Tag Info

Hot answers tagged

4

My work-colleague pointed me to the same direction as /u/meuh did, using a slightly different approach. Match Address "172.24.*.33" PermitRootLogin yes Match Address "192.168.1.18,192.168.1.20" PermitRootLogin yes


4

Simply change permissions of the files in a way everyone could read them, but not alter them. When you use ls -l to list your files, you get something like ls -l file -rw-rwxr-- 1 rafael Grp 1620 Aug 18 14:58 file That first set of dashes/letters sets the permitting of three distinct (but not exclude each other) groups, namely User ...


3

Solaris has a built in format command which has analyze and purge subcommands to do this. See https://blogs.oracle.com/cmt/entry/erasing_disks_securely for more information.


3

you might screw up permissions in your config file you might check your config file into source control you might be working on an open source project so cannot put passwords in source control Answer: use an env var


2

If your system is running systemd, you could create a unit which would trigger when the network interface goes down which would lock your screen in the simple case where the machine is physically unplugged from the network. But you want your work computer to verify that you are still connected to your work computer, not merely that your work computer can ...


2

Depending on your version of ssh, you might be able to set a match condition around your AllowUsers. man sshd_config lists the allowed commands under Match. If AllowUsers is in there, you might try the following.Make sure it is at the end of the file. Match User root AllowUsers root@ a.b.c.d root@q.r.s.t Eg, not in OpenSSH_6.0p1 Debian, but ok in ...


2

Use this: security find-certificate -c "certificatename" -a -Z | \ sudo awk '/SHA-1/{system("security delete-certificate -Z "$NF)}' awk is called with sudo. awk then searches for the string SHA-1 and calls the security delete-certificate command with the hash as argument. You have to provide the sudo password only once.


1

I'm not sure what you mean by "swipe scancodes", but I would say No. Do not use GPG tools with sensitive private keys when you are not confident that the system integrity is up to par. Perhaps I'm too sensitive/paranoid, but if keylogging the X environment is a concern, why wouldn't the TTY also have integrity concerns? Maybe we don't have enough info. Are ...


1

What you want can be done with chroot or maybe even lxc in debian. EDIT: You may want to use overlayfs or squashfs to make what you're doing faster(instantaneous). For that you need debootstrap and squashfs-tools. With these tools you'll able to give your users different runtime versions or archituctures to choose from. For that You need ...


1

Alpine Linux uses a kernel with grsec by default so once installed updates require no added effort.


1

Reality: yes, SELinux can confine the root user. This is possible because SELinux do not actually care about the current Unix user: all it sees is a supplementary metadata called the context (which includes, among other fields, a domain field) and which lets SELinux decides whether the requested action can be authorized or not. What one usually conceives ...


1

Create a passwords file: ~/.mutt/passwords: set imap_pass="password" set smtp_pass="password" Encrypt the passwords file: $ gpg -r your.email@example.com -e ~/.mutt/passwords $ ls ~/.mutt/passwords* /home/user/.mutt/passwords /home/user/.mutt/passwords.gpg $ shred ~/.mutt/passwords $ rm ~/.mutt/passwords Add to your muttrc: source "gpg -d ...



Only top voted, non community-wiki answers of a minimum length are eligible