Tag Info

New answers tagged

2

I will attempt to specifically answer question 3 here as it appears you have found the configuration part of fail2ban which answers questions 1 and 2. If want to beef up security on SSH I recommend the following. Make sure that strict mode is set to true Disable root logins Change your SSH port Disable password logins Use port knocking To answer your ...


-1

Not sure about whonix but I know tails stays anonymous by never using the harddisk and only using the RAM to run and store data. When it quits the RAM is erased. Maybe its similar to that.


0

I think that, at the moment still, the reason is combined. Like you said, Windows outnumbers Linux by far and the default configuration of some versions was less then ideal. Quite a lot of users of *nix OS gain more insight into (security) technologies while tinkering, leading to a better understanding of the systems configuration and in turn to better ...


2

I assume you are trying to set a password to edit GRUB but you need to boot without being asked for password. I think in addittion to your current configuration you need to edit /etc/grub.d/10_linux and add the --unrestricted option. For a complete reference you can check this link in AskUbuntu I posted once, when I was stuck in the same situation. ...


9

What you describe is an anti-exploitation feature called Address Space Layout Randomization (ASLR). Basically, the kernel puts the very top address of a program's function call stack at a slightly different ("random") address every time the kernel loads the program's ELF file from disk. The addresses in argv and the environment variables, of which your ...


0

Performance should not be problem; check @rbl feature of ModSecurity in combination with local DNS caching which will enable you to keep track of offenders in DNS and utilize that DNS zone as reference when deciding to allow or block some connection. more on http://jwall.org/docs/jwall-rbld/ch03s03.html


1

I was experimenting with a ubuntu machine for trying to find a solution for you. When you create a user and delete it and then create a user again, the second user takes the uid of the deleted user so it s hard to find the amount of users by this technic. I suppose there is no command for your willing actions. I think you re going to find your answer by ...


1

I would say there's no issue with disabling this service, assuming you have no need for UPnP (Universal Plug and Play). This is a service which allows for devices to "auto discover" one another on your network and advertise services that they can either provide or are looking for to consume. http://miniupnp.free.fr/minissdpd.html excerpt I first ...


6

To add to the excellent answers of @slm and @ramesh: Yes, as you have pointed out, you can still switch to users with nologin as their default shell by running sudo with a shell defined, but in this case, you have had to: Log in as another user that has a valid shell Have sudo permissions configured for that user to run the su command, and Had your su ...


19

Definitely it serves a security purpose. For example, look at the below bug filed for a system user who had a shell. My debian server was compromised due to the daemon account having a valid login shell and having samba open for internet access. The break in was made by setting a password remotly via samba for the daemon account and the logging ...


12

If you take a look at the nologin man page you'll see the following description. excerpt nologin displays a message that an account is not available and exits non-zero. It is intended as a replacement shell field to deny login access to an account. If the file /etc/nologin.txt exists, nologin displays its contents to the user instead of ...


1

Pwgen is a good choice but You can use the following command to generate the random password: tr -dc A-Za-z0-9_ < /dev/urandom | head -c 16 | xargs Sample outputs: 1z2G4SVmZOdd4uK4 Also you can use the following shell function to generate random password. Edit ~/.bashrc file, enter: $ vi $HOME/.bashrc Append the following code: genpasswd() { ...


1

Use: rpm -Vf /etc/pam.d/system-auth although in this example, rpm will complain that the file isn't owned by any package as it's a symlink. In this instance you need to make sure that you are running the command against that actual file, not the symlink to it: rpm -Vf /etc/pam.d/system-auth-ac


3

Perhaps a 'funny' script in the ~/bin/ or /etc/bin/. Do something like replace the functionality of LS, cat or CD to behave a little differently and give them a bit of a tip-off that something is amiss, (the first one that comes to mind is to have ls/cd has a change to list/move the wrong folder) and have the code listed in a comment of the sh file. Perhaps ...


6

Run an nc listener that echo's out one of the voucher codes when you telnet or nc to it. If they look at the file, they get it too. #!/bin/sh nc -i 2 -l -p 3128 -c "echo amazoncode" Name it something useful, like squid Create some local firewall rules with names or parameters of amazon codes. iptables -N amazoncode -P ACCEPT iptables -I INPUT -j ...


3

Some ideas: Plain-text file in a user's home directory ("Amazon Code.txt" or something else obvious), world-readable Plain-text file in a user's home directory, not world-readable but the user has an easily-guessed password Process with the key obfuscated in the source-code, but it calls something else (say system("sleep 864000 $key")) that exposes the key ...


5

I don't know if this method is something that might interest the students. I create a file as amazoncode with the original code. cat amazoncode 125622234 Now, encrypt the file using the below command. openssl aes-128-cbc -salt -in amazoncode -out amazoncode.aes -k somepassword somepassword is the password that you set for the file. Now, remove the ...


4

You can freeze it with kill -STOP $pid. The process statistics will remain accessable through /proc/$pid, but it will not be executing. You can get access to the executable file with cp /proc/$pid/exe /destination/path.


1

There are reported false positives where chkrootkit thinks it's found Suckit on a clean system. The Fedora bug report indicates that chkrootkit is still broken as of Fedora 20. Having no utmp entry for an X server is normal if nobody is logged in (if it's showing the GUI login prompt). So these results don't indicate that your system is infected. It ...


0

It is possible to resize a window (in Xfce, Gnome 3.8, and probably a few other desktop environments) with something like this command*: wmctrl -r :ACTIVE: -e "0,20,20,500,500" Anyone with access via terminal or SSH can use them to control most of your computer using aviable commands in the user's path. *I know about this sort of usage of the wmctrl ...


