rules -D # Set buffer size -b 8192 # ...


2

One of the best thing is to use the "Digest_Spec" possibility in the sudoers file, to validate the checksum of your executable Extract of the man page: If a command name is prefixed with a Digest_Spec, the command will only match successfully if it can be verified using the specified SHA-2 digest. Using openssl, to generate the checksum: $ openssl ...


2

If you want to forbid paths completely, the simplest way is to test if the variable contains a slash (/). In bash: if [[ "$1" = */* ]] ; then... This will block all paths, though, including foo/bar. You could test for .. instead, but that would leave the possibility of symlinks pointing to directories outside the target path. If you only want to allow ...


2

From your github link, follow "Audit Event Parsing Library" which has a link the the dictionary at https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv The raw CSV version is at https://raw.githubusercontent.com/linux-audit/audit-documentation/master/specs/fields/field-dictionary.csv


1

Logs should be write-only if they contain potentially confidential data. Obviously they can only be write-only to the application that produces the log and other applications running on the server, and perhaps even to the logging subsystem (once written to the log files), but system administrators and auditors should be able to read them. The most important ...


1

In my case I've found that I can add an entry to /etc/group that masks the Active Directory entry. (This might not be the correct solution but in my situation it works). Here is what I would add for your example, where getent group 67uts-mq-admins returns 67uts-mq-admins:x:57376: mqm:x:57376: You may be able to run the command addgroup --gid 57376 mqm or ...


1

As Krzysztof points out, you'll need a separate cron entry for this. It's probably best to call unattended-upgrade directly (it's a python script), to ensure package blacklists/whitelists, reboots and other details are handled appropriately. For example: echo "0 0-23/4 * * * root sleep $(( $RANDOM % 14400 ));PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/...


1

I've tried a bunch of tools, including iftop, ntop, iptraf, and of course the very useful built-in netstat -tupln, but the most practical for my use case turned out to be nethogs - it aggregates connections by the originating app, and is the least noisy of all. Installable via: sudo apt-get install nethogs Run as root: sudo nethogs


1

I'm going to add this, well after the question is officially answered: MAGIC: Malicious Aging in Circuits/Cores, which unfortunately is locked up behind ACM's paywall. The upshot of the paper is that the very small width traces in circuits in use today age during use, and eventually break down. By finding the correct instruction(s) and repeating them over ...



Only top voted, non community-wiki answers of a minimum length are eligible