Tag Info

New answers tagged

0

After uploading the backup you can use chattr +i to make them immutable so they can not be modified or deleted. Only root can set or clear this flag. As an alternative you could chown the files to another user after upload so that the backup account no longer has access to them.


0

Running system services under the same account as a personal account is very bad practice. Use this as an opportunity to end this practice. System services should run with minimal privileges, to limit the impact of a security hole. Having access to an administrator's configuration files (to plant privilege escalation methods), or worse, to an ...


1

AFAIK duplicity can't do a backup of a remote directory to a local directory. I solve the problem in two steps. On the backup server do: Run rsync over ssh using ssh keys to sync the remote directory to a local directory rsync -avz -e ssh user@remote:/remote/directory local_directory Run duplicity from one directory to another. Use asymmetric GnuPG keys, ...


1

As far as I know, there is no way to restrict a user from changing the modification time of a file. Changing the modification time is a normal feature, use for example when extracting files from an archive or copying them from another machine. Instead of looking at the modification time, look at the inode change time (ctime). Pass the option -c to ls to ...


1

You can prevent hackers from using PHP code to change modification time (mtime) of files that are writeable by your web server by disabling those PHP functions (such as touch) using [disable_functions][1] option in php.ini configuration file. However, tracking modification time is not the right approach because the modification time of files do not change ...


0

This answer is building on the answer suggested from @gnp. The difference being that to reduce the risk of vlock locking of virtual console/terminal switching being impacted by the usual pm-suspend etc hacks that tinker with the consoles. Similar the answer of @gnp we need two files /etc/pm/sleep.d/20_lock_with_countdown (with +x file permission) ...


1

This sleep.d script should work (replace <youruser> with a user you've got the password for. I ran it with root the first time and couldn't get back in): #!/bin/sh case "$1" in hibernate|suspend) ;; thaw|resume) USER=<youruser> /usr/bin/vlock -ans & echo $! > /var/run/vlock.pid ...


0

As suggested by Slm you can use : $ lastlog -b 0 -t 100 To find out the users that have logged into a system in the last 100 days.


2

Complementing the previous answer that correctly states that the installation of packages itself does execute scripts as root during the process, the later execution of the installed software (even by non privileged users) can harm the system and other users files. During the installation process, the scripts (ran as root) can install suid executable files ...


4

sudo dpkg -i file.deb will happily execute as root code from the package file.deb. In particular, it'll execute at least the pre- and post-install scripts (which themselves can execute anything, from rm -Rf --no-preserve-root / through custom binary code delivered as part of the package. You should only install packages from trustworthy sources.


1

No. The directory that the files are contained within are permissioned so that only the owner of the directory can access them. $ ls -ld ~/.dbus/ drwx------. 3 saml saml 4096 Jan 5 2014 /home/saml/.dbus/ $ ls -ld ~/.dbus/session-bus/ drwx------. 2 saml saml 4096 Jan 18 2014 /home/saml/.dbus/session-bus/ $ ls -ld ...


1

is it possible to port the latest required version of libxml2 to RHEL 4 that way I can use the latest version of ModSecurity? Yes. The ideal way to do this is to install it into /usr/local, presumably building from source. After the build and install, you will need (as root) to run ldconfig to update the linker cache. Libraries in /usr/local/lib ...


0

Second Look is a commercial product that is a powerful tool for intrusion detection on Linux systems. It uses memory forensics to examine the kernel and all of the running processes, and compares them with reference data (from the distribution vendor or authorized custom/third-party software). Using this integrity verification approach, it detects kernel ...


0

You have the most updated bash version for CentOS 5.11. Version bash-4.2.45-5.el7_0.4 is for CentOS 7.X This RedHat page lists the latest bash versions per OS.


1

The version number of a program is not a good indication of the security issues that it has. When a security hole is found, it is standard practice to patch just this hole, and not to upgrade the program to a later version which may turn out to be incompatible in subtle cases. Thus seeing that you have bash 4.1 does not give any information as to whether it ...


