Tag Info

New answers tagged

1

Why don't you make your debian computer to require only public and private keys instead of requiring for a password? You can change that setting on the sshd_config file. But before you do that you just have to generate the keys and install them on your server with ssh-copy-keys. After going through this process nobody would be able to even try to guess an ...


1

The biggest issue with public connections is the password. I don't really care if someone comes to know my username/what I did. What matters though, is how they could re-use my password. I suggest securing SSH access with two-steps authentication. I found that link explaining how to enable Google Authenticator for your SSH login: ...


1

In addition to @Stéphane Chazelas's answer, we don't have to worry about this issue if we use -i command line option: $ perl -pe '' 'uname|' Linux $ perl -i -pe '' 'uname|' Can't open uname|: No such file or directory. Because when using -i option, perl used stat to check the file status before process it: $ strace -fe trace=stat perl -pe '' 'uname|' ...


3

You don't want to enable the dgram one. That allows an attacker to make your machine send UDP packets with any content, and if attackers are able to have packets with spoofed source address delivered to you, that means any UDP packet to any destination. For instance if the attacker does: packit -t UDP -s 10.10.10.10 -S 7 -d 10.10.10.11 -D 7 -p ...


13

What's the problem First, like for many utilities, you'll have an issue with file names starting with -. While in: sh -c 'inline sh script here' other args The other args are passed to the inline sh script; with the perl equivalent, perl -e 'inline perl script here' other args The other args are scanned for more options to perl first, not to the ...


2

::1 is the ipv6 version of 127.0.0.1


1

The address ::1 (or 0000:0000:0000:0000:0000:0000:0000:0001 with all fields written out) is an IP version 6 address and specifies the loopback address in host scope. So technically, it is the same as the IP version 4 address 127.0.0.1.


0

Any other firewall will have have the same issue as PF as they all have to keep some type of 'state' to enable packets to come back in to a device behind a NAT or other kind of inbound block that lets replies though but stops new packets.


1

There're builtin application restriction approaches, you don't have to run it within a container. Take a look at apparmor, it should fit all your needs. e.g what file it can read / write, what binaries it can execute


0

Redhat cluster use a fencing method called fence scsi. The fencing node forbid the other from accessing lun in SAN. however, this still requires some sort of TCP/IP communication between node. I assume that by Because of security there is no any TCP/IP network between two linux server. you meant nodes can't access ILO/iDrac feature to power off ...


0

Apt security bugs do exist, but they also get fixed as they as discovered. You still didn't say what release/version you are using. However, if you are very concerned about security, you should be using stable. As mentioned in https://www.debian.org/security/, you should have deb http://security.debian.org/ wheezy/updates main contrib non-free for the ...


0

I would suggest installing Wireshark (https://www.wireshark.org/) on the laptop. That should allow you to show all packets going in and out of the system and the process responsible for them. That should give you a good place to start, once you know the process running I would suggest killing it via the command line and confirming that the traffic to the ...


2

The package in question is iproute not iproute2 on CentOS. Without including the architecture, it is hard for others to verify the md5 sum of your executable. One way to check is to, from a machine you trust, manually pull down the rpm from the centos mirrors, unpack it, and look at the files. When I do this for the latest versions on mirror.centos.org ...


1

there is a daemon running on the IP Cam which is constantly updating a database somewhere with my new public IP from the ISP Makes sense. it is bypassing the router with my router credentials You didn't go into detail about this part but it's not bypassing your router. It's being forwarded to by your router. Your external public IP is the ...


5

This is a security feature. It is set in /etc/login.defs on the line FAIL_DELAY N where N is the time in seconds to delay another attempt.


5

This is a security feature and slows down an attacker who tries passwords.


3

Since you can only run su - other_user to get access to that account, there are things you can't do. You can only run the login shell of that account or programs that the login shell allows you to run. This doesn't make a difference if the login shell is a general shell like sh or bash, but it does if the shell is a restricted shell or some kind of ...


