Tag Info

New answers tagged

0

I looked all over for this and never found a satisfying answer, but I managed to construct one, so... I suggest making a copy of the key first, unless your goal is to lock your users out of any passwordless keys; if the key is passwordless this command WILL GIVE IT A PASSWORD. $ ssh-keygen -p -P '' -N 'wibblepop' -f ~/.ssh/KEYTEST Key has comment ...


2

RESTRICT The way I interpret "restricting users to the set of programs that do not [allow shell escapes] is often unworkable", it means that it is so common for programs that, on the surface, seem to perform a single, safe task, but actually allow one to run any other program, that one should assume, in the general case, that giving a user access to a ...


2

I like Gilles's answer but there's another aspect to consider: A principle of unix is that each program is supposed to "do one thing well". Programs weren't supposed to get so big and complicated that the user wouldn't be able to predict the result of running one. If a proper unix program touches a file, it's because you told it to touch that file. The ...


15

The literal answer is that there is no such thing as an untrusted application running under your account. If you want to run an untrusted application, run it under a different account or in a virtual machine. Typical desktop operating systems such as Unix and Windows and typical mobile operating systems such as Android and iOS have different security ...


0

CentOS 7 Security Hardening Document that I've just posted might help you out, it's based on OpenSCAP.


0

I can suggest you a tool but I'm afraid it also has a web interface. It's called SeaLion. Even after knowing your apprehension for such tools I'm still suggesting you this tool because: The agent runs as an unprivileged user. All data transfer takes place over SSL connection. So this should address your security concern. The tool has a 'daily digest' ...


0

The guest operating system runs inside the host. The host has full control over everything that the guest does and everything that goes in or out of the guest. Thus any confidential information that becomes accessible to the guest is also accessible to the host. A rogue process on the host can access everything in the guest, assuming that it has sufficient ...


0

When both the Host and Guest OSes are turned off and the data is at rest on a storage device, is it any easier/harder to retrieve the encrypted file system? This scenario is similar to the security of a Truecrypt encrypted container in Host OS. If the Host is already off then accessibility can only be through personal access where more or less, ...


-1

You can just put it in /etc/fstab. A line for a particular user might look like: tmpfs /home/username/tmp tmpfs size=[num]%,uid=[num],gid=[num],noauto,user,mode=0700 Putting a line like that for each user you want to be able to mount a tmpfs in their home directory will make it so. The user username could do just do mount ~/tmp to mount a tmpfs over their ...


3

You can use pam-tmpdir for this. It creates a directory for each user that logs in, at the start of their PAM session. See How to remount filesystem at logout? for a little more context... In Debian, Ubuntu and derivatives it's available in libpam-tmpdir.


2

You have several options like adding the host you want to connect to into the /etc/hosts file: vi /etc/hosts, add: 10.0.0.1 host.where.i.want.to.connect.to make sure that 10.0.0.1 is an IP address which does not exist in your network. Using this method you are overriding the resolving of the host you have configured in your my_program.rb application. If ...


2

TL;DR: It's probably just a typo. Long answer As a quick search shows, vftovp could be a tool in the TeX suite to convert a virtual font metric to a virtual property list. So, the original tool would not be something to be concerned of. Two questions are remaining: Who executed this tool on your machine? Is the binary on your system really this TeX ...


2

Requirements for which I will offer solutions, as bullet points: Passwordless root console login Passwordless root remote login from pre-authorised users Passwordless remote login for specified accounts from pre-authorised users Passwordless remote login for any account from pre-authorised users The following examples are based on Debian, since that's ...


2

So what I think you want to do is get a list of listening ports and then remove them from the "Local Address:Port" column of ss output, I'm using \s{2} in the grep to attempt to only match on the "Local Address:Port" column. Normally I might try to use the filtering functionality of ss, like with ss -tn state established '(sport != :<port1> and sport ...


0

Sudo would be the tool of choice and you could divide the accesses up by group. Create the 3 groups you want as administrators add the users you want in each group. Set your command aliases in /etc/sudoers Cmnd_Alias APPADM = /usr/bin/yum Cmnd_Alias USEADM = /usr/sbin/useradd Cmnd_Alias NETADM = /usr/bin/service network * And then the group ...


1

The simple fact is that if a person can arbitrarily install programs then they probably can install a program that will run under root privileges, so they could install programs that would grant them other types of access. IE any person who can install or modify something that is run as root, is or can easily become root. If you want to separate out your ...