0

Here's a one-off script for generating XKCD-style passphrases. /usr/share/dict/words isn't a great dictionary for this since most of the words are long, but it is easily available. For nicer passphrases you could use a dictionary of short words such as the S/Key One-Time Password word list. dict="/usr/share/dict/words" max="`wc -l <"$dict"`" \ perl ...


0

You could do something like... $ssh->enablePTY(); $ssh->exec('/path/to/daemon_adm.py'); $ssh->write('...'); echo $ssh->read();


1

Block all traffic going out to port 23 of a remote server using your firewall: iptables -A OUTPUT -p tcp --dport 23 -j DROP According to Symantec, the destination is host 72.167.37.182 therefore if you want to be more specific (or need outgoing port 23 to other hosts - hopefully not as it's telnet): iptables -A OUTPUT -p tcp -d 72.167.37.182 --dport 23 ...


0

Of course you can delete it. Your question probably means Should I delete it? and as such, is too broad. If I were you, I'd nuke the system and re-install from scratch, but then again, that depends on the environment and usecase.


1

Save the settings in the user's home directory. Yes, a malware running as the user will be able to delete them. So? A malware that infects the user's account can do whatever your application can do. The only way to hide something from malware is to run with some privilege that the malware doesn't have. This would require the user to give your application ...


1

To insert a string in a shell snippet and arrange for the shell to interpret the string literally, there are two relatively simple approaches: Surround the string with single quotes, and replace each single quote ' by the 4-character string '\''. Prefix each ASCII punctuation character with \ (you may prefix other characters as well), and replace newlines ...


0

The 'last' command reads data from /var/log/wtmp file. If you have logrotate service enabled it probably rotates wtmp file. Check if you have wtmp.1 or wtmp.1.gz file inside of /var/log directory. If you have it (or more similar with next numbers: wtmp.2 wtmp.3, etc) it means wtmp log is rotated. Then you can adjust/disable rotation or use 'last -f ...


2

It is likely that logrotate has archived the log(s) of interest and opened a new one. If you have older wtmp files, specify one of those, as for example: last -f /var/log/wtmp-20141001


2

ssh2::exec() returns a stream, which is connected to the stdin, stdout, and stderr of the remote command. So you can do: $command = '/path/to/daemon_adm.py'; $stream = $ssh->exec($command); fwrite($stream, "$text\n"); If you don't want to pass the parameters via stdin, you can use escapeshellarg(): $command = '/path/to/daemon_adm.py ' . ...


1

Unfortunately these are your options: User's home directory /etc Some other designated location on the system There is no magical place you can save your data where it will be impervious to a potential attack. This is why must follow good security practices on the entire machine and make use of a firewall and not install software that hasn't been ...


0

While it is not safe, please remember that Linux these days is in its early twenties - like with other things in IT the security implications were either not that clear back then or addressed later on. Hence, as mentioned in the other answers, do not use password on the command line. You can (and probably shold) also restrict the information provided by ...


14

The command line arguments of every process in the system is considered "public". Not just the w command, but ps and top and many other commands access that information as a matter of course. Indeed no special privileges are required to get that information. On Linux, you can read the command line of another process, even a process belonging to another user, ...


5

No, it's not safe to pass passwords to programs on the commandline. It's better to use: mohsen@debian:~$ mysql -uuser -p Enter password:


2

This looks like the version that patched shellshock (Subject to other bug variations / patches.) for cygwin bash: Date: Mon, 29 Sep 2014 15:22:43 -0600 https://cygwin.com/ml/cygwin-announce/2014-09/msg00040.html AKA: 4.1.14-7 " This is a minor rebuild which picks up an upstream patch to fix CVE-2014-7169 and all other ShellShock attacks (4.1.13-6 was ...


2

Debian applied various patches to bash version in wheezy(-security) which also prevents CVE-2014-6277 and CVE-2014-6278 to be exploitable. See https://github.com/hannob/bashcheck/blob/master/README.md how to interpret your result. My output of the (probably updated) bashcheck script on Debian is: Testing /bin/bash ... GNU bash, Version 4.2.37(1)-release ...



Top 50 recent answers are included