New answers tagged

0

Have you tried rdocker? It looks exactly what you are looking for. Enjoy


3

A potential intruder could reboot into single user mode if they had physical access. Physical security is just as important as software security. That is why schools lock out USB drives and the BIOS. You have to lock it down. In /etc/default/grub you can uncomment the following line GRUB_DISABLE_RECOVERY="true" And poof! Single User mode is now gone.


3

Several reasons: one, you have to have physical access to the servers, and most employees don't want to lose their jobs by getting caught on CCTV video breaking into systems. Then, you have some companies that implement BIOS / boot passwords or boot loader passwords. Sometimes, the "single user" option requires a password (if set up properly ahead of time), ...


2

It's not clear what your actual problem is. Port 3306 is MySQL, is the attacker trying to break into your database? If the DB should not be accessible from outside, you should perhaps drop all connection requests from outside (I normally consider sending any reply packets to an attacker an unnecessary courtesy...) If the attacker somehow consumes your ...


0

Provided that your smb.conf contains passdb backend = tdbsam you can export a file with encrypted passwords, on a system that was already setup, using: sudo pdbedit -e smbpasswd:/tmp/smbpasswd Then, in order to setup a new system, you can import it using sudo pdbedit -i smbpasswd:/tmp/smbpasswd -e tdbsam:/var/lib/samba/private/passdb.tdb (/var/lib/...


1

I worked it out - our system used CloudLinux and the other user was operating under CageFS determined by running: /usr/sbin/cagefsctl --list-enabled Following the instructions at: https://www.ndchost.com/wiki/cloudlinux/how-to-add-commands-to-cagefs-users, I then added xvfb to the Cage: vi /etc/cagefs/conf.d/binutils.cfg Then added the lines: [custom] ...


0

I have two aliases added to my .zshrc.local file to create strong passwords. The first is: alias pw.graph="cat /dev/urandom | tr -dc '[:graph:]' | fold -w 1000 | perl -pe 's/(.)(?=.*?\1)//g' | head -n 5" The output of typing pw.graph is five lines of every character that can be typed on a keyboard with the exception of the space bar: /d=|&mRq!g$...


0

This is to be expected (MD5sum being different on bootup when using Puppy on a usb drive). assuming your using a multisession flag. This url may help understand if this is in fact to be expected based on the way you are using Puppy linux. Hope this helps at least point you in the right direction.


1

There is nothing wrong with your VNC server. Why that happened Welcome to the other side of the internet! The side that is not behind a NAT and a firewall. vnc too many security failures simply means that someone tried to login into your VNC server and failed, several times. VNC servers have a security feature in which they block connections for a ...


1

Vote me up, because this is the best answer by far! I first found this question, unconvinced by all the answers, here is a much better one, which also allows you to completely obfuscate your bash script, if you are so inclined! It should be self-explanatory. #include <string> #include <unistd.h> template <typename T, typename U> T &...


1

Those options work by passing options to the compiler, so the most straightforward way is to recompile the kernel. However for a reproducible and module-specific way kbuild allows you to set custom CFLAGs on a per-module basis. https://www.kernel.org/doc/Documentation/kbuild/makefiles.txt You particularly want to set -fno-stack-protector for the modules ...


1

The good thing of Linux is that every Linux can be tuned up to be equal secure than other one. So, select your favorite distro to start over and begin to secure it in the way you prefer. If you want to hardening your Linux distro, check out these topics: Users / groups privileges (don't do everything as root) IPTables (Linux firewall) SELinux Encrypt ...


0

Even though this can only be done with root privilege, but it's still very dangerous: you use ssh from that machine to access other critical machines, then a malicious person with root privilege steal your password or pass phrase without you knowing it.


3

Yesterday This didn't happen yesterday. This happened back in 2014, when the people who were responsible for packaging up mediawiki for Debian simply stopped doing so. Then in 2015 this was noticed and Debian member (and currently listed Debian maintainer for mediawiki) Jonathan Wiltshire filed a bug saying that the version of mediawiki packaged was ...


2

As SmokeDispenser says, it depends on exactly which distribution you're using. In most cases you'd be better off upgrading to a supported release... You can always try adding the Debian security updates to your apt