Tag Info

Hot answers tagged

5

Allowing a less trusted user to run apt-get update is ok. They worst they can do is consume a lot of bandwidth and fill up some disk space, and they have plenty of other means to do this unless you've taken stringent measures to prevent this. Allowing a user to run apt-get upgrade is likely to give them root access. Some packages query the user and might ...


3

The good old arpwatch is still useful. Other than that, it might be a good idea to capture all network traffic for a few days and analyse it.


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

On Linux use mlock http://linux.die.net/man/2/mlock mlock() and mlockall() respectively lock part or all of the calling process's virtual address space into RAM, preventing that memory from being paged to the swap area. The man page has more details.


3

A iptables rule like this works fine *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [1:156] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT -A INPUT -j REJECT --reject-with ...


2

If you're not comfortable working with the iptables commands you could use UFW instead. UFW stands for Uncomplicated Firewall and is a way esaier tool to use than iptables. Install ufw on your Raspbery Pi with: sudo apt-get install ufw After you've installed ufw you can setup the defaults with: sudo ufw default deny incoming && sudo ufw default ...


2

You can set up OpenSSH so that a particular account can only run one command (the command sent by the client is ignored). In /etc/ssh/sshd_config, add lines like: Match User anonymous ForceCommand /usr/bin/telnet localhost 34843 PasswordAuthentication yes PermitEmptyPasswords yes AllowAgentForwarding no AllowTcpForwarding no PermitTTY yes ...


2

There is an incredible amount of files that one can modify to "install a backdoor" on the system (editing /etc/group is the easiest, but there are lots of more stealthy way to achieve it). It is also possible to disable this noexec protection by editing /etc/sudoers file! I wouldn't rely on NOEXEC to make "sudo $editor" secure. it is not secure. DO use ...


2

D-Bus isn't using the magic cookie file here; it's passing credentials over the UNIX domain socket (SCM_CREDENTIALS). The magic cookie file is only one of several D-Bus authentication mechanisms. D-Bus implements a SASL-compliant interface (see RFC4422) to support a wide range of authentication mechanisms. One of these mechanisms is called "EXTERNAL" ...


2

Run netstat -pan --tcp --udp (Linux-specific syntax) on each server to find out which programs are listening to which ports, and disable those you don't need. Don't leave them running just is case, any open port is a potential risk.


2

It's readable by remote_user and root. None other, unless remote_command is writing it to a globally readable file or something like that. You can inspect the environment of a process in the /proc filesystem in /proc/$pid/environ. You either need to be the same user as the euid of $pid or you need to be root, as the permissions of that file seem to default ...


1

Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which ...


1

The best I know about are the audit tools provided by the auditd daemon, and developed by RedHat but available for any Linux. The configuration can become quite complex. After reading and studying it for yourself, you can get a baseline configuration that will probably be mostly relevant for your system(s) via the DISA RHEL-6 STIG. Just search for ...


1

One thing to be aware, is that STIG locks down /tmp with noexec. If you already spent some time on the box, it's possible that you won't be able to execute the files out of that folder. Try another location for download/install. Also, run your installer as SUDO


1

As already stated, Puppy uses a different security model (or different paradigm, if you prefer) and must be judged experientially, in the real world. My experiences can be summed up as follow: Debian: hacked, with apps phoning home. Slackware: hacked. Arch: never stayed stable long enough to be hacked. Windows XP: I uninstall the ethernet driver after it ...



Only top voted, non community-wiki answers of a minimum length are eligible