Tag Info

New answers tagged

0

This code using PAM worked for me: #include <security/pam_appl.h> #include <security/pam_misc.h> #include <stdio.h> #include <string.h> // Define custom PAM conversation function int custom_converation(int num_msg, const struct pam_message** msg, struct pam_response** resp, void* appdata_ptr) { // Provide password for the PAM ...


1

Environment variables are plenty secure. What the question you linked to is saying is that if the system is compromised, the only security benefit of using environment variables over a configuration file is obscurity. Meaning that if someone has gained root access, they can get to both. Whether using environment variables for secret data is considered ...


1

As Gilles explained in a very comprehensive answer to a similar question on security.stackexchange.com, process environments are only accessible to the user that owns the process (and root of course).


2

First of all, if files are missing, it does not mean you should not create them. The common-* files available on Debian are just regular PAM configuration files, however, they are included in any other file which requires them. For instance, on Debian, at the end of the su file, you may find: @include common-auth @include common-account @include ...


0

I see many connections like when I use netstat, are they all to the Internet? It depends on how you define “the Internet”. If you’re at home, and you have multiple computers, some of the connections might be to your other computers.  If you’re at work, it’s highly likely that you have connections to other machines at work. Are there network ...


4

Q#1: I see many connections like when I use netstat, are they all to the internet? No not all connections listed in the output of netstat are to the internet. Many of these so-called connections are to files that are in use on your system. These are special files, one of which, is called a socket. A socket file allows an application to "talk" to ...


1

i see many connections like when I use netstat, are they all to the internet? That depends on the output, you have to tell IPv6 and IPv4 apart. In IPv4, the following adresses are so-called private: 10.x.x.x 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255 and are there any connections to the internet or other things that aren't ...


0

From the brief description you have provided it seems it would be better if you set up a log monitoring system. It would help you monitor the logins, create alerts, compare the data of several days, and yes of-course Graphs for all that. But if you need to monitor it temporarily, you can use last command. last | grep root | grep -v tty | awk '{print $3}' ...


2

Using SCAN_TIMEOUT I would assume that if psad detects scanning attacks from some nefarious IP address that it wholesale blocks it for the duration of time set in AUTO_BLOCK_TIMEOUT. If you just want to block scanning attacks then from the manual I would say you might want to use this timeout instead: SCAN_TIMEOUT 3600; excerpt ...


1

To specify the ip address 1.1.*, you would use 1.1.0.0/16. This notation is used for CIDR (classless inter-domain routing) and is the standard method used to specify blocks of addresses. The /16 indicates the network includes all of the lower 16 bits of the address, so it matches in this case the address block from 1.1.0.0 to 1.1.255.255.


1

How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting? Download Debian installation media. Download the accompanying SHA256SUMS and SHA256SUMS.sign files. Import the keys from the Debian keyring or a PGP key server and check their fingerprints on the Debian website accessed over HTTPS. $ gpg --recv-key ...


2

the pages at https://tails.boum.org/download/index.en.html#index3h1 explain the process of verifying that the image you download has the expected checksum, the process of verifying that the checksum you read on the website is signed by the distributor, the process of have reasonable evidence that the key you downloaded is indeed not a malicious one. To be ...


2

Debian provides MD5 checksums to all image files which you can then compare with your downloaded file to make sure it is the same file.


8

You can use the last command to get this information # last|head phemmer ssh 192.168.0.24 Wed Aug 20 21:08 - 21:08 (00:00) phemmer pts/13 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh 192.168.0.2 Wed Aug 20 14:00 - 18:43 (04:43) phemmer ssh ::1 Wed Aug 13 23:08 - 23:08 (00:00) ...


6

You should not allow people to use ssh by logging in directly as root (using the root password or a certificate in /root/.ssh/authorized_keys) if you want to audit who logged in as root. Instead, use one account for each person and let them use sudo to gain root permissions. In this way you will find in the appropriate log (the position of the log file ...


4

The command who /var/log/wtmp should show information like what who shows, but going back in time.


10

This depends on your distribution or OS. sshd will log each login somewhere, and will include the relevant IP address in the login a format like this: Aug 20 15:56:53 machine sshd[2728]: Accepted publickey for root from 192.168.1.2 port 49297 That part is consistent, but how you get there can vary. On systems based on systemd, use journalctl: journalctl ...


0

You'll get better answers if you say what exactly you want to do instead of how you want to do it - in other words: Put down the chocolate-covered banana and step away from the European currency systems. TL;DR summary Q: Will it work? A: It could. Q: Does it make sense? A: Only under some very specific assumptions, I'm afraid. Security is very hard to get ...


0

It is my understanding there are severe problems if you ever log in to X as root with root's home directory set to /. In the old days the protection provided by /root was considered unnecessary and having root's home dir as / was merely untidy but not so much anymore. root didn't used to have full sessions but now he does if some people misuse the system.


11

Yes. /root has 700 permission (rwx------) whereas / has 555 (r-xr-xr-x) permissions for all users. Now if you use various common utilities you would have /root/.config with rwxr-xr-x permissions. If you were in /, that directory becomes accessible to anyone on the server, whereas if it was in /root it would not be. Having root's data accessible to any user ...


0

I think, there are things which you simply can't prevent. In your place I used 2 partition on the flash drive of the client. The first were used for booting, and to load in a minimal C program. This minimal C program contacted the server, and got the decoding key to the second partition to that. This whole run from initrd. After the successful decoding, ...


0

The host name variable for your mail server is invalid. Try and change the value of myhostname field from /etc/postfix/main.cf from the default value to your host name (e.g. yourwebsite.com or mail.yourwebsite.com)


0

If you want to do something like this you'll have to use a restricted sudo rule (like this): user ALL=(root) /bin/ls -l /proc/* using the sudoers command (as root of course :-)1023) The "user" would then type in: sudo /bin/ls -l /proc/.... to get the information.


2

You actually can't set permissions for many entries in procfs (in Linux at least) at all - they are handled by the kernel itself.



Top 50 recent answers are included