Tag Info

New answers tagged

3

I just looked at the maldet source code, and can see that the bug lies here, where paths are not properly quoted. Because the path is not properly quoted, the logic being performed fails (as it only looks at part of the path). Frankly, I can't even tell what the end goal of that part of the function is because the code is so full of redundancy, bugs, and ...


0

The last unsuccessful login attempt is shown upon successful login to the system for that particular user, above the last login and the MOTD (if the latter exists). That is, if this is not suppressed by the existence of an empty file ~/.hushlogin The failed logins are stored in /etc/security/lastlog, which is only accessible to root, and readable by the ...


4

I think that the message Java.Exploit.CVE_2013_2472 FOUND means that this installer for the Java runtime is affected with the security bug you posted the description of. If so, it's not a virus at all, just some piece of legit-but-dangerous software. I would say the message from ClamAV is a bit confusing, and the action of deleting the affected file may not ...


2

A trivial but simpler solution is to chmod 700 a directory and operate inside it.


2

One way to do this is to make a blank insecure.key file first and chmod it. touch insecure.key chmod 600 insecure.key Which makes the directory look like total 28 drwxr-xr-x 2 flyte flyte 4096 Apr 17 11:44 . drwxr-xr-x 12 flyte flyte 4096 Apr 17 11:44 .. -rw------- 1 flyte flyte 0 Apr 17 11:44 insecure.key -rw------- 1 flyte flyte 1746 Apr 17 11:42 ...


5

You can try to set umask before converting it umask 077; openssl rsa -in secure.key -out insecure.key Edit: To not affect other files in the current shell environment by the umask setting execute it in a subshell: ( umask 077; openssl rsa -in secure.key -out insecure.key )


0

If a user/process has cap_setfcap or cap_dac_override, then it is trivial to gain root access. If the user is trusted you can add them to group sudo/sudoers (depends on configuration), and they can use sudo. You can even add rules to /etc/sudoers.d/ to allow the user to run setcap only, and only in the specified ways. However this will just give you a ...


0

Check with grep (for / and *): if echo "$user_cmd" | grep '*\|\/'; then ... fi BUT.... you should probably treat this as a permissions issue instead. Assign users who use the script to a group with locked-down permissions. This would be better than just stripping characters as a period (.) could be used for both a file extension (.JPG ) and ../../


1

On Root privileges You can remove root login, root password etc. You will then need some other way to get admin things done: such as adding users to groups configuring sudo to give fine-grained permissions giving users and programs capabilities. root has recently been broken into a number of capabilities, so where you read that you need root to do ...


0

I assumed your problem is the su-pam file and the pam_rootok module. #%PAM-1.0 auth sufficient pam_rootok.so auth include system-auth The sufficient clause short-cuts the authentication process. So system-auth never gets included, which means the pam_group module is never activated for this session. Then, sigh I read ...


1

First off, I usually create a second sshd process with its own configuration file. (sshd -f /etc/ssh/sshd-2222.conf for instance) or by overriding the configuration on the command-line (sshd -p 2222 -o PasswordAuthentication=no,AllowRoot=no). This way they share the same keys, etc, but you can override any of the parameters. Any ideas why this happen? ...


-1

Is it possible to harden a Linux box (possibly with SELinux), such that even the root user cannot do specific malicious activities on it? This may sound cheap, but it's easy: change the uid of the user root to non-zero. Simply go into /etc/passwd and /etc/shadow, modify the existing uid=0 entries from "root" to something else, and then add an account ...


0

Basic and digest authentication basically works by requiring a valid username/password to access a page, giving the browser a 401 unauthorized the first time the it tries to get the page. When your browser realizes it needs a password to get in it prompts the user for what password to give the web server. So there's no real opportunity to do what you're ...


3

It's all about risk mitigation; if make does something destructive, you can only lose whatever data was modifiable (or deletable) by the user running it. So you run make as a plain user to limit the scope to that user's files, and you run make install as root because you have to if you want to install to /usr/local typically. Note that in the example you ...


2

It comes down to trust vs convenience. True, make might be insecure, but then so might make install. It's just that the surface attack area should (hopefully) be smaller for make install, and it's more likely a quick perusal of the Makefile will spot anything strange. However, installing software into the $PATH is risky regardless of who has compiled it, so ...


0

As I am not the only one encountering these entries, it seems to be the mailman upgrade that is responsiable for that. Thanks for sharing your experiences.


0

I wouldn't give root access nor physical access to anyone I wouldn't trust with my life. This is an exceedingly bad idea, but unfortunately the OP never responded to the WHY?! or the What do they need to do exactly? which in my humble opinion were excellent requests for clarification. Be that as it may, If I were to consider such a course of action rather ...


0

In ZFS, encryption is at the file system level - not at the level of zpools - so instead of encrypting the whole rpool, you could pick and choose which filesystems to encrypt individually. As an example, # zpool create halfcrypt mirror file1 file2 # zfs create -o mountpoint=/public halfcrypt/public # zfs create -o encryption=on -o mountpoint=/whatever ...


