New answers tagged

0

I was skeptical of Stéphane’s answer, however it is possible to abuse $#: $ set `seq 101` $ IFS=0 $ [ $# = 0 ] bash: [: too many arguments This is a contrived example, but the potential does exist.


0

I've been using the form username ALL=(ALL) NOPASSWD: /bin/su targetuser


0

/sbin/iptables -L Will list all the active rules.


0

You have two problems. The first one is you're trying to install mariadb RPM's that conflict with what's in CentOS/RHEL base packages. The second one is you're using the rpm command. For the first problem, since you're not on the internet with this machine, then it's not a problem. But if you do manage to have the machine on the internet, then you may have ...


3

It might be worth looking at the Filesystem Hierarchy Standard which describes what the various filesystems are generally for (from a standards perspective, not everyone has to follow it), which will let you know where personalised data might be stored. However, the short answer is - anywhere an application wants to store it, and has permission to store it. ...


3

No. The mount options trump all. That's what they're for: to ensure that nothing ever gets executed directly from that filesystem. To counter noexec, you can run most programs indirectly by invoking their launcher: If the program is a script (starting with a shebang), invoke the interpreter and pass it the script as its first argument. If the program is a ...


2

If you put proxy settings in /etc/environment then every process running on the system will have access to the password. If you only want the proxy settings for your user then put the settings in a file that's read when you log in, typically ~/.profile. If you don't want the password to be readable by someone who steals the disk, encrypt your home ...


3

As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...


0

Because your /sbin/setcap doesn't have CAP_SETFCAP bit in neither inheritable set, nor permitted set. The file's effective bit is not set as well. And as richard said, it 'll make no sense of security if you grant these 2 capabilities to any non-root user


2

nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...


1

I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...


1

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host and guest are simultaneously connected to internet via single USB modem. Usually virtual box (Vmware or other) creates its own own virtual subnetwork, ...


4

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright. $ sudo lastb [sudo] password ...


0

Open terminal and type : wpa_passphrase YOUR_SSID YOUR_PASSWORD Sample output: network={ ssid="YOUR_SSID" #psk="YOUR_PASSWORD" psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702 } Open the wpa_supplicant.conf file and add the following line: psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702


2

You can generate the NtPasswordHash (aka NTLM password hash) yourself as follows: echo -n plaintext_password_here | iconv -t utf16le | openssl md4 Prefix it with "hash:" in the wpa_supplicant.conf file, i.e. password=hash:6602f435f01b9173889a8d3b9bdcfd0b


0

This seems to have been overlooked: Defaults umask_override which does what was asked (see the sudoers manpage): umask_override If set, sudo will set the umask as specified by sudoers without modification. This makes it possible to specify a more permissive umask in sudoers than the user's own umask and matches historical behavior. If umask_override ...


0

I needed to add a dash when switching users in the console. So su - $ALTUSER instead of su $ALTUSER. The dash - is an alias for the -login option of su.


97

The concern is whether your password is recorded in the authentication log. If you're logging in on a text console under Linux, and you pressed Ctrl+C at the password prompt, then no log entry is generated. At least, this is true for Ubuntu 14.04 or Debian jessie with SysVinit, and probably for other Linux distributions; I haven't checked whether this is ...


2

A bug that allow a remote individual to crash the software (DoS) isn't exactly at the same level of risk as what we normally think of when we talk about "vulnerabilities". I wouldn't call this a "vulnerable" package; otherwise, you're elevating any bug that can cause the program to crash to a security "vulnerability". Also, it's not clear to me whether ...


19

Debian has security tracker which shows status of the CVE's in all supported releases. Here is your: https://security-tracker.debian.org/tracker/CVE-2015-8041 You can check it is fixed in version 2.3-1+deb8u3. The fix was probably backported to the older version, which prevents breaking other things with rebase to new version in stable release (point of ...


2

Kees Cook implemented a sysctl to fill this need in early 2009. As documented in Documentation/sysctl/kernel.txt: modules_disabled: A toggle value indicating if modules are allowed to be loaded in an otherwise modular kernel. This toggle defaults to off (0), but can be set true (1). Once true, modules can be neither loaded nor unloaded, and ...


1

The best as i have tested is to use Profile.d best & safest way Step # 1 (Create a Alias File) [root@newrbe ~]# vim /etc/customalias.sh Add Below lines : alias rm="echo remove contenet is restricted" alias poweroff="echo Poweroff is restricted" alias chmod="echo Change Permission is restristed" Save & quit Step # 2 (Create Profile loader) ...


1

RAID1 will destroy everything in the case you make a mistake or a virus decides to destroy your files. But, it makes it easy to fix actual hard drive failures. rsync will cause downtime in the (very common) case that your primary hard drive fails, because you have to transfer the data back (or at least swap out the drives). But, it makes it easy to recover ...


3

My personal favourite is: create a Raid1 Software Raid (mdadm) do regular incremental backups do weekly full-backups. The software raid1 protects you from online-faults, such that the volume is active ALWAYS, as long as one drive is okay. The software raid automatically syncs the contents between the drives, so you always have the up-to-date data ...


0

The threat of repeatedly failed sudo access attempts is that a malicious user might be able to brute force the password and thereby escalate their privileges. Since the user in question doesn't actually have sudo access, this is a dangling threat – a threat with no vulnerability to exploit. However, a monitoring system might trigger an alarm for this as part ...


6

To cover a few points the other answers haven't: First, look what's in the file before you extract it: tar -tvf untrusted_tar_file.tar If there's anything in there you don't trust or want to extract, don't extract the tarball. Second, extract the tarball as a non-root user that only has write access to the one directory you're extracting the tarball ...


