Tag Info

Hot answers tagged

15

The literal answer is that there is no such thing as an untrusted application running under your account. If you want to run an untrusted application, run it under a different account or in a virtual machine. Typical desktop operating systems such as Unix and Windows and typical mobile operating systems such as Android and iOS have different security ...


5

You can try to set umask before converting it umask 077; openssl rsa -in secure.key -out insecure.key Edit: To not affect other files in the current shell environment by the umask setting execute it in a subshell: ( umask 077; openssl rsa -in secure.key -out insecure.key )


3

I think that the message Java.Exploit.CVE_2013_2472 FOUND means that this installer for the Java runtime is affected with the security bug you posted the description of. If so, it's not a virus at all, just some piece of legit-but-dangerous software. I would say the message from ClamAV is a bit confusing, and the action of deleting the affected file may not ...


3

It's all about risk mitigation; if make does something destructive, you can only lose whatever data was modifiable (or deletable) by the user running it. So you run make as a plain user to limit the scope to that user's files, and you run make install as root because you have to if you want to install to /usr/local typically. Note that in the example you ...


3

You can use pam-tmpdir for this. It creates a directory for each user that logs in, at the start of their PAM session. See How to remount filesystem at logout? for a little more context... In Debian, Ubuntu and derivatives it's available in libpam-tmpdir.


2

IP Spoofing, is a technique where the attacker uses a forged IP source address with the purpose of concealing the identity of the sender or impersonating another computing system. However, this kind of attack will be nearly "impossible" from the internet because RFC1918 defines the following blocks that will be used only inside LAN environments: The ...


2

Requirements for which I will offer solutions, as bullet points: Passwordless root console login Passwordless root remote login from pre-authorised users Passwordless remote login for specified accounts from pre-authorised users Passwordless remote login for any account from pre-authorised users The following examples are based on Debian, since that's ...


2

You have several options like adding the host you want to connect to into the /etc/hosts file: vi /etc/hosts, add: 10.0.0.1 host.where.i.want.to.connect.to make sure that 10.0.0.1 is an IP address which does not exist in your network. Using this method you are overriding the resolving of the host you have configured in your my_program.rb application. If ...


2

TL;DR: It's probably just a typo. Long answer As a quick search shows, vftovp could be a tool in the TeX suite to convert a virtual font metric to a virtual property list. So, the original tool would not be something to be concerned of. Two questions are remaining: Who executed this tool on your machine? Is the binary on your system really this TeX ...


2

You have to have someone have access to the root account to provide additional privileges. Beyond that, you can use sudo to limit effect areas of control for other administrators without giving them root. But overall, what you're describing seems to be more of a political / training issue than a technical issue. Hire the right staff, and they won't get in ...


2

It comes down to trust vs convenience. True, make might be insecure, but then so might make install. It's just that the surface attack area should (hopefully) be smaller for make install, and it's more likely a quick perusal of the Makefile will spot anything strange. However, installing software into the $PATH is risky regardless of who has compiled it, so ...


2

So what I think you want to do is get a list of listening ports and then remove them from the "Local Address:Port" column of ss output, I'm using \s{2} in the grep to attempt to only match on the "Local Address:Port" column. Normally I might try to use the filtering functionality of ss, like with ss -tn state established '(sport != :<port1> and sport ...


2

A trivial but simpler solution is to chmod 700 a directory and operate inside it.


2

One way to do this is to make a blank insecure.key file first and chmod it. touch insecure.key chmod 600 insecure.key Which makes the directory look like total 28 drwxr-xr-x 2 flyte flyte 4096 Apr 17 11:44 . drwxr-xr-x 12 flyte flyte 4096 Apr 17 11:44 .. -rw------- 1 flyte flyte 0 Apr 17 11:44 insecure.key -rw------- 1 flyte flyte 1746 Apr 17 11:42 ...


2

RESTRICT The way I interpret "restricting users to the set of programs that do not [allow shell escapes] is often unworkable", it means that it is so common for programs that, on the surface, seem to perform a single, safe task, but actually allow one to run any other program, that one should assume, in the general case, that giving a user access to a ...


2

I like Gilles's answer but there's another aspect to consider: A principle of unix is that each program is supposed to "do one thing well". Programs weren't supposed to get so big and complicated that the user wouldn't be able to predict the result of running one. If a proper unix program touches a file, it's because you told it to touch that file. The ...


1

On Root privileges You can remove root login, root password etc. You will then need some other way to get admin things done: such as adding users to groups configuring sudo to give fine-grained permissions giving users and programs capabilities. root has recently been broken into a number of capabilities, so where you read that you need root to do ...


1

These values must match: /etc/rkhunter.conf: ALLOW_SSH_ROOT_USER=no /etc/ssh/sshd_config: PermitRootLogin no Can you confirm that these values are set as above? If so, you should not be warned by rkhunter any longer.


1

This is a hard situation. The requests seem to match a malicious pattern, so your task is to block the IPs making malicious requests from your server. These days there are all kinds of fancy hardware to do this. If you can't get that then you are down to manually creating firewall rules or apache rules to ignore or block requests from certain IPs. For ...


1

The guest operating system runs inside the host. The host has full control over everything that the guest does and everything that goes in or out of the guest. Thus any confidential information that becomes accessible to the guest is also accessible to the host. A rogue process on the host can access everything in the guest, assuming that it has sufficient ...


1

When both the Host and Guest OSes are turned off and the data is at rest on a storage device, is it any easier/harder to retrieve the encrypted file system? This scenario is similar to the security of a Truecrypt encrypted container in Host OS. If the Host is already off then accessibility can only be through personal access where more or less, ...


1

First off, I usually create a second sshd process with its own configuration file. (sshd -f /etc/ssh/sshd-2222.conf for instance) or by overriding the configuration on the command-line (sshd -p 2222 -o PasswordAuthentication=no,AllowRoot=no). This way they share the same keys, etc, but you can override any of the parameters. Any ideas why this happen? ...


1

The simple fact is that if a person can arbitrarily install programs then they probably can install a program that will run under root privileges, so they could install programs that would grant them other types of access. IE any person who can install or modify something that is run as root, is or can easily become root. If you want to separate out your ...


1

sudo has ways to give users access to some, but not all, commands through sudo. You can use the visudo command to safely edit the /etc/sudoers file, with some syntax checking before the file is really saved. Inside the file, you can add a line like mike ALL=(root) /usr/bin/aptitude, /usr/bin/apt-get to give mike access to aptitude and apt-get through sudo, ...


1

CentOS 7 Security Hardening Document that I've just posted might help you out, it's based on OpenSCAP.


1

There are two general approaches to do what you want to do. printer specific method: Using the printer manufacturer provided tools and documentation configure the printer. This has the advantage of the fewest components. On the other hand you would need to trust the manufacturer of the printer to securely implement the print server with all the needed ...



Only top voted, non community-wiki answers of a minimum length are eligible