New answers tagged

1

Logs should be write-only if they contain potentially confidential data. Obviously they can only be write-only to the application that produces the log and other applications running on the server, and perhaps even to the logging subsystem (once written to the log files), but system administrators and auditors should be able to read them. The most important ...


0

You may sanitize and validate the email address in PHP like this: $sanitized_email = filter_var($email, FILTER_SANITIZE_EMAIL); if (filter_var($sanitized_email, FILTER_VALIDATE_EMAIL)) { echo "This sanitized email address is considered valid.\n"; echo "Before: $email\n"; echo "After: $sanitized_email\n"; } else { echo "This sanitized ...


0

You'll need a root access anyway to install and configure any software on your server. After that you can work as regular user and access your files. Take a look here for example of installing and configuring LAMP on CentOS server.


0

I will add this : Dont make the script to be called directly, but to call a secondary script, the first script will be used to do log: #!/bin/bash [ "$USER" != "www-data" ] && exit set -a sudo realscript &>/var/log/myscript.log and the realscript: [ "$USER" != "root" ] && exit In sudo, put the realscript as sudo permitted ...


0

Setting aside whether your approach is a good idea or not, if mycommand is interactive you should inhibit shell escapes using the noexec directive. This prevents the execution of other commands by presetting the exec() system calls to do nothing. (This is achieved through the mechanisms around LD_PRELOAD, see sudo.conf(5).) Caveat: this is not bulletproof - ...


2

One of the best thing is to use the "Digest_Spec" possibility in the sudoers file, to validate the checksum of your executable Extract of the man page: If a command name is prefixed with a Digest_Spec, the command will only match successfully if it can be verified using the specified SHA-2 digest. Using openssl, to generate the checksum: $ openssl ...


3

Things that can affect the setuid program Let's consider some ways the calling user could affect the behavior of the setuid process. I'll divide the things to consider in three groups: 1) the program itself, 2) the input to the program, and 3) the environment it runs in. The binary: If the unprivileged user can modify the binary that will be run, that ...


4

I'd amend your list of criteria for protecting a script a little. Given this - or a similar - entry in /etc/sudoers: www-data ALL=(ALL) NOPASSWD: /usr/local/sbin/mycommand we can state that the script: must be writeable only by the root user must be readable and executable by the root user must be in a hierarchy of directories that can only be written ...


0

What else can be done to secure a sudo-powered script: use PAM - pluggable authentication modules. PAM administrators guide: http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html PAM module writer's guide: http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_MWG.html PAM application developer's guide: http://www.linux-pam.org/Linux-PAM-html/Linux-...


7

If you only want to delete a file in /home/charlesingalls (and not a file in a subdirectory) then it's easy: just check that the argument doesn't contain a /. case "$1" in */*) echo 1>&2 "Refusing to remove a file in another directory"; exit 2;; *) rm -f /home/charlesingalls/"$1";; esac This runs rm even if the argument is . or .. or empty, but ...


5

Just make sure that the arguments passed to eval are not coming from external input or that if they are, you've sanitized them before hand. As in, don't do: n=0 .... n=((n + 1)) eval "var$n=$1" $n is under your control, the content of $1 is not. If $1 is foo;reboot for instance, eval will receive the var3=foo;reboot code to interpret and that will run ...


2

If you want to forbid paths completely, the simplest way is to test if the variable contains a slash (/). In bash: if [[ "$1" = */* ]] ; then... This will block all paths, though, including foo/bar. You could test for .. instead, but that would leave the possibility of symlinks pointing to directories outside the target path. If you only want to allow ...


10

This answer assumes that $1 is allowed to include subdirectories. If you are interested in the simpler case where $1 should be a simple directory name, then see one of the other answers. Wildcards are not expanded when in double-quotes. Since $1 is in double-quotes, wildcards are not a problem. Both ../ and symlinks can obscure the real location of a ...


1

I'm going to add this, well after the question is officially answered: MAGIC: Malicious Aging in Circuits/Cores, which unfortunately is locked up behind ACM's paywall. The upshot of the paper is that the very small width traces in circuits in use today age during use, and eventually break down. By finding the correct instruction(s) and repeating them over ...