3

If your hardware is not physically secure, nothing you do in software will give you physical security. Don't bother encrypting unless you have a separate, secure location for the key. Full disk encryption on a computer is useful when someone types in the (password to derive the) key at boot time. Full disk encryption can also be done if the key is on a ...


18

With GNU tar, it's simply tar -xvf untrusted_file.tar in an empty directory. GNU tar automatically strips a leading / member names when extracting, unless explicitly not told otherwise with the --absolute-names option. GNU tar also detects when the use of ../ would cause a file to be extracted outside of the toplevel directory and puts those files in the ...


34

You don't need the paranoia at all. GNU tar — and in fact any well-written tar program produced in the past 30 years or so — will refuse to extract files in the tarball that begin with a slash or that contain .. elements, by default. You have to go out of your way to force modern tar programs to extract such potentially-malicious tarballs: both GNU and BSD ...


0

If a malicious user got access to your login and you have unrestricted sudo access, you are correct: sudo access wouldn't provide any additional barrier compared to just using a root shell directly. (That's likely the first thing they would do with their sudo access anyway.) However, if it's just you using it, using normal privileges except when you ...


0

I suspect that the system reports each failed sudo attempt to the sysadmin, who takes them as individual action items. Yelling at you allows the sysadmin to cross them off his/her todo list. The threat model is not to the system, but to the sysadmin. The sysadmin feels a need to respond to these incidents to prove that s/he is not asleep at the wheel. If ...


3

I can't speak to your specific situation; you'll have to ask your sysadmin why they chose to yell at you. But I can tell you why sudo reports these incidents: Because there is no legitimate reason for them to happen. You do not have root. You should know that you don't have root (and if somehow you don't, you can check with sudo -l). You have no business ...


7

I was trying to follow some linux instructions that involved sudo This is the threat. A user who doesn't know or understand what he or she is entering into their terminal with sudo privileges can cause very bad things to happen very quickly. It sounds like the admin didn't really explain to you that trying to sudo isn't really the issue, (in theory you ...


2

If sudo is configured to send email and if the mailbox file hypothetical failed sudoers email goes to (or if the MTA is broken, the mail queue) is not or seldom monitored, and if a malicious local user is given sufficient time, and if disk usage on /var is not monitored, then a malicious local user may be able to fill that partition with mailbox or mailqueue ...


14

First off, sudo all by itself, doesn't send any emails or create warning messages, other than logging your unsuccessful attempt to the log. People who observe these logs and correlate events (most probably using a scripted log watcher), see that some user id, which happened to be yours this time, is trying to gain root access where he/she is not permitted. ...


0

It is generally good security practice to set service and application accounts to non interactive login. An authorized user may still have access to those accounts using SU or SUDO but all their actions are tracked in the Sudoers log files and can be traced back to the user who executed commands under service account privileges. This is why it is important ...


0

Hardening is the process of making a system more secure. For example, setting file system permissions or turning off services that leave the system vulnerable.


1

Yes, it's always a very good idea to have an unprivileged account on the system to use when you do not need admin privileges. On systems with X Window (e.g. KDE, GNOME) this is practically mandatory. If you have console-only access it is recommended anyway to have it -- even if you're working all the time as admin. In fact, you should block remote ssh ...


2

If you are neither God nor the Pope, you're not infallible, so prone to make mistakes. ;-) Therefore I would create 2 users: A user that can read everything but not change anything: adduser NormalUserName An "Admin" user that needs the sudo command to change anything. adduser AdminUserName adduser AdminUserName adm adduser AdminUserName cdrom adduser ...


1

The document you're reading is from the last century. I don't remember any system I've used this century that didn't use cookies (described in §8 of the document). With cookies, the first thing an application needs to do when it connects to the X server is to present the “cookie”, which is a password that's randomly generated when the server starts and ...


0

dm-crypt only works with block devices, not files. You can still encrypt files by using loop devices, cryptsetup will even automatically create those loop devices as needed. However, this is only suitable for special cases, for example in an Initramfs where cryptsetup is the encryption tool you already have and you don't want the bloat of adding another. ...


5

dm-crypt is a transparent disk encryption subsystem. That being said, it's better suited to encrypt disks and partitions. It can encrypt files, but they have to be mapped as devices for this to work. If you want to encrypt only one file, GnuPG could be a better tool. Example: gpg -c filename See Also: nixCraft: Linux: HowTo Encrypt And Decrypt Files ...


2

At step 1, try also doing this: systemctl disable firewalld.service systemctl stop stops the service immediately, but leaves it configured to start again whenever it would usually do so (i.e. on boot). systemctl disable removes it from the boot process. To stop it immediately and prevent it starting on next boot, run both. systemctl status ...


2

Removing access to other commands than su, will not inherently make your system more secure. First off you will not be able to prevent internal commands from running if you assign the user to known shell, except likes of rbash but rbash itself is a little more permissive and allow user to run some commands. If you can make a peace with that, you can use ...


1

If you call a user script in the users home (editable by the user) with root permissions, that effectively means the user is root. From a security / principle of least privilege point of view, that's a very bad thing to do. Of course, in your case it might not matter. As long as you know what you are doing and what the possible repercussions are, and if you ...


1

This question is primarily opinion, but I'll go ahead and give you mine. In this case, I don't think it could be considered "bad practice", but in a larger (i.e. corporate) environment, it probably would be. On an RPi at home, go for it - if it were a corporate server that I were a co-admin on, I'd have to object to doing so.


-1

You can using apparmor Or better selinux for this porpose By they yiu can garanti just your software have access to the folder Another way is using chattr . But it not safer then apparmor v selinux


0

Apparmor does exactly what you're asking. You can explicitly allow/deny which file firefox can read/write/execute See here for more help



Top 50 recent answers are included