1

sudo has ways to give users access to some, but not all, commands through sudo. You can use the visudo command to safely edit the /etc/sudoers file, with some syntax checking before the file is really saved. Inside the file, you can add a line like mike ALL=(root) /usr/bin/aptitude, /usr/bin/apt-get to give mike access to aptitude and apt-get through sudo, ...


2

You have to have someone have access to the root account to provide additional privileges. Beyond that, you can use sudo to limit effect areas of control for other administrators without giving them root. But overall, what you're describing seems to be more of a political / training issue than a technical issue. Hire the right staff, and they won't get in ...


2

There was such a way, but you needed to have prepared for it already. (Kind of like how the fire insurance people won't sell you a new policy for a smoking hull.) The two most common programs that do this are AIDE and Tripwire. They scan your system, build a database of what's there, and let you save that off to some durable storage medium off-machine, so ...


0

This worked out real well for me. (IPs have been changed to protect the guilty) $ awk '/Failed/ {x[$(NF-3)]++} END {for (i in x){printf "%3d %s\n", x[i], i}}' /var/log/auth.log | sort -nr 65 10.0.0.1 14 10.0.0.2 4 10.0.0.3 1 10.0.0.4


3

As a follow-up of my comment: Run the following command on one shell. You can make a shell script of it or demonize with the -d option. inotifywait -m -r -e open --format '%f' /kernel_sources/directory/in_use/ -o /home/user/kernel_build.log On other shell, execute make The log file /home/user/kernel_build.log will have a list of the files that have been ...


2

I guess we are talking about YOUR system here. Since you own the system the fastest way would be to change it. If you are in the sudoers, you can sudo bash and then passwd to change root password. If you're not, start your system with any live CD you have around, mount the drive where your system is in /mnt for instance, chroot to /mnt or where you ...


3

No, you can't. If they can read the files they can copy them. EDIT: I've been thinking about it and maybe you can do something. If those files should only be accessed by a couple of programs (You said something about CAD files) maybe you can set the program owner to a new user (let's say CADuser) and change the permissions of all those files so that only ...


5

It's very difficult, and more of a policy decision than a technical one IMO. There's just too many workarounds to 'get data from one place to another'. You could disallow copy, but how would you prevent cat $file > /usb/$file? Simply not possible to do exhaustively. I would suggest therefore you instead disallow workstation access to files, and ...


15

You could use something like this: grep "Failed password for" /var/log/auth.log | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \ | sort | uniq -c It greps for the string Failed password for and extracts (-o) the ip address. It is sorted, and uniq counts the number of occurences. The output would then look like this (with your example as input file): 1 ...


6

It might be a bloated solution but i suggest you look at installing something like Fail2Ban It is made for this kind of logging + adds the bonus of being able to add (temporary) rules in your firewall to block repeating offenders. Be sure to whitelist your own ip's though, i managed to lock myself out temporarily on a few occasions


0

cat /var/log/auth.log |grep "Failed password for"|awk -F"from" {'print $2'}| awk {'print $1'}|sort -u


0

The direct answer to your question is, yes, it is possible to do all those things but, no, there is no command line tool to do that task specifically. You could create a script or program to do what you describe but some effort would need to be made to do that.


-1

When you type keys are stored in a buffer, when that buffer is filled you will start listening bips whenever you type extra caracters, those characters are discarded (if my memory serves me well). The next thing depends on what the first program that access that buffer do. If it first discards the buffer content a start reading your keystrokes will be ...


3

Nothing running under X is isolated from other programs running under X. A program running on an X server, using the X11 protocol, can check which other windows are open. There are several other security issues with X11. When configuring sshd, I've only ever seen recommendations for turning access through X off, never on. Wayland is supposed to be an ...


1

You stipulate that you are allowed to run sudo mount with any arguments. In that case, unless I misunderstand your question, it seems to be trivially easy to gain root access: just create a disk image that contains a setuid-root binary and mount it with sudo mount -o loop! After all, anyone can create a disk image, it's just bytes... To prove it, here's a ...


0

Is there a sane solution that I'm missing that would make it possible to encrypt only certain parts of the base system (to be able to boot without VNC and enter the passphrase via SSH)? There are lots of ways to encrypt files. PEFS might be what you want. Is the whole idea of encrypting on a server stupid (since the volumes need to be decrypted for ...