0

Using Bind it's possible to limit the set of source ports used for a query. DNSSec aside, restricting the source port too much makes it easier for fake replies to be injected. If you want to lock down entirely, you could use an external proxy such as Google's 8.8.8.8 DNS servers on 8.8.8.8. Single (internal) source. Single destination for all queries. I can'...


0

According to Steve Grubb's reply on the official mailing list (link to the email): Steve's answer: Is it possible that there are duplicate fields in a record? Sometimes. I've tried to fix those when it happens. The problem is that not everyone runs their audit code by this mail list so that we can check it to see that its well formed. ...


4

Named pipe approach. As root, run mkfifo -m 666 /tmp/foo /tmp/readpipe.sh & And can, as user www-data then write to the pipe echo test >>/tmp/foo readpipe.sh in its simplest form (perl with taint would be better) : #!/bin/sh while read A </tmp/foo do echo received $A done


1

As Krzysztof points out, you'll need a separate cron entry for this. It's probably best to call unattended-upgrade directly (it's a python script), to ensure package blacklists/whitelists, reboots and other details are handled appropriately. For example: echo "0 0-23/4 * * * root sleep $(( $RANDOM % 14400 ));PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/...


2

another option is AIDE (advanced intrusion detection environment). It is free and you can get started pretty easy with one of the sample config files.


2

You have the linux audit system for that, I don't know if it's installed by default on debian but you ca install it by: $ sudo apt-get install auditd audispd-plugins From there you need to configure it, the configuration file is /etc/audit/audit.rules, a rule for your purpose would be like: # Delete all previous rules -D # Set buffer size -b 8192 # ...


0

So I solved tiny a part of the problem - I found out that auditd start, ver=2.2 is valid. I failed to find any documentation though. The only document I have is an example from the Red Hat's manual: Example 7.5. Additional audit.log events The following Audit event records a successful start of the auditd daemon. The ver field shows the version of ...


0

For some reason the mount.ecryptfs_private call is failing, so it's not able to mount the eCryptfs folders it tried to set up. I'm not sure why, but checking man mount.ecryptfs_private it reveals some info like: mount.ecryptfs_private is a mount helper utility for non-root users to cryptographically mount a private directory, ~/Private by ...


2

From your github link, follow "Audit Event Parsing Library" which has a link the the dictionary at https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv The raw CSV version is at https://raw.githubusercontent.com/linux-audit/audit-documentation/master/specs/fields/field-dictionary.csv


0

You can also modify the bash shell to do some rsylog. Effectively, you setup rsyslog on a remote host to accept specific connections. Then modify the host shell on which you want to monitor - by compiling your version, with one which has the following enabled: vi config-top.h #define SYSLOG_HISTORY #if defined (SYSLOG_HISTORY) # define SYSLOG_FACILITY ...


4

There is no way to verify that a binary package does what the source says it should do (it's an unsolvable problem both in theory and in practice). However, if you know how the binary package was produced, you may be able to be certain that it was the result of compiling the source code. This requires trusting: the compilation tools (not just compilers as ...


0

Yes, a custom encoding C# class will function properly with the Mono .NET 4.0 libraries installed on Ubuntu 16.04. After battling with the .NET 4.0 HttpEncoder feature described in [https://msdn.microsoft.com/en-us/library/system.web.util.httpencoder(v=vs.100).aspx] for an hour , I got this exception: The actual exception which was being reported was: ...


0

You could follow and Watch CEH Channel on Youtube Install Kali Linux/BackTrack/BlackBuntu and get started with basic tools installed in these operating systems This document could be of some use.


1

I've tried a bunch of tools, including iftop, ntop, iptraf, and of course the very useful built-in netstat -tupln, but the most practical for my use case turned out to be nethogs - it aggregates connections by the originating app, and is the least noisy of all. Installable via: sudo apt-get install nethogs Run as root: sudo nethogs


1

In my case I've found that I can add an entry to /etc/group that masks the Active Directory entry. (This might not be the correct solution but in my situation it works). Here is what I would add for your example, where getent group 67uts-mq-admins returns 67uts-mq-admins:x:57376: mqm:x:57376: You may be able to run the command addgroup --gid 57376 mqm or ...



Top 50 recent answers are included