New answers tagged security
0
The OS can and does add a log entry every time someone logs in as root. But that doesn't do any good against privilege escalation bugs for many reasons.
Once the attacker is root, they can delete log entries. The only way to avoid this is to write the logs to some place the attacker cannot access, such as a write-once media or a remote machine.
Logins or ...
0
If you are missing a rule to enable traffic from ESTABLISHED connections, then you will need a rule allowing traffic from your host to the remote system. It is common to have a first rule like this:
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Then you can eable youe access with a rule like:
iptables -A INPUT -s zzz.example.com ...
2
Exploits by their very nature are trying to not be detected. So most exploits are not coming into the system through normal means, at least not initially. They'll typically use something like a buffer overflow to gain access to the system.
buffer overflow
This style of attack looks for portions of an application that are looking to take input from a user. ...
1
You should set DIR_MODE in /etc/adduser.conf and use the adduser command as recommended in the man page for useradd on your system:
adduser testuser
If you do not want to make changes to the original /etc/adduser.conf (or need different setups) you can make changes in a copy and use adduser --conf <yourconf>
0
Since you are posting this in security I will take a bait. This is how is done in by default in OpenBSD
drwxr-xr-x 5 predrag predrag 512 May 20 23:00 predrag
My account has been created on the boot. You see that by default a separate group is created and I am logged in as a member of that group. That first account is by default member of the wheel ...
1
To make the creation of the home directory behave differently do
useradd -m -K UMASK=0066 testuser
Giving other no access at all should be safe.
0
I've had no problems setting home directories as 0700 as a base, and then opening them up more little by little as required.
0
I don't know who some people are, but I don't agree with them at all. sshfs is about 99% of the speed of NFS (tested) and a lot more robust. It carries with it the ability of ssh to handle the flaky nature of internet traffic without dropping, that on NFS would have you hanging with stale file handles.
I've used sshfs to mount my home directory on my box ...
0
Over 30yrs programming in dozens of languages from assembly to Oracle database administration, and I've found nothing more secure and reliable than Puppy Linux.
Like all Unix/Linux systems, Puppy Linux security is a very different world than the Microsoft one most are familiar with. The disparaging expressed in other answers is completely understandable ...
3
What you're looking for is typically called Kiosk Mode.
Kiosk from scratch
There is a good tutorial over on alandmore's blog titled: Creating a kiosk with Linux and X11: 2011 edition.
View this is only a start.
LiveCD
Additionally I'd consider using a LiveCD for this type of situation since this will limit any permanent damage one can inflict if they ...
2
Just complement the other answers that show you what types of things to anonymize in logs I thought I'd provide a list of tools that can be used to help facilitate anonymizing the logs.
TCPDUMP/pcap
The list is primarily tools for dealing with tcpdump/pcap logs. NOTE: The full list of tools and libraries is here.
AnonTool
Netflow (v5 and v9) traces in ...
2
Adding to the other two (great) answers, it's also good to realize that the process of factor separation, so important for good testing/troubleshooting, is somehow related to the act of removing the sensitive info.
In other words, whenever possible, always try to replicate your problem in a separate environment. Apart from the advantage of ruling out ...
2
The basic rule should be to expose only necessary information.
So here the basic security rules apply:
Only as much access/information as needed
Anything else should be forbidden/not readable
As you can see from many questions asked here - comments will ask for further information, if needed. But it is up to you to obfiscate personal information about ...
2
for benchamrking purposes you should disable syn_cookies:
echo 0 > /proc/sys/net/ipv4/tcp_syncookies
But re-enable them if you're done!
If the server can't take the load you have to optimize your webapp, tune your config, use some kind of caching or use more than one server fronted by a loadbalancer.
I can't tell more detals because it highly depends ...
6
Even though password brute force attempts may not be successful on your system, using fail2ban has other benefits than simply blocking the attack:
Keeps your auth log from filling up too much, saving disk space and making analysis easier.
Reduces unnecessary CPU cycles and bandwidth servicing bruteforce attempts.
fail2ban is a great tool for more than ...
1
[EDIT]: I misunderstud the question, I rewrite a more appropriate ansver here
I do not know Tiger security, but I agree that the user nobody is mean to have NO homedir, NO right over any subdir at all and is mean to really to have NO shell at all (and to do never properly do a 'login').
But the actual settings (in /etc/passwd) is different for differents ...
