Hot answers tagged

3

Yesterday This didn't happen yesterday. This happened back in 2014, when the people who were responsible for packaging up mediawiki for Debian simply stopped doing so. Then in 2015 this was noticed and Debian member (and currently listed Debian maintainer for mediawiki) Jonathan Wiltshire filed a bug saying that the version of mediawiki packaged was ...


3

A potential intruder could reboot into single user mode if they had physical access. Physical security is just as important as software security. That is why schools lock out USB drives and the BIOS. You have to lock it down. In /etc/default/grub you can uncomment the following line GRUB_DISABLE_RECOVERY="true" And poof! Single User mode is now gone.


3

Several reasons: one, you have to have physical access to the servers, and most employees don't want to lose their jobs by getting caught on CCTV video breaking into systems. Then, you have some companies that implement BIOS / boot passwords or boot loader passwords. Sometimes, the "single user" option requires a password (if set up properly ahead of time), ...


3

chsh is setuid, so it can run in a context that means users can perform actions with root's privilege. Anything setuid has to be written very carefully to not allow a privilege escalation. chsh is written in C, and it appears to check that the person running the program is the same as the user that you're asking to change.


2

First sorry for my bad english. Lets show something for you using only unix concepts, cause i think it can help (or maybe not). Imagine that i want that the executable nano can be executed by every users, but must never run as the user that call its executable, but with a limited environment, with access to edit the apache configuration only or files in ...


2

[Inspired by this answer by cas.] But what if …? But what if my script sets a variable to a known value before using it?  In particular, what if it sets a variable to one of two or more possible values (but it always sets it to something known), and none of the values contain space or glob characters?  Isn’t it safe to use it without quotes in ...


2

In order to prevent root or any one from being able to read your files, you need to encrypt them. File Encryption is a very convenient option to look into if you wish to avoid having to deal with complex file system manipulations. Encryption Options: Encrypt ordinary files and prevent everyone but yourself from being able to view them Encrypt Shell ...


2

It's not clear what your actual problem is. Port 3306 is MySQL, is the attacker trying to break into your database? If the DB should not be accessible from outside, you should perhaps drop all connection requests from outside (I normally consider sending any reply packets to an attacker an unnecessary courtesy...) If the attacker somehow consumes your ...


2

As SmokeDispenser says, it depends on exactly which distribution you're using. In most cases you'd be better off upgrading to a supported release... You can always try adding the Debian security updates to your apt setup, they probably won't break anything. First you need to determine which version of Debian your distribution is based on; then if it's ...


1

I was able to do the above with a tool named passe-partout. See the answer posted by Nathan Osman for further details here http://serverfault.com/questions/549298/retrieving-an-rsa-key-from-a-running-instance-of-apache


1

I worked it out - our system used CloudLinux and the other user was operating under CageFS determined by running: /usr/sbin/cagefsctl --list-enabled Following the instructions at: https://www.ndchost.com/wiki/cloudlinux/how-to-add-commands-to-cagefs-users, I then added xvfb to the Cage: vi /etc/cagefs/conf.d/binutils.cfg Then added the lines: [custom] ...


1

There is nothing wrong with your VNC server. Why that happened Welcome to the other side of the internet! The side that is not behind a NAT and a firewall. vnc too many security failures simply means that someone tried to login into your VNC server and failed, several times. VNC servers have a security feature in which they block connections for a ...


1

Those options work by passing options to the compiler, so the most straightforward way is to recompile the kernel. However for a reproducible and module-specific way kbuild allows you to set custom CFLAGs on a per-module basis. https://www.kernel.org/doc/Documentation/kbuild/makefiles.txt You particularly want to set -fno-stack-protector for the modules ...


1

The good thing of Linux is that every Linux can be tuned up to be equal secure than other one. So, select your favorite distro to start over and begin to secure it in the way you prefer. If you want to hardening your Linux distro, check out these topics: Users / groups privileges (don't do everything as root) IPTables (Linux firewall) SELinux Encrypt ...


1

Vote me up, because this is the best answer by far! I first found this question, unconvinced by all the answers, here is a much better one, which also allows you to completely obfuscate your bash script, if you are so inclined! It should be self-explanatory. #include <string> #include <unistd.h> template <typename T, typename U> T &...



Only top voted, non community-wiki answers of a minimum length are eligible