4

Does this security policy make sense? Yes and no. No in the sense that it does not protect other_user's data. But it does protect other_user's password. This may seem inconsequential, but that means there is at least one important thing you cannot do: change the password so that the person who normally uses the account can't access it. Another ...


0

As you indicated there is a limited set of websites the applications need to access, provide those in /etc/hosts and disable DNS lookups. Just make sure you have some mechanism to update those hosts files (either remote initiated scp, or download on a regular basis). This will not block people from using IP addresses to connect to unwanted sites, but makes ...


0

Next to the great answers already given, I can think of the following scenario. A security bug in a service running as a restricted user allows to write a file as that user. This file can be ~/.ssh/authorized_keys. This allows the attacker to login directly in a shell which would make it much easier to execute a privilege escalation. Disallowing a login ...


2

As mentioned in this Kernel Mailing List message, whether a process needs extra security is checked in cap_bprm_secureexec() of the kernel file security/commoncap.c, which does check for capabilities. This is then exported to the process via the auxiliary vector. This can be accessed/tested via getauxval(AT_SECURE). I inserted getauxval(AT_SECURE) into a ...


1

The line setting DIALOG_TEXT has two problems - a leading space, and the wrong variable name. Change it to DIALOG_TEXT="The file '$file' appeared in directory '$path' via '$action'. Clamscan was run on $file, generating the following output: $CLAMSCAN_OUTPUT" To handle filenames with spaces, change the quoting as follows: CLAMSCAN_OUTPUT=$(clamscan ...


2

A quick Google searchs turns up the PDF Javascript Stripper, which appears to do just that. But bear in mind that PDF is a subset of Postscript, which is a Turing-complete language. So there may be other attack vectors, not just embedded JavaScript (even if that arguably is the biggest one), and it’s thus mathematically impossible to know that your PDF is ...


3

Given you're using RHEL, SELinux is likely already installed. To confirm: $ rpm -aq | grep -i selinux selinux-policy-targeted-3.12.1-74.26.fc19.noarch libselinux-devel-2.1.13-15.fc19.x86_64 libselinux-2.1.13-15.fc19.x86_64 libselinux-utils-2.1.13-15.fc19.x86_64 selinux-policy-3.12.1-74.26.fc19.noarch libselinux-2.1.13-15.fc19.i686 ...


2

Firstly search if selinux is installed. rpm -qa | grep selinux, rpm -q policycoreutils, and rpm -qa | grep setroubleshoot If this doesn't show anything then install selinux by, sudo yum install selinux After selinux is installed, configure SELINUX=permissive in /etc/selinux/config Then finally restart your computer for selinux to take effect.


2

As long as you patch your bash shell you should be okay :) For more information on securing and patching the BASH shell check out this website: https://shellshocker.net/ You can first try upgrading bash sudo apt-get update && sudo apt-get install --only-upgrade bash If no upgrades are available I suggest compiling it yourself, we will start off ...


0

I would strongly suggest Kali, because you already get a lot of tools for that purpose, and it is still quite easy to handle (and you get a lot of tutorials in addition).


0

After uploading the backup you can use chattr +i to make them immutable so they can not be modified or deleted. Only root can set or clear this flag. As an alternative you could chown the files to another user after upload so that the backup account no longer has access to them.


0

Running system services under the same account as a personal account is very bad practice. Use this as an opportunity to end this practice. System services should run with minimal privileges, to limit the impact of a security hole. Having access to an administrator's configuration files (to plant privilege escalation methods), or worse, to an ...


1

AFAIK duplicity can't do a backup of a remote directory to a local directory. I solve the problem in two steps. On the backup server do: Run rsync over ssh using ssh keys to sync the remote directory to a local directory rsync -avz -e ssh user@remote:/remote/directory local_directory Run duplicity from one directory to another. Use asymmetric GnuPG keys, ...



Top 50 recent answers are included