0

It's possible that somebody was trying to spoof that server. It's also possible, and in most environments more likely, that there was a misconfiguration of some kind. Maybe the DNS is misconfigured and has several IP addresses recorded for the same host name. Maybe two machines were competing for the same IP address. Maybe the SSH server on the target ...


2

IP Spoofing, is a technique where the attacker uses a forged IP source address with the purpose of concealing the identity of the sender or impersonating another computing system. However, this kind of attack will be nearly "impossible" from the internet because RFC1918 defines the following blocks that will be used only inside LAN environments: The ...


1

There are two general approaches to do what you want to do. printer specific method: Using the printer manufacturer provided tools and documentation configure the printer. This has the advantage of the fewest components. On the other hand you would need to trust the manufacturer of the printer to securely implement the print server with all the needed ...


0

The first time you logged into the server, it didn't have a key value associated with it's hostname in your ~/.ssh/known_hosts. When you accepted its identity, you added the key. Subsequent log ins referenced that key value so its identity was verified and you got no message. When you logged in from a different system, one that had accessed this server ...


1

This is a hard situation. The requests seem to match a malicious pattern, so your task is to block the IPs making malicious requests from your server. These days there are all kinds of fancy hardware to do this. If you can't get that then you are down to manually creating firewall rules or apache rules to ignore or block requests from certain IPs. For ...


1

These values must match: /etc/rkhunter.conf: ALLOW_SSH_ROOT_USER=no /etc/ssh/sshd_config: PermitRootLogin no Can you confirm that these values are set as above? If so, you should not be warned by rkhunter any longer.


0

I looked all over for this and never found a satisfying answer, but I managed to construct one, so... Note that this will update the file if it works, so if you're trying to not be noticed by the users whose keys you're testing, you may want to copy the key first. OTOH, since you just caught your user with a passwordless key, maybe you don't care if they ...


2

RESTRICT The way I interpret "restricting users to the set of programs that do not [allow shell escapes] is often unworkable", it means that it is so common for programs that, on the surface, seem to perform a single, safe task, but actually allow one to run any other program, that one should assume, in the general case, that giving a user access to a ...


2

I like Gilles's answer but there's another aspect to consider: A principle of unix is that each program is supposed to "do one thing well". Programs weren't supposed to get so big and complicated that the user wouldn't be able to predict the result of running one. If a proper unix program touches a file, it's because you told it to touch that file. The ...


15

The literal answer is that there is no such thing as an untrusted application running under your account. If you want to run an untrusted application, run it under a different account or in a virtual machine. Typical desktop operating systems such as Unix and Windows and typical mobile operating systems such as Android and iOS have different security ...


1

CentOS 7 Security Hardening Document that I've just posted might help you out, it's based on OpenSCAP.


0

I can suggest you a tool but I'm afraid it also has a web interface. It's called SeaLion. Even after knowing your apprehension for such tools I'm still suggesting you this tool because: The agent runs as an unprivileged user. All data transfer takes place over SSL connection. So this should address your security concern. The tool has a 'daily digest' ...


1

The guest operating system runs inside the host. The host has full control over everything that the guest does and everything that goes in or out of the guest. Thus any confidential information that becomes accessible to the guest is also accessible to the host. A rogue process on the host can access everything in the guest, assuming that it has sufficient ...


1

When both the Host and Guest OSes are turned off and the data is at rest on a storage device, is it any easier/harder to retrieve the encrypted file system? This scenario is similar to the security of a Truecrypt encrypted container in Host OS. If the Host is already off then accessibility can only be through personal access where more or less, ...


-1

You can just put it in /etc/fstab. A line for a particular user might look like: tmpfs /home/username/tmp tmpfs size=[num]%,uid=[num],gid=[num],noauto,user,mode=0700 Putting a line like that for each user you want to be able to mount a tmpfs in their home directory will make it so. The user username could do just do mount ~/tmp to mount a tmpfs over their ...


3

You can use pam-tmpdir for this. It creates a directory for each user that logs in, at the start of their PAM session. See How to remount filesystem at logout? for a little more context... In Debian, Ubuntu and derivatives it's available in libpam-tmpdir.


2

You have several options like adding the host you want to connect to into the /etc/hosts file: vi /etc/hosts, add: 10.0.0.1 host.where.i.want.to.connect.to make sure that 10.0.0.1 is an IP address which does not exist in your network. Using this method you are overriding the resolving of the host you have configured in your my_program.rb application. If ...


2

TL;DR: It's probably just a typo. Long answer As a quick search shows, vftovp could be a tool in the TeX suite to convert a virtual font metric to a virtual property list. So, the original tool would not be something to be concerned of. Two questions are remaining: Who executed this tool on your machine? Is the binary on your system really this TeX ...


2

Requirements for which I will offer solutions, as bullet points: Passwordless root console login Passwordless root remote login from pre-authorised users Passwordless remote login for specified accounts from pre-authorised users Passwordless remote login for any account from pre-authorised users The following examples are based on Debian, since that's ...



Top 50 recent answers are included