Hot answers tagged

32

On Linux it depends on the file capabilities. Take the following simple mykill.c source: #include <stdio.h> #include <sys/types.h> #include <signal.h> #include <stdlib.h> void exit_usage(const char *prog) { printf("usage: %s -<signal> <pid>\n", prog); exit(1); } int main(int argc, char **argv) { ...


22

Nothing: strace kill -HUP 1 [...] kill(1, SIGHUP) = -1 EPERM (Operation not permitted) [...]


7

If you could call mknod arbitrarily, then you could create device files owned and accessible by you for any device. The device files give you unlimited access to the corresponding devices; therefore, any user could access devices arbitrarily. For instance, suppose /dev/sda1 holds a file system to which you have no access. (Say, it is mounted to /secret). ...


5

kill(2) man page explains: Linux Notes Across different kernel versions, Linux has enforced different rules for the permissions required for an unprivileged process to send a signal to another process. In kernels 1.0 to 1.2.2, a signal could be sent if the effective user ID of the sender matched that of the receiver, ...


5

Most scripted and manual break-ins do: clean up log entries and similar traces of the break-in install a rootkit, which allows entry to the system outside of default server programs replace default programs (like ps, netstat, ls, etc.) with manipulated versions which hide any activity of the above mentioned rootkit (ie. ps won't show the running rootkit ...


4

After the regular, FIFO and socket file types, mknod can also create device files. These are used to access devices. Granting access to devices is considered a privileged operation. Generally, we don't want to create arbitrary device nodes and make them accessible to regular users. That would be Bad. [Aside: Typically device access is granted by ...


4

With mknod, you create device-special files that allow raw access to the hardware. That is, the kernel looks at the device-special file's permissions to decide whether a given user is allowed raw acess to hardware, not to anything in configuration or some such. E.g., on Debian, devices related to optical drives are created with 0660 permission bits, user ...


4

There are utility commands named last and lastb to list the logins and attempted logins on most Unix distributions. In your case you might want to try the lastb command to see the failures. As stated before you will need to be root to see these logs.


3

No. debian template for lxc-create internally uses debootstrap which certainly verifies downloaded packages against release signatures in the repository just like apt.


3

The Policy is simply a basic aid to tidying up and checking the incoming certificate signing requests follow corporate policy (or more precisely, your organisation's Certificate Policy (CP) and/or Certification Practice Statement (CPS)). If you are signing your certificates on the command line, the security benefits are negligible - after all, you (or ...


2

On 23/11/12 12:50, Gene Czarcinski wrote: Libvirt is in the process of changing for using bind-interface to using bind-dynamic to fix a security related issue where dnsmasq was responding to port 53 queries which did not occur on an address on the virtual network interface that instance of dnsmasq was supporting. Checking ps -ax|grep dnsmasq, ...


2

Whether it's in /usr/local/bin or /usr/bin is irrelevant. It's just a python script that posts either its arguments or its STDIN to a web service: #! /usr/bin/python import sys, os, stat, subprocess content = "" mode = os.fstat(0).st_mode if stat.S_ISFIFO(mode): content = sys.stdin.read() elif stat.S_ISREG(mode): content = sys.stdin.read() else: ...


2

Aside from home directories, there are three directory hierarchies with writable data: /etc, /tmp and /var. /etc contains system configuration files, most of which are typically not sensitive. But there can be sensitive data there, e.g. wifi passwords. /tmp can potentially contain sensitive data; just about any program might put temporary files there. This ...


1

My advice, Rebuild the machine Restore the contents of the home directory from the backup nearest to the point before you ran the script. If you don't, the next time anything weird happens, you'll be left wondering if you've still got an infection. There are virus / malware scanners for Linux, so you could check those out (I don't have any I can ...


1

what is the better method of securing SSH by using SSH Keys or TOTP? They are completely different things. TOTP is and should be used as the second factor and they are based on the shared secret. This is something you have (token, FreeOTP application with secret key) and if you loose it, you would be screwed up if there was no other factor (they are ...


1

You should try setting port = ssh to the port you really use. (I assume that even with running ssh on a non-standard port, you're not changing the value in /etc/services, and you probably shouldn't do that anyway.)


1

I believe you need is ssh-keygen, which remembers your "device signature". So even you changed your password, it still works as long as you ssh from the same device. Here is a detailed tutorial how to set it up. Does it need to be run in root privilege? No, you only need root privilege on the host-server when you set it up, in order to edit some file ...


1

It was asked before on ServerFault. Quoting with few modification and notes: Start the process with /usr/sbin/sshd -f ~/.ssh/sshd_config where ~/.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from ...


1

ArchLinux have newest kernel with grsec in their repo. More info about this package can be found on it's dedicated wiki page.



Only top voted, non community-wiki answers of a minimum length are eligible