New answers tagged

1

Your example code does not drop privileges! It can freely elevate privileges again by calling seteuid(euid). If you can ptrace it then you can make it call seteuid(euid) and thus execute privileged code. Are you asking this because you thought ptrace was read-only? No, it isn't: strace is just one thing you can do with it; ptrace allows the tracer to ...


0

That seems a good guess, because of the possibility of switching back, which is a known area where a security problem would result. Further reading: 12. Local root exploits (Hacker's hut) Re: Preventing ptrace() Jan 03 2003 04:38AM


2

A PGP-signed list of hashes is available, covering all the release files. The PGP key used to sign this is well connected in the web of trust.


2

It's possible for a user on the system (or a monitoring program that captures ps output) to see the password as a parameter to the groupadd process -- if the user or monitor "happens" to run ps while the groupadd process is running. The risk of that happening is small (the groupadd process will likely finish running fairly quickly), but non-zero. See an ...


0

This is in fact a very broad question. Let me try to address the kernel, yes the kernel is shared only if you are not using Kernel Zones. Kernel zones are separate kernels running at the same time, so you can get a higher level of isolation here. If the kernel of this zone gets compromised it will not affect the others ones. It also allows you to run ...


0

Trusted Extensions provides ways to allow limited, controlled communication between zones - for instance, allowing data from your internet facing zone to go to the credit card zone, but not the other way around. It was originally designed to meet government requirements around different levels of data classification (Public, Confidential, Limited Access to ...


0

You really shouldn't be 'cat'ing arbitrary files. It's a bad idea even if the file is not malicious. You can determine the file 'type' by running the 'file' program, e.g. file /usr/bin/vi. Using 'cat' is kind of low-level anyway. Perhaps try using 'more' or 'less'. When I try more /usr/bin/vi I get /usr/bin/vi: Not a text file. Also, you can reset your ...


1

You could do cat -v /usr/bin/vi to have it print the unprintable characters as ASCII representations, not as actual control characters that the terminal may try to process. Does that solve your problem?


1

Use the audit package to accomplish this task. Ensure the auditd service is running, and set to start on boot chkconfig auditd on Set a watch on the required file to be monitored by using the auditctl command : For e.g auditctl -w /etc/hosts -p war -k monitor-hosts That is: auditctl : the command used to add entries to the audit database. -w : Insert ...


2

The easiest and most portable way to see "hidden commands" is probably using cat -v For instance, I might run "cat -v" and paste into that terminal to see the nonprinting characters. Further reading: How can I see what my keyboard sends? (ncurses FAQ)


4

No, you have little control over how the private keys are configured, and you can't detect / enforce any passphrase requirement on them. You also can't limit the size of the keys without modifying the OpenSSH source itself (i.e. there is no configuration option to achieve a minimum key length limit). You can limit the type of public keys accepted using the ...


1

It may depend on which distribution you are using, but in Fedora (and therefore in most or all Fedora-derived distributions including Red Hat Enterprise Linux and CentOS) the selinux-policy-targeted package includes a postinstall script with restorecon and fixfiles commands, so it should not be necessary.


3

This is normal. To understand it, let's see how file descriptors work and how they are passed between processes. You mentioned that you are using GLib.spawn_async() to spawn the shell script. That function, presumably, creates a pipe to be used for sending data into the child's stdin (or perhaps you create the pipe yourself and pass it to the function). To ...


1

The example you give is not just an example. This is a major system upgrade. You better wait for 16.04.1 which is probably more stable. Upgrading from 14.04 to 16.04 is not just an upgrade. If you have 14.04, and it installs a new kernel like 3.2.34 to 3.2.35, you can wait I guess. Well maybe there is a security update in the old kernel, then you can see ...


0

This question has a big chance of getting closed due to the answers you will get are going to be mostly opinion based. But here is my 2 cents. Production systems are reliant on stable releases of operating systems. If you install the latest and greatest kernel/patch/update on your system, you don't know what deficiencies lurk in the short time ahead. I am ...


1

Elasticsearch is not secure when open to the internet btw. Not sure if yours is, just thought I should point that out. "Using a firewall is always important. The elasticsearch http module was not designed to be exposed to untrusted networks as it doesn't provide authorization neither authentication mechanisms. By default, elasticsearch listens on two ...


1

This is definitely an attack. Someone managed to a) drop a file onto your server (possibly via poorly configured apache) b) execute that file You should do: a) mount the /tmp partition with the noexec - option b) reboot the server c) run a malware scan on the complete host while offline d) if that does not help : REINSTALL from scratch To get to the ...