1
One quick way to do it (if you dont care to take an IV + key and send it through RC4) is:
i=1
while [ $i -le 4 ]
do
dd if=/dev/random bs=1 count=16 2>/dev/null | xxd -ps
i=$(( i+1 ))
done
This will generate four 128-bit wep keys. Adjust count for different strengths
1
Your display manager (lightdm, openbox, etc.) is a child of init which is owned by root. Init isn't set-uid because it's a very special process and is just started with uid of 0. The command ps -eaH gives a structured view of parentage, the relevant bits are:
r 1 ? 00:00:00 init
r 1521 ? 00:00:00 lightdm
r 1531 tty7 00:00:12 Xorg
...
0
/proc is a special pseudo filesystem. From proc(5) (man 5 proc):
The proc file system is a pseudo-file system which is used as an inter-
face to kernel data structures. It is commonly mounted at /proc. Most
of it is read-only, but some files allow kernel variables to be
changed.
I recommend reading the complete man page for an ...
1
There is no basic mechanism to authorize commands because this is mostly pointless. The core unix permission mechanism is about protecting access to data. If you can read the data, you can do anything you want with it. For example, it's impossible to “allow reading but prevent copying” (copying is just reading in one place and writing in another place), so ...
2
The arguments to a builtin will never show up in any ps output, because the builtin is not a separate program with its own command line. All modern shells (except some highly stripped-down configurations of BusyBox), including all bash versions, have echo built in.
Note that if you're calling bash -c "echo $password", then the password will show up for ...
1
Daemon users and flesh-and-blood users are listed in the same files. The “file like /etc/passwd for daemons” is /etc/passwd.
There is no formal definition of human vs system users. The kernel doesn't care (other than granting a lot of privileges to the user with UID 0). Most administration commands don't care either. Some typical differences are:
A human ...
1
What you want to do is not possible. Not only does pam_cap only manipulate the inheritable capabilities (so it does not actually grant any permitted/effective capability at all), it also only deals with users and not groups (not even primary groups).
2
If this is going to accessible via the network, yes. In order for apache to access the public_html it's going to need some level of access to root's home directory (which could be catastrophic if they somehow found a way, via software vulnerability or unsafe configuration, to add something to root's .bash_profile or something).
Run as little as humanly ...
4
You can replace any binaries you want to approve usage of with a wrapper that will alert the operator, store the action requested and delay it until it is approved. Just remove the execute and read permissions from the programs in question (for the users in question) and place a wrapper with the same name somewhere in the path of those users. (The removal of ...
1
You can set those set those to run only with sudo and create a asksudo command that send this to the root user(s)
This might be a good start (only works when for root when it is logged in):
PS: I didn't test it, it might contain errors
function asksudo {
# for users
write root "asksudo from $(whoami):"
write root "\"$(whoami)\" \"$(PWD)\" && ...
3
Just force it to use the builtin:
builtin echo foo
If echo is not a builtin, this will fail.
1
If you really want to split user and system accounts (reading some of the comments on other posts, it looks like you are curious about this), you could leave all system users in the files (i.e. /etc/passwd) database and put people users in a second database (kinda like if you were doing ldap).
For this, you can use the Berkeley DB NSS module (available on ...
0
Most daemons run as root, a few (for security reasons, to limit their capacity for harm) run as their own users. They are listed in the /etc/passwd file. Most distributions limit the "system user's" UID to some value, like 500 or 1000, so that gives a clue. Some deamons have GECOS (user description) entries saying "daemon", others have strange shells. But ...
2
There is no reason to have a seperate user definition file. System users and real users are not technically seperated but organizationally: by the range from which their UIDs are taken. have a look at the file /etc/login.defs. My openSUSE has these entries:
SYSTEM_UID_MIN 100
SYSTEM_UID_MAX 499
UID_MIN 1000
UID_MAX ...
2
If you really mean "forget the password" it probably already did within microseconds of you entering it.
Persistence of authentication through the login session is maintained in Ubuntu-ish systems by ssh-agent and gnome-keyring-daemon. By their nature of operation (non-invertable hashing) it may be fundamentally impossible to selectively remove one ...
2
I don't believe this information is kept anywhere. They only place you could get some of this type of information would be from the sudo command logs, assuming you're using sudo and that your sudo setup gives out permissions such that you're logging on individual commands such as passwd.
I've used this command before to show what accounts are locked,i.e. ...
