Tag Info

New answers tagged

1

Use this: security find-certificate -c "certificatename" -a -Z | \ sudo awk '/SHA-1/{system("security delete-certificate -Z "$NF)}' awk is called with sudo. awk then searches for the string SHA-1 and calls the security delete-certificate command with the hash as argument. You have to provide the sudo password only once.


0

All conversations on the internet should be private. DNS should always be private, it runs the internet, without clean DNS records we could not rely on networking. If a MITM attack occurred between master and slave and they modified records on the slave, they only need to DOS primary server and slave will start serving incorrect records Read this nice ...


0

Inside seahorse: "Right click on "Login keyring", and select "Change Password", then change it to be the same as your login password. The next time you log in (even with KDE), the Login keyring will be unlocked." http://linuxfollies.blogspot.com/2012/12/changing-gnome-keyring-password.html


1

I'm not sure what you mean by "swipe scancodes", but I would say No. Do not use GPG tools with sensitive private keys when you are not confident that the system integrity is up to par. Perhaps I'm too sensitive/paranoid, but if keylogging the X environment is a concern, why wouldn't the TTY also have integrity concerns? Maybe we don't have enough info. Are ...


4

My work-colleague pointed me to the same direction as /u/meuh did, using a slightly different approach. Match Address "172.24.*.33" PermitRootLogin yes Match Address "192.168.1.18,192.168.1.20" PermitRootLogin yes


2

Depending on your version of ssh, you might be able to set a match condition around your AllowUsers. man sshd_config lists the allowed commands under Match. If AllowUsers is in there, you might try the following.Make sure it is at the end of the file. Match User root AllowUsers root@ a.b.c.d root@q.r.s.t Eg, not in OpenSSH_6.0p1 Debian, but ok in ...


0

Alpine Linux uses a kernel with grsec by default so once installed updates require no added effort.


0

Your problem is with GnuPG. I can't tell you how to fix GnuPG, but if you just want to import the key, then I suggest that don't let gpg fetch the key - download it yourself from the keyserver and then let gpg import it. Or as a command line: curl "https://pgp.mit.edu/pks/lookup?op=get&search=0x4E2C6E8793298290" -o - | gpg --import


1

Reality: yes, SELinux can confine the root user. This is possible because SELinux do not actually care about the current Unix user: all it sees is a supplementary metadata called the context (which includes, among other fields, a domain field) and which lets SELinux decides whether the requested action can be authorized or not. What one usually conceives ...


0

A few pedantic notes: Users often have poor passphrase. Users can change passphrases. User can store their keys in multiple places. Users are likely to use ssh agent so they can unlock the key once, say on their laptop.


0

Do other network functions work?  Try to telnet from one machine to the other.  If you can successfully connect as root, and not as non-root, you have a problem.  Even if you get "Connection refused" (or something similar) as root and "Permission denied" (or something similar) as non-root, you have a problem. TL;DR If other network functions work as ...


4

Simply change permissions of the files in a way everyone could read them, but not alter them. When you use ls -l to list your files, you get something like ls -l file -rw-rwxr-- 1 rafael Grp 1620 Aug 18 14:58 file That first set of dashes/letters sets the permitting of three distinct (but not exclude each other) groups, namely User ...


3

Solaris has a built in format command which has analyze and purge subcommands to do this. See https://blogs.oracle.com/cmt/entry/erasing_disks_securely for more information.


1

Create a passwords file: ~/.mutt/passwords: set imap_pass="password" set smtp_pass="password" Encrypt the passwords file: $ gpg -r your.email@example.com -e ~/.mutt/passwords $ ls ~/.mutt/passwords* /home/user/.mutt/passwords /home/user/.mutt/passwords.gpg $ shred ~/.mutt/passwords $ rm ~/.mutt/passwords Add to your muttrc: source "gpg -d ...


3

you might screw up permissions in your config file you might check your config file into source control you might be working on an open source project so cannot put passwords in source control Answer: use an env var


1

What you want can be done with chroot or maybe even lxc in debian. EDIT: You may want to use overlayfs or squashfs to make what you're doing faster(instantaneous). For that you need debootstrap and squashfs-tools. With these tools you'll able to give your users different runtime versions or archituctures to choose from. For that You need ...


2

If your system is running systemd, you could create a unit which would trigger when the network interface goes down which would lock your screen in the simple case where the machine is physically unplugged from the network. But you want your work computer to verify that you are still connected to your work computer, not merely that your work computer can ...


0

I was looking for something like this (bash): hash=$(sudo cat /etc/shadow |grep "^$USER:" |cut -d: -f2) cmphash=$(mkpasswd -m sha-512 -S "$(echo "$hash" | cut -d '$' -f3)") cmp <(echo "$hash") <(echo "$cmphash") && echo "Correct password!" This works but harcodes the hash method which somehow identified by the number in echo "$hash" | cut ...


3

Most modern Unix systems use PAM to handle authentication. The pam_unix module is the one that does password authentication against /etc/password and /etc/shadow. However, you shouldn't reinvent the wheel. Asking for the user's password and running as root is a basic configuration of sudo, the de facto standard way to elevate privileges. Note that properly ...


4

Setting a password with passwd or chpasswd generates a random salt, so users who happen to have the same password would not have identical hashes. In order to have identical hashes this way, you'd have to have a misconfigured system that somehow doesn't save entropy between reboots, and systems that are so completely identical as to repeat the random seed ...



Top 50 recent answers are included