2

It's really up to you. The benefit of setting up jails is that you're going to separate security issues that come up between the jails, as well as making it easier to upgrade and manage them separately, which can increase reliability. The downside of setting up the jails of course is that you have to learn it, it's a bit of management overhead, etc. ...


1

It depends on how users change their passwords. If they just use passwd it's not hard for root user to replace an actual passwd binary with a compromised equivalent. Most people don't have a habit of obsessive checking whether passwd is a binary or a shell script or whether it comes from a legitimate source. But finally, the most important thing is that ...


1

Yes, of course. The superuser can replace the programs that read the user's password (login, passwd, …) by versions that do their job, plus write the password out to a log. The superuser can also replace the kernel by a kernel that modifies the way programs like ls, md5sum, lsof, etc. work so that they report the modified programs looking like the normal ...


0

Theoretically yes. The superuser can modify anything in the running System. That means also the Kernel and all binaries related to logging in, e.g. adding a call that sends the password to a website prior to it being hashed. In practice, this is useless, as you have pointed out yourself, which is why something like this will probably never happen.


0

Easy as 1-2-3: Get source code of shell the user is using Modify such that either everything is logged or just characters after passwd Compile and replace existing shell


3

First, anyone who claims Linux (or any other non-toy OS) is impenetrable is foolish, at best. Some are harder to penetrate than others (OpenBSD is famous for being one of the harder ones); many (including Linux, and even Windows Server) can be secure if maintained by competent admins with sufficient organizational support (enough time, resources, etc.). The ...


0

I believe that one of the defence mechanism against that, is that there is a checksum on these packages, and if a package was changed, the checksum indicated would not match the computed one, then of course you could imagine that the hacker could modify the checksum to reflect the new fraudulent package, but first it would be difficult, and second, no system ...


0

I'd add that security patch are released faster in the Linux world than in Windows, which is something that makes it more secure to my eyes. And Perdro, some people would say that it is easier to hack something from which you have the source code.


3

Linux is a very secure system, however it isn't full free of vulnerabilities. There are malware known as rootkits that can get to a Unix/Linux system and steal information, destoy data,etc. However for rootkits being successful the system must be insecure / bad managed, just because a Linux system is as secure as its administrator is aware of security. ...


-1

All software has vulnerabilities. GNU/Linux systems are not different in terms of having bugs or certain configurations that lead to vulnerabilities. Windows has been in the spotlight because of its much larger desktop install base, which usually is an "easy way in". Not wanting to start any type of war about which is better, one could argue that because ...


13

The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in. By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before ...


2

It's not possible to switch to an arbitrary user / group without superuser access. Utilities like su and sudo switch to root via the suid bit and then enforce whatever privilege system they're designed to provide. It's unlikely that there were any files with a suid/sgid bit that didn't require it, so you broke stuff across the board. There are probably still ...


0

The grsecurity-Debian-Installer script that dtbnguyen found could be worth a try. That said, however, i think this is still a very valid question, because the idea of a package coming from Debian itself should be that if simplifies your life somehow/somewhat, thus avoiding at least part of the hasle of patching a vanilla kernel yourself. In this case, ...


9

Because access to the underlying device is controlled only by file permissions by default, so if your USB stick contains a POSIX filesystem with a world-writable device node corresponding to a real device in the system, you can use that device node to access the corresponding device as a "plain" user. Imagine a device corresponding to one of the audio ...


5

I realize if someone controls your environment you're probably screwed anyway Yes, that. If you run a script in an unknown environment, all manner of things can go wrong, starting with LD_PRELOAD causing the shell process to execute arbitrary code before it even reads your script. Attempting to protect against a hostile environment from inside the ...


0

If you are concerned about system integrity, then selinux or grsecurity (or the various similar security packages) are very powerful. Unfortunately, mastering their policies is far from trivial. (Any decent distro that includes SELinux will have predefined policies for all kinds of things, though.) Grsecurity policies are easier to create but still require ...


11

Olivier D is almost correct, but you must set POSIXLY_CORRECT=1 before running unset. POSIX has a notion of Special Built-ins, and bash supports this. unset is one such builtin. Search for SPECIAL_BUILTIN in builtins/*.c in the bash source for a list, it includes set, unset, export, eval and source. $ unset() { echo muahaha-unset; } $ unset unset ...


1

You could use unset -f to remove the functions builtin, command and type.



Top 50 recent answers are included