Tag Info

Hot answers tagged

20

Definitely it serves a security purpose. For example, look at the below bug filed for a system user who had a shell. My debian server was compromised due to the daemon account having a valid login shell and having samba open for internet access. The break in was made by setting a password remotly via samba for the daemon account and the logging ...


13

If you take a look at the nologin man page you'll see the following description. excerpt nologin displays a message that an account is not available and exits non-zero. It is intended as a replacement shell field to deny login access to an account. If the file /etc/nologin.txt exists, nologin displays its contents to the user instead of ...


11

Yes. /root has 700 permission (rwx------) whereas / has 555 (r-xr-xr-x) permissions for all users. Now if you use various common utilities you would have /root/.config with rwxr-xr-x permissions. If you were in /, that directory becomes accessible to anyone on the server, whereas if it was in /root it would not be. Having root's data accessible to any user ...


10

This depends on your distribution or OS. sshd will log each login somewhere, and will include the relevant IP address in the login a format like this: Aug 20 15:56:53 machine sshd[2728]: Accepted publickey for root from 192.168.1.2 port 49297 That part is consistent, but how you get there can vary. On systems based on systemd, use journalctl: journalctl ...


9

What you describe is an anti-exploitation feature called Address Space Layout Randomization (ASLR). Basically, the kernel puts the very top address of a program's function call stack at a slightly different ("random") address every time the kernel loads the program's ELF file from disk. The addresses in argv and the environment variables, of which your ...


8

You can use the last command to get this information # last|head phemmer ssh 192.168.0.24 Wed Aug 20 21:08 - 21:08 (00:00) phemmer pts/13 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh ::1 Wed Aug 13 23:08 - 23:08 (00:00) ...


6

To add to the excellent answers of @slm and @ramesh: Yes, as you have pointed out, you can still switch to users with nologin as their default shell by running sudo with a shell defined, but in this case, you have had to: Log in as another user that has a valid shell Have sudo permissions configured for that user to run the su command, and Had your su ...


6

Run an nc listener that echo's out one of the voucher codes when you telnet or nc to it. If they look at the file, they get it too. #!/bin/sh nc -i 2 -l -p 3128 -c "echo amazoncode" Name it something useful, like squid Create some local firewall rules with names or parameters of amazon codes. iptables -N amazoncode -P ACCEPT iptables -I INPUT -j ...


6

You should not allow people to use ssh by logging in directly as root (using the root password or a certificate in /root/.ssh/authorized_keys) if you want to audit who logged in as root. Instead, use one account for each person and let them use sudo to gain root permissions. In this way you will find in the appropriate log (the position of the log file ...


5

I don't know if this method is something that might interest the students. I create a file as amazoncode with the original code. cat amazoncode 125622234 Now, encrypt the file using the below command. openssl aes-128-cbc -salt -in amazoncode -out amazoncode.aes -k somepassword somepassword is the password that you set for the file. Now, remove the ...


4

You can freeze it with kill -STOP $pid. The process statistics will remain accessable through /proc/$pid, but it will not be executing. You can get access to the executable file with cp /proc/$pid/exe /destination/path.


4

Q#1: I see many connections like when I use netstat, are they all to the internet? No not all connections listed in the output of netstat are to the internet. Many of these so-called connections are to files that are in use on your system. These are special files, one of which, is called a socket. A socket file allows an application to "talk" to ...


4

The command who /var/log/wtmp should show information like what who shows, but going back in time.


3

Some ideas: Plain-text file in a user's home directory ("Amazon Code.txt" or something else obvious), world-readable Plain-text file in a user's home directory, not world-readable but the user has an easily-guessed password Process with the key obfuscated in the source-code, but it calls something else (say system("sleep 864000 $key")) that exposes the key ...


3

Perhaps a 'funny' script in the ~/bin/ or /etc/bin/. Do something like replace the functionality of LS, cat or CD to behave a little differently and give them a bit of a tip-off that something is amiss, (the first one that comes to mind is to have ls/cd has a change to list/move the wrong folder) and have the code listed in a comment of the sh file. Perhaps ...


