New answers tagged

0

Yes. Following attack can be performed: A user runs an untrusted application This application starts to intercept all the key strokes User runs sudo command in their terminal Password is acquired by the application and an adversary has the full control over the system


0

What does version grub run ? You can write in the commandline grub --version or info version or man grub and tell us the version grub you run (GRUB Legacy or GRUB 2 or GRUB 0.9x) .Documentation you could find at www.gnu.org/software/grub/index.html or wikipedia org .That is much ...


2

No. debian template for lxc-create internally uses debootstrap which certainly verifies downloaded packages against release signatures in the repository just like apt.


0

Even if your new server operating system is hardened to the nth degree, and you use the latest patched software and have no more plain text services; they just may have gained access on the old server through the web application running on the server - for example a SQL injection or file upload vulnerability. So you may get owned again if you deploy the ...


0

Personally, I wouldn't use the Pi's for this. I'd use 2 Mikrotik devices. The Mikrotik's can handle multiple ssid's but only one 2.4hgz channel as you have to use virtual ap's in the wifi model. It also has a vpn server and client so you can use L2TP/IPSec over the unsafe link and it has switch chips. Internet--RB2011--(unsafe link-cat6)--RB2011 ...


0

I decided that I will also share my use case, until I forget it. It might be handy also for future me since I was solving same issue months ago and it took me too much time to find out once more. Ok. it is not actually core-dump, but stack trace that is also useful. Problem: No idea what is going on there: sudo id Segmentation fault Solution: Move suid ...


31

On Linux it depends on the file capabilities. Take the following simple mykill.c source: #include <stdio.h> #include <sys/types.h> #include <signal.h> #include <stdlib.h> void exit_usage(const char *prog) { printf("usage: %s -<signal> <pid>\n", prog); exit(1); } int main(int argc, char **argv) { ...


5

kill(2) man page explains: Linux Notes Across different kernel versions, Linux has enforced different rules for the permissions required for an unprivileged process to send a signal to another process. In kernels 1.0 to 1.2.2, a signal could be sent if the effective user ID of the sender matched that of the receiver, ...


-1

the signal would carry but the process owner belong to root. so, the other user don't have the right to terminate the process so you will receive permission error problem. terminate process is only possible when you own the ownership(proper rights) of the process.


1

what is the better method of securing SSH by using SSH Keys or TOTP? They are completely different things. TOTP is and should be used as the second factor and they are based on the shared secret. This is something you have (token, FreeOTP application with secret key) and if you loose it, you would be screwed up if there was no other factor (they are ...


21

Nothing: strace kill -HUP 1 [...] kill(1, SIGHUP) = -1 EPERM (Operation not permitted) [...]


5

Most scripted and manual break-ins do: clean up log entries and similar traces of the break-in install a rootkit, which allows entry to the system outside of default server programs replace default programs (like ps, netstat, ls, etc.) with manipulated versions which hide any activity of the above mentioned rootkit (ie. ps won't show the running rootkit ...


4

There are utility commands named last and lastb to list the logins and attempted logins on most Unix distributions. In your case you might want to try the lastb command to see the failures. As stated before you will need to be root to see these logs.


2

Whether it's in /usr/local/bin or /usr/bin is irrelevant. It's just a python script that posts either its arguments or its STDIN to a web service: #! /usr/bin/python import sys, os, stat, subprocess content = "" mode = os.fstat(0).st_mode if stat.S_ISFIFO(mode): content = sys.stdin.read() elif stat.S_ISREG(mode): content = sys.stdin.read() else: ...


2

Got it: the software was called Driftnet


1

You should try setting port = ssh to the port you really use. (I assume that even with running ssh on a non-standard port, you're not changing the value in /etc/services, and you probably shouldn't do that anyway.)


1

I believe you need is ssh-keygen, which remembers your "device signature". So even you changed your password, it still works as long as you ssh from the same device. Here is a detailed tutorial how to set it up. Does it need to be run in root privilege? No, you only need root privilege on the host-server when you set it up, in order to edit some file ...


1

It was asked before on ServerFault. Quoting with few modification and notes: Start the process with /usr/sbin/sshd -f ~/.ssh/sshd_config where ~/.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from ...


1

ArchLinux have newest kernel with grsec in their repo. More info about this package can be found on it's dedicated wiki page.


4

With mknod, you create device-special files that allow raw access to the hardware. That is, the kernel looks at the device-special file's permissions to decide whether a given user is allowed raw acess to hardware, not to anything in configuration or some such. E.g., on Debian, devices related to optical drives are created with 0660 permission bits, user ...


7

If you could call mknod arbitrarily, then you could create device files owned and accessible by you for any device. The device files give you unlimited access to the corresponding devices; therefore, any user could access devices arbitrarily. For instance, suppose /dev/sda1 holds a file system to which you have no access. (Say, it is mounted to /secret). ...


4

After the regular, FIFO and socket file types, mknod can also create device files. These are used to access devices. Granting access to devices is considered a privileged operation. Generally, we don't want to create arbitrary device nodes and make them accessible to regular users. That would be Bad. [Aside: Typically device access is granted by ...


0

You could use mknod to access device files in a chroot "prison" (e.g. the device for the root file system)


2

On 23/11/12 12:50, Gene Czarcinski wrote: Libvirt is in the process of changing for using bind-interface to using bind-dynamic to fix a security related issue where dnsmasq was responding to port 53 queries which did not occur on an address on the virtual network interface that instance of dnsmasq was supporting. Checking ps -ax|grep dnsmasq, ...


3

The Policy is simply a basic aid to tidying up and checking the incoming certificate signing requests follow corporate policy (or more precisely, your organisation's Certificate Policy (CP) and/or Certification Practice Statement (CPS)). If you are signing your certificates on the command line, the security benefits are negligible - after all, you (or ...


2

On Unix, users are represented by a number (User ID, or UID). Any user with UID 0 is privileged, normally there is only one called root. Unix system permissions are more or less represented as permissions (the typical rwx) on files (devices, like disks, are also files for Unix). One of the differences is that root can override any read and write permission. ...


1

root is the system administrator, and they can do whatever they want to the system, which can lead to data corruption if the account is not used wisely. Since it appears you are new to Linux, I would recommend you not use root until you get more experience with Linux. To access an administrator/root command prompt from a standard users command prompt, type ...


6

The root user can do pretty much anything that the hardware allows. The root user can write directly to hard drives without going through the filesystem. Root can modify the kernel via modules. The root user can also circumvent any security policy of the system software: he can change ownership of any files, set up privileged ports, write to privileged ...


1

It accesses the Documents/Images of the user you run it as (if they exist - if that user has no home, then it may not work, browsers usually store some data in home, such as the profiles and stuff). Otherwise, the answer is yes. No regular user can (as per usual permissions on home folders) access homes of any other users, or change system files. The ...



Top 50 recent answers are included