Tag Info

Hot answers tagged

8

First, as several people have already said, keeping the credentials separate from the script is essential. (In addition to increased security, it also means that you can re-use the same script for several systems with different credentials.) Second, you should consider not only the security of the credentials, but also the impact if/when those credentials ...


6

First of all, if there is any way at all you can change things to avoid having to store a password inside or alongside a script in the first place, you should make every effort to do that. Jenny D's answer contains a lot of good advice to that effect. Otherwise, your idea of placing the password in a separate file with restricted permissions is pretty much ...


5

When on Linux you can use the inotify mechanism in combination with incron. Setup incron by installing the package and edit the config: /etc/incron.conf system_table_dir=/etc/incron.d user_table_dir=/var/spool/incron allowed_users=/etc/incron.allow denied_users=/etc/incron.deny lockfile_dir=/var/run logfile_name=incrond editor=vi Then configure a watch in ...


3

"Installing as root user" isn't a bad thing necessarily, especially if they installed using package managers. For e.g., installing mysql on CentOS via yum, will create a mysql user and the mysql process then is usually run as that user. For starts, see this: http://serverfault.com/questions/212269/tips-for-securing-a-lamp-server . If you have specific ...


2

You can translate MikroTik firewall rules to Linux iptables rules pretty easily. The only real difference is that iptables marking isn't quite as pretty, it likes 32 bit flags instead of nice long names, but "1" suffices most of the time. According to the iptables man pages: add chain=prerouting : -t mangle -A PREROUTING (Appends a new rule to the end of ...


2

It's not the kernel that's preventing bad memory accesses, it's the CPU. The role of the kernel is only to configure the CPU correctly. More precisely, the hardware component that prevents bad memory accesses is the MMU. When a program accesses a memory address, the address is decoded by the CPU based on the content of the MMU. The MMU establishes a ...


2

Using sudo: #!/bin/sh ip -s -s neigh flush all ufw enable sudo -Hu username sh -c '"/home/back/Downloads/tor-browser_en-US/Browser/start-tor-browser" --detach || ([ ! -x "/home/back/Downloads/tor-browser_en-US/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k -H: Sets the $HOME environment variable ...


2

There is no thing as default autostart from a removable device in the DEs I know. So the only malicious code executed would bugs in the filesystem (unlikely) and bugs in the applications used to open the files. I would search for known security problems in the programs used (like LibreOffice etc). Where to find these depends on the program and the ...


2

This is, at least in part, governed by the ServerTokens directive, so you could set ServerTokens Prod which will reveal only that the Server is an unspecified version of Apache, but even the manual itself suggests this is not a security measure.


1

Other answers have addressed the how, but I'll consider the whether. Depending on what kind of database your users are connecting to, you might already have a suitable mechanism that's already used by those client programs, in which case be sure to use them (I'm thinking of ~/.mysqlrc or ~/.pgpass). If you're giving several users the ability to access the ...


1

Your idea of hiding the password in an inaccessible place might be OK depending on the circumstances. If the information is separate, that means simple editing of the file, e.g. during a code review with a colleague is not going to show it. But realise anyone with access to your account can easily find such a file. I have used a subdirectory of ~/.ssh for ...


1

See man xferlog for the details but in short: /var/www/.../success.gif is the filename b stands for: a binary transfer _ stands for: no special action (like compression or tar) was taken d means that the file is deleted r stands for: access-mode real - a local authenticated user username stands for the authenticated username ftp stands for the ...


1

There are two ways to go about this. 1) Run the script as a non-root user and use sudo to raise privileges to the root user (prefix the commands to be ran as root with sudo). or 2) Run the script as root user and use su to run the tor command as non-root user. su allows you to stipulate what user to run the command as and the -c option to specify what ...


1

FileVault (and OS X in general) does not check /etc/passwd, so a script using it as a trigger will not work. FileVault uses DirectoryServices, so any interception of what is being entered has to be through Apple's OpenDirectory implementation (see documentation on DirectoryService). How to do that is beyond me, but reading up on ...


1

From the manpage of the syscall chflags(2): SF_IMMUTABLE The file may not be changed. SF_NOUNLINK The file may not be renamed or deleted. [...] UF_IMMUTABLE The file may not be changed. UF_NOUNLINK The file may not be renamed or deleted. The flags prefixing with SF_ may only be set or unset by the super-user. The others prefixing with UF_ may ...



Only top voted, non community-wiki answers of a minimum length are eligible