0
Correct me if I'm wrong, but: As far as I understood it, there is no way a computer can come up with a completely random string. So I came up with the following idea [and hope it isn't completely stupid]:
If one throws a 26-sided dice, the chance to throw, say 26 is 1:26. In other words: The chance to throw 26 is about 0.04%. Further, a dice has no memory ...
3
127.0.0.1 is not the "outside world", it is looking around inside the house.
Check your firewall configuration (iptables in Linux today), most of them shouldn't be accessible from the ouside.
Don't run services you don't need. Uninstall all not required software.
Change passwords to be stronger. Check your usage of the system, don't go chasing any ...
2
Unfortunately I have to answer the question myself now. "Unfortunately" because the answer is "No, it is not possible".
I took a look at how PAP is working, and came to the conclusion that it is logically impossible to store the password as a hash value.
With PAP, the username and password are sent directly to the authentification side. Therefore, the ...
1
This sounds like your password may have been locked. While you're logged in as root, try passwd -u <useraccount>. Or, passwd -d <useraccount> to delete the password for the user. Here is the man page for passwd.
2
When you login as root, check system logs ( /var/adm/messages, who, last, dmesg, etc) to see if you see any errors relating to SSH configuration.
Check your /etc/pam.conf file. Are you using multiple authentication schemes? That login prompt changing suggests that there may be multiple auth entries for SSH in PAM.
Use -v with ssh to see some verbose ...
1
What you're asking for is not a simple suspend-to-RAM, which leaves the RAM powered on and shuts down everything else. Since you'd be wiping cleartext process data from RAM, you need to marshall it all to the suspension image. So you have to invoke the hibernation (i.e. suspend-to-disk) code. The realistic way to do that would be to create an encrypted ...
0
What network-card are you using?
I may be related to promiscuous mode, which does affect a lot of sniffing abilites of modern networking cards.
0
Check out tpm-luks : https://github.com/shpedoikal/tpm-luks
It stores your encryption keys in your computer's trusted platform module.
Another option may be TRESOR, which uses CPU registers to store secret keys.
0
This doesn't directly answer your question but it does give you an alternative option to consider that may help you out. I typically setup my $HOME/.ssh/config file like so:
IdentityFile ~/.ssh/my-computers
# infrastructure
Host lap1
User sam
#PubkeyAuthentication no
ProxyCommand ssh sam@my.dom.com nc lap1.internal.local %p
Then when I want ...
0
I think that's the wrong approach, what are you trying to do ?
Remote control a machine(s) with ad-hoc commands, then use something like csshx
Or Automatically have jobs run by root via cron, then just setup cron jobs on the server, the server doesn't depend on the client machine to login and kick off the job.
0
If interested with PAM authentication and eventual related problems, I started to work on this subject while correctly adding PAM authentication to Openswan/Libreswan.
I today come up with one Web document related to PAM programming in my public knowledge database. You can view this document at ...
0
Agh, I accidentally omitted the portion of that sentence that would have made it sensible. What I MEANT to say was:
And finally, the odds of someone bruteforcing a SSH daemon that ONLY supports pubkey authentication, are nonexistent.
Clearly I shouldn't have been typing last night.
1
It would be best to design your automation such that it's fired off from crontab on the server itself.
Another possibility is to create a setUID wrapper (which can just be something like a C program that calls execv("/path/to/script",argc,argv); or the like) for the root-required commands, and only allow your automation users to run it via group ...
3
This was surprisingly lacking in documentation. I found this file, module-signing.txt, which is part of the RHEL6 Kernel Documentation. In this document it shows how to generate signing keys, assuming you want to sign all your modules as part of a kernel build:
cat >genkey <<EOF
%pubring kernel.pub
%secring kernel.sec
Key-Type: DSA
Key-Length: 512
...
8
This is a broad ranging question and can probably only be answered with the same sorts of brushstrokes. Ultimately, it comes down to what you, the user, wish to protect.
Fundamentally, you should not post anything that would allow someone else to find it easier to compromise your system, or any of the other connected tools or accounts you use. For this ...
0
If you're REALLY desperate to see how the fork bomb works, try running it as root, e.g. sudo :(){ :|:& };:, but again, be warned. Tried it myself on Ubuntu. The system WILL FREEZE!
A simple dissection for you:
:() { #Define a new shell function
:|:& #Pipe function named ':' through itself, creating two copies of itself, and make them run in the ...
Top 50 recent answers are included
