Tag Info

Hot answers tagged

39

Preamble First, I'd say it's not the right way to address the problem. It's a bit like saying "you should not murder people because otherwise you'll go to jail". Similarly, you don't quote your variable because otherwise you're introducing security vulnerabilities. You quote your variables because it is wrong not to (but if the fear of the jail can help, ...


8

The problem is in cases where the content of $x has not been sanitized and contains data that could potentially be under the control of an attacker in cases that shell code may end up being used in a privilege escalation context (for instance a script invoked by a setuid application, a sudoers script or used to process off-the-network data (CGI, DHCP ...


4

I will try to answer questions as briefly as possible. The questions you are asking are usually addressed in introductory operating systems courses at universities but I will assume you have not taken such a course. Memory isolation for userspace processes is very desirable - not only to protect the kernel from malicious userspace programs, but also to ...


4

As it so happens, there is another significant interface with the kernel: the /proc and /sys virtual filesystems. While they do not hold regular files, their contents are direct gateways to the kernel: to act on them is to act directly on kernel-allocated memory. For instance, if you want to drop all memory caches, you may use... echo 3 > ...


2

SSHd does not ban IP addresses. Whenever it encounters an authentication failure, it adds an entry to its log, and keeps going. Other pieces of software, however, may read these logs afterwards and ban IPs according to their rules. The most common daemon used for such a task is fail2ban. Fail2ban works with jails. Each jail is associated to a service, a log ...


2

Get your current config.gz and deploy it in a source tree as described in this answer. Start make menuconfig and go into the "Device Drivers" submenu. Make sure "Serial ATA and Parallel ATA drivers (libata)" is disabled. Scroll down to the "USB support" sub-submenu and make sure "USB Mass Storage" is disabled. You could completely disable USB too if you ...


2

The separated repository is two fold: To keep all security related upgrades easily identifiable, since they come from a different domain and with different suite. To expedite all the security related upgrades and provide an unique mirror to assure maximum availability in the shortest time, since mirrors sync with Debian's on regular basis which defeats the ...


1

Yes, you're correct: locking yourself to a particular CentOS point release will expose you to future security flaws by preventing you from receiving the fixes. Just as in RHEL, a CentOS point release is not a "version" in the same sense as used by much of the rest of the software world. You will never see a CentOS 6.4.1, for example. All the "4" means here ...


1

Yes, that's perfectly fine. A lot of common utilities do that. You should however have some fallback in case the application does not get sudo - but that's just good script writing. Another way to do things like these, that I do not recommend, is to ask the user to run the application as root, which is bad. So this alternative is better. Also make sure that ...


1

It depends. What do you mean by 'verify'? If you just want to monitor what syscalls some process is triggering then it's possible.. usually.... But if you feel like digging deeper then you're in trouble... I have not heard of any tools that could do that. You can use strace to see what syscalls some particular process is firing. Of course you'll have to ...


1

If someone has physical access to your computer, they can boot from a USB key, or take out the hard drive and plug it into another computer. To prevent someone from changing boot parameters, put the computer in a locked case or locked room. If the computer is in a locked case but its keyboard is accessible to untrusted people, then you need a software means ...


1

Maybe you should first do your homework, and clear up the separate topics "what is virtualisation" and "what is security and how can it be applied to/ is it implemented in different virtualisation methods" and "what specific use case do I choose for both together". You should probably first create an overview for yourself - what are virtualisation methods - ...


1

You may be interested in Arch Linux. It aims to be simple and lightweight, so very few packages are installed by default.


1

TRESOR is still an out of tree kernel module today. Further, it looks like it is no longer being developed by the people at Erlangen. I co-maintain some AUR packages which have updated TRESOR up to the current 3.17 and 3.14 kernels: https://aur.archlinux.org/packages/linux-tresor/ https://aur.archlinux.org/packages/linux-lts-tresor/


1

I am using ubuntu and had same issue Solution: add-shell /sbin/nologin sudo usermod -s /sbin/nologin ftpme sudo vi /etc/pam.d/vsftpd Then comment and add lines as following #%PAM-1.0 session optional pam_keyinit.so force revoke auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed auth required ...



Only top voted, non community-wiki answers of a minimum length are eligible