0

There's a way to store passwords in a bash script but you have to encrypt and obfuscate the script so that no one can actually read it or run any type of debugger on it to see exactly what it is doing. To encrypt and obfuscate a bash/shell script and have it actually be executable, try copying and pasting it here: ...


2

The bash command history will be saved in the location specified by the $HISTFILE environment variable. Normally it will be in ${HOME}/.bash_history.


1

It is usually in the .bash_history file located in the home directory For the root, .bash_history is located in the /root folder. You may use #find / -type f -name .bash_history #Run as root to see the .bash_history files for all users.


0

You should have receive a license key with download instructions. Documentation from the modsecurity.org website: How do I use the rules feed from Trustwave? Once you purchase the ModSecurity Rules feed, you will receive the following information: Unique license key(s). Use this key to identify yourself. Download instructions. Details on ...


3

They are described quite well in the standard AIX documentation. fsize : Identifies the soft limit for the largest file a user's process can create or extend. core : Specifies the soft limit for the largest core file a user's process can create. cpu : Sets the soft limit for the largest amount of system unit time (in seconds) that a user's process ...


0

I was skeptical of Stéphane’s answer, however it is possible to abuse $#: $ set `seq 101` $ IFS=0 $ echo $# 1 1 or $?: $ IFS=0 $ awk 'BEGIN {exit 101}' $ echo $? 1 1 These are contrived examples, but the potential does exist.


0

I've been using the form username ALL=(ALL) NOPASSWD: /bin/su targetuser


0

/sbin/iptables -L Will list all the active rules.


0

You have two problems. The first one is you're trying to install mariadb RPM's that conflict with what's in CentOS/RHEL base packages. The second one is you're using the rpm command. For the first problem, since you're not on the internet with this machine, then it's not a problem. But if you do manage to have the machine on the internet, then you may have ...


3

It might be worth looking at the Filesystem Hierarchy Standard which describes what the various filesystems are generally for (from a standards perspective, not everyone has to follow it), which will let you know where personalised data might be stored. However, the short answer is - anywhere an application wants to store it, and has permission to store it. ...


3

No. The mount options trump all. That's what they're for: to ensure that nothing ever gets executed directly from that filesystem. To counter noexec, you can run most programs indirectly by invoking their launcher: If the program is a script (starting with a shebang), invoke the interpreter and pass it the script as its first argument. If the program is a ...


2

If you put proxy settings in /etc/environment then every process running on the system will have access to the password. If you only want the proxy settings for your user then put the settings in a file that's read when you log in, typically ~/.profile. If you don't want the password to be readable by someone who steals the disk, encrypt your home ...


3

As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...


0

Because your /sbin/setcap doesn't have CAP_SETFCAP bit in neither inheritable set, nor permitted set. The file's effective bit is not set as well. And as richard said, it 'll make no sense of security if you grant these 2 capabilities to any non-root user


2

nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...


1

I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...


1

I have a computer with Linux BackTrack 5 as host and Windows XP as guest on virtual box. I am using Host-Only-Adapter to create virtual LAN and to share USB modem internet as well so that both host and guest are simultaneously connected to internet via single USB modem. Usually virtual box (Vmware or other) creates its own own virtual subnetwork, ...


5

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright. $ sudo lastb [sudo] password ...


0

Open terminal and type : wpa_passphrase YOUR_SSID YOUR_PASSWORD Sample output: network={ ssid="YOUR_SSID" #psk="YOUR_PASSWORD" psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702 } Open the wpa_supplicant.conf file and add the following line: psk=6a24edf1592aec4465271b7dcd204601b6e78df3186ce1a62a31f40ae9630702


2

You can generate the NtPasswordHash (aka NTLM password hash) yourself as follows: echo -n plaintext_password_here | iconv -t utf16le | openssl md4 Prefix it with "hash:" in the wpa_supplicant.conf file, i.e. password=hash:6602f435f01b9173889a8d3b9bdcfd0b


0

This seems to have been overlooked: Defaults umask_override which does what was asked (see the sudoers manpage): umask_override If set, sudo will set the umask as specified by sudoers without modification. This makes it possible to specify a more permissive umask in sudoers than the user's own umask and matches historical behavior. If umask_override ...


0

I needed to add a dash when switching users in the console. So su - $ALTUSER instead of su $ALTUSER. The dash - is an alias for the -login option of su.


99

The concern is whether your password is recorded in the authentication log. If you're logging in on a text console under Linux, and you pressed Ctrl+C at the password prompt, then no log entry is generated. At least, this is true for Ubuntu 14.04 or Debian jessie with SysVinit, and probably for other Linux distributions; I haven't checked whether this is ...



Top 50 recent answers are included