Tag Info

New answers tagged

2

Get your current config.gz and deploy it in a source tree as described in this answer. Start make menuconfig and go into the "Device Drivers" submenu. Make sure "Serial ATA and Parallel ATA drivers (libata)" is disabled. Scroll down to the "USB support" sub-submenu and make sure "USB Mass Storage" is disabled. You could completely disable USB too if you ...


1

Yes, you're correct: locking yourself to a particular CentOS point release will expose you to future security flaws by preventing you from receiving the fixes. Just as in RHEL, a CentOS point release is not a "version" in the same sense as used by much of the rest of the software world. You will never see a CentOS 6.4.1, for example. All the "4" means here ...


0

Try the following: Grant another user on the local machine access to our X server. It’s pretty easy: $ xhost +SI:localuser:anotheruser localuser:anotheruser being added to access control list Then your user must show up when you: $ xhost Reference


1

Yes, that's perfectly fine. A lot of common utilities do that. You should however have some fallback in case the application does not get sudo - but that's just good script writing. Another way to do things like these, that I do not recommend, is to ask the user to run the application as root, which is bad. So this alternative is better. Also make sure that ...


4

As it so happens, there is another significant interface with the kernel: the /proc and /sys virtual filesystems. While they do not hold regular files, their contents are direct gateways to the kernel: to act on them is to act directly on kernel-allocated memory. For instance, if you want to drop all memory caches, you may use... echo 3 > ...


1

It depends. What do you mean by 'verify'? If you just want to monitor what syscalls some process is triggering then it's possible.. usually.... But if you feel like digging deeper then you're in trouble... I have not heard of any tools that could do that. You can use strace to see what syscalls some particular process is firing. Of course you'll have to ...


2

SSHd does not ban IP addresses. Whenever it encounters an authentication failure, it adds an entry to its log, and keeps going. Other pieces of software, however, may read these logs afterwards and ban IPs according to their rules. The most common daemon used for such a task is fail2ban. Fail2ban works with jails. Each jail is associated to a service, a log ...


0

Sound like a config issue with the "/etc/ssh/sshd_config". Change the below line from PermitRootLogin no To PermitRootLogin yes And restart the ssh service


4

I will try to answer questions as briefly as possible. The questions you are asking are usually addressed in introductory operating systems courses at universities but I will assume you have not taken such a course. Memory isolation for userspace processes is very desirable - not only to protect the kernel from malicious userspace programs, but also to ...


1

If someone has physical access to your computer, they can boot from a USB key, or take out the hard drive and plug it into another computer. To prevent someone from changing boot parameters, put the computer in a locked case or locked room. If the computer is in a locked case but its keyboard is accessible to untrusted people, then you need a software means ...


0

As an addendum to Roland Illig's answer, it's entirely possible to write a program that, when given root permissions, corrupts system files and/or compromises your system in various ways. The problem is that just writing it doesn't mean it automatically gets to run as root -- it needs to have its owner set to root, and then the setuid bit that Roland refers ...


8

The problem is in cases where the content of $x has not been sanitized and contains data that could potentially be under the control of an attacker in cases that shell code may end up being used in a privilege escalation context (for instance a script invoked by a setuid application, a sudoers script or used to process off-the-network data (CGI, DHCP ...


1

Maybe you should first do your homework, and clear up the separate topics "what is virtualisation" and "what is security and how can it be applied to/ is it implemented in different virtualisation methods" and "what specific use case do I choose for both together". You should probably first create an overview for yourself - what are virtualisation methods - ...


0

Most distributions allow you to install a Minimalist / Core set of packages. A small, yet incomplete, list includes CentOS, Ubuntu, Gentoo, and Arch. It is unlikely there would be a significant difference in the amount of ram used in of the above distributions with a minimal install. In general, the amount of RAM used is directly related to the number of ...


1

You may be interested in Arch Linux. It aims to be simple and lightweight, so very few packages are installed by default.


0

Solved. I had to run openvas-mkcert-client -n om -i which I found from this post - this was a different issue but the same error message. Then I could rebuild the NVT cache: # openvasmd --progress --rebuild -v Rebuilding NVT cache... done. Checking the log now shows it is successful: # tail /var/log/openvas/openvasmd.log md main: INFO:2014-12-05 ...


0

Based on those 1st 3 messages it would look like you need to upgrade your version of Perl to at least 5.12.3. Perl version 5.012003 (5.12.3) is at least recommended to run ASSP 2.4.3 (14313) - you are running Perl version 5.010001 - please upgrade Perl Perl version 5.012000 (5.12.0) is at least required to use the unicode Bayesian/HMM engine of ASSP ...


36

Preamble First, I'd say it's not the right way to address the problem. It's a bit like saying "you should not murder people because otherwise you'll go to jail". Similarly, you don't quote your variable because otherwise you're introducing security vulnerabilities. You quote your variables because it is wrong not to (but if the fear of the jail can help, ...


0

I have (hopefully the right word is had now) the same issue, and I think a cron job was responsible for the dialog. I run crontab -l and found that I had a cron job set at the same time the dialog appeaed. Since I didn't needed the cron job I did crontab -r. I haven't seen the dialog since, but it hasn't been too long. Have you solved your issue? If so, ...


0

There are quick and easy ways to do it with bash as the shell, but they aren't very secure. (there have been several security flaws found in the last few years with the authorized_keys 'command" directive, and with Bash's environment variables. Should be safe now, unless there is another lurking bug...) If you want to do this safely, but still want to ...


1

Why don't you make your debian computer to require only public and private keys instead of requiring for a password? You can change that setting on the sshd_config file. But before you do that you just have to generate the keys and install them on your server with ssh-copy-keys. After going through this process nobody would be able to even try to guess an ...


1

The biggest issue with public connections is the password. I don't really care if someone comes to know my username/what I did. What matters though, is how they could re-use my password. I suggest securing SSH access with two-steps authentication. I found that link explaining how to enable Google Authenticator for your SSH login: ...


3

In addition to @Stéphane Chazelas's answer, we don't have to worry about this issue if we use -i command line option: $ perl -pe '' 'uname|' Linux $ perl -i -pe '' 'uname|' Can't open uname|: No such file or directory. Because when using -i option, perl used stat to check the file status before process it: $ strace -fe trace=stat perl -pe '' 'uname|' ...


4

You don't want to enable the dgram (UDP) one. That allows an attacker to make your machine send UDP packets with any content, and if attackers are able to have packets with spoofed source address delivered to you, that means any UDP packet to any destination. For instance if the attacker does: packit -t UDP -s 10.10.10.10 -S 7 -d 10.10.10.11 -D 7 -p ...


14

What's the problem First, like for many utilities, you'll have an issue with file names starting with -. While in: sh -c 'inline sh script here' other args The other args are passed to the inline sh script; with the perl equivalent, perl -e 'inline perl script here' other args The other args are scanned for more options to perl first, not to the ...


2

::1 is the ipv6 version of 127.0.0.1


1

The address ::1 (or 0000:0000:0000:0000:0000:0000:0000:0001 with all fields written out) is an IP version 6 address and specifies the loopback address in host scope. So technically, it is the same as the IP version 4 address 127.0.0.1.


0

Any other firewall will have have the same issue as PF as they all have to keep some type of 'state' to enable packets to come back in to a device behind a NAT or other kind of inbound block that lets replies though but stops new packets.



Top 50 recent answers are included