2

You have an SSH session, but you are running it from a terminal. The SSH protocol doesn't give the server much control at all. There's almost nothing it can do to you (other than capture your typing). But the terminal you are running may chose to respond to terminal requests that the server sends. It may send a command that requests a terminal resize, ...


0

ssh login is similar to any other login you make directly on the system. It is all the same as physical login only that you do it remotely and you get a remote shell. But regarding your question, am not sure what you have asked is possible, but yes if the user with which you're sshing has the privilege and the script or tool to do that from a different ...


2

Yes, there are some drawbacks here. You are using password-less authentication to increase security. Since giving password will be a second door to login to your system. So in /etc/ssh/sshd_config PasswordAuthentication no RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys ChallengeResponseAuthentication no ...


0

This code using PAM worked for me: #include <security/pam_appl.h> #include <security/pam_misc.h> #include <stdio.h> #include <string.h> // Define custom PAM conversation function int custom_converation(int num_msg, const struct pam_message** msg, struct pam_response** resp, void* appdata_ptr) { // Provide password for the PAM ...


1

Environment variables are plenty secure. What the question you linked to is saying is that if the system is compromised, the only security benefit of using environment variables over a configuration file is obscurity. Meaning that if someone has gained root access, they can get to both. Whether using environment variables for secret data is considered ...


1

As Gilles explained in a very comprehensive answer to a similar question on security.stackexchange.com, process environments are only accessible to the user that owns the process (and root of course).


2

First of all, if files are missing, it does not mean you should not create them. The common-* files available on Debian are just regular PAM configuration files, however, they are included in any other file which requires them. For instance, on Debian, at the end of the su file, you may find: @include common-auth @include common-account @include ...


0

I see many connections like when I use netstat, are they all to the Internet? It depends on how you define “the Internet”. If you’re at home, and you have multiple computers, some of the connections might be to your other computers.  If you’re at work, it’s highly likely that you have connections to other machines at work. Are there network ...


4

Q#1: I see many connections like when I use netstat, are they all to the internet? No not all connections listed in the output of netstat are to the internet. Many of these so-called connections are to files that are in use on your system. These are special files, one of which, is called a socket. A socket file allows an application to "talk" to ...


1

i see many connections like when I use netstat, are they all to the internet? That depends on the output, you have to tell IPv6 and IPv4 apart. In IPv4, the following adresses are so-called private: 10.x.x.x 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255 and are there any connections to the internet or other things that aren't ...


0

From the brief description you have provided it seems it would be better if you set up a log monitoring system. It would help you monitor the logins, create alerts, compare the data of several days, and yes of-course Graphs for all that. But if you need to monitor it temporarily, you can use last command. last | grep root | grep -v tty | awk '{print $3}' ...


2

Using SCAN_TIMEOUT I would assume that if psad detects scanning attacks from some nefarious IP address that it wholesale blocks it for the duration of time set in AUTO_BLOCK_TIMEOUT. If you just want to block scanning attacks then from the manual I would say you might want to use this timeout instead: SCAN_TIMEOUT 3600; excerpt ...


2

To specify the ip address 1.1.*, you would use 1.1.0.0/16. This notation is used for CIDR (classless inter-domain routing) and is the standard method used to specify blocks of addresses. The /16 indicates the network includes all of the lower 16 bits of the address, so it matches in this case the address block from 1.1.0.0 to 1.1.255.255.


2

How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting? Download Debian installation media. Download the accompanying SHA256SUMS and SHA256SUMS.sign files. Import the keys from the Debian keyring or a PGP key server and check their fingerprints on the Debian website accessed over HTTPS. $ gpg --recv-key ...


3

the pages at https://tails.boum.org/download/index.en.html#index3h1 explain the process of verifying that the image you download has the expected checksum, the process of verifying that the checksum you read on the website is signed by the distributor, the process of have reasonable evidence that the key you downloaded is indeed not a malicious one. To be ...


2

Debian provides MD5 checksums to all image files which you can then compare with your downloaded file to make sure it is the same file.


8

You can use the last command to get this information # last|head phemmer ssh 192.168.0.24 Wed Aug 20 21:08 - 21:08 (00:00) phemmer pts/13 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh ::1 Wed Aug 13 23:08 - 23:08 (00:00) ...


6

You should not allow people to use ssh by logging in directly as root (using the root password or a certificate in /root/.ssh/authorized_keys) if you want to audit who logged in as root. Instead, use one account for each person and let them use sudo to gain root permissions. In this way you will find in the appropriate log (the position of the log file ...


4

The command who /var/log/wtmp should show information like what who shows, but going back in time.


10

This depends on your distribution or OS. sshd will log each login somewhere, and will include the relevant IP address in the login a format like this: Aug 20 15:56:53 machine sshd[2728]: Accepted publickey for root from 192.168.1.2 port 49297 That part is consistent, but how you get there can vary. On systems based on systemd, use journalctl: journalctl ...


0

You'll get better answers if you say what exactly you want to do instead of how you want to do it - in other words: Put down the chocolate-covered banana and step away from the European currency systems. TL;DR summary Q: Will it work? A: It could. Q: Does it make sense? A: Only under some very specific assumptions, I'm afraid. Security is very hard to get ...


0

It is my understanding there are severe problems if you ever log in to X as root with root's home directory set to /. In the old days the protection provided by /root was considered unnecessary and having root's home dir as / was merely untidy but not so much anymore. root didn't used to have full sessions but now he does if some people misuse the system.


11

Yes. /root has 700 permission (rwx------) whereas / has 555 (r-xr-xr-x) permissions for all users. Now if you use various common utilities you would have /root/.config with rwxr-xr-x permissions. If you were in /, that directory becomes accessible to anyone on the server, whereas if it was in /root it would not be. Having root's data accessible to any user ...



Top 50 recent answers are included