3

the pages at https://tails.boum.org/download/index.en.html#index3h1 explain the process of verifying that the image you download has the expected checksum, the process of verifying that the checksum you read on the website is signed by the distributor, the process of have reasonable evidence that the key you downloaded is indeed not a malicious one. To be ...


3

I will attempt to specifically answer question 3 here as it appears you have found the configuration part of fail2ban which answers questions 1 and 2. If want to beef up security on SSH I recommend the following. Make sure that strict mode is set to true Disable root logins Change your SSH port Disable password logins Use port knocking To answer your ...


2

Using SCAN_TIMEOUT I would assume that if psad detects scanning attacks from some nefarious IP address that it wholesale blocks it for the duration of time set in AUTO_BLOCK_TIMEOUT. If you just want to block scanning attacks then from the manual I would say you might want to use this timeout instead: SCAN_TIMEOUT 3600; excerpt ...


2

To specify the ip address 1.1.*, you would use 1.1.0.0/16. This notation is used for CIDR (classless inter-domain routing) and is the standard method used to specify blocks of addresses. The /16 indicates the network includes all of the lower 16 bits of the address, so it matches in this case the address block from 1.1.0.0 to 1.1.255.255.


2

How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting? Download Debian installation media. Download the accompanying SHA256SUMS and SHA256SUMS.sign files. Import the keys from the Debian keyring or a PGP key server and check their fingerprints on the Debian website accessed over HTTPS. $ gpg --recv-key ...


2

Debian provides MD5 checksums to all image files which you can then compare with your downloaded file to make sure it is the same file.


2

Yes, there are some drawbacks here. You are using password-less authentication to increase security. Since giving password will be a second door to login to your system. So in /etc/ssh/sshd_config PasswordAuthentication no RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys ChallengeResponseAuthentication no ...


2

You have an SSH session, but you are running it from a terminal. The SSH protocol doesn't give the server much control at all. There's almost nothing it can do to you (other than capture your typing). But the terminal you are running may chose to respond to terminal requests that the server sends. It may send a command that requests a terminal resize, ...


2

First of all, if files are missing, it does not mean you should not create them. The common-* files available on Debian are just regular PAM configuration files, however, they are included in any other file which requires them. For instance, on Debian, at the end of the su file, you may find: @include common-auth @include common-account @include ...


2

I assume you are trying to set a password to edit GRUB but you need to boot without being asked for password. I think in addittion to your current configuration you need to edit /etc/grub.d/10_linux and add the --unrestricted option. For a complete reference you can check this link in AskUbuntu I posted once, when I was stuck in the same situation. ...


1

I was experimenting with a ubuntu machine for trying to find a solution for you. When you create a user and delete it and then create a user again, the second user takes the uid of the deleted user so it s hard to find the amount of users by this technic. I suppose there is no command for your willing actions. I think you re going to find your answer by ...


1

I would say there's no issue with disabling this service, assuming you have no need for UPnP (Universal Plug and Play). This is a service which allows for devices to "auto discover" one another on your network and advertise services that they can either provide or are looking for to consume. http://miniupnp.free.fr/minissdpd.html excerpt I first ...


1

Pwgen is a good choice but You can use the following command to generate the random password: tr -dc A-Za-z0-9_ < /dev/urandom | head -c 16 | xargs Sample outputs: 1z2G4SVmZOdd4uK4 Also you can use the following shell function to generate random password. Edit ~/.bashrc file, enter: $ vi $HOME/.bashrc Append the following code: genpasswd() { ...


1

Use: rpm -Vf /etc/pam.d/system-auth although in this example, rpm will complain that the file isn't owned by any package as it's a symlink. In this instance you need to make sure that you are running the command against that actual file, not the symlink to it: rpm -Vf /etc/pam.d/system-auth-ac


1

There are reported false positives where chkrootkit thinks it's found Suckit on a clean system. The Fedora bug report indicates that chkrootkit is still broken as of Fedora 20. Having no utmp entry for an X server is normal if nobody is logged in (if it's showing the GUI login prompt). So these results don't indicate that your system is infected. It ...



Only top voted, non community-wiki answers of a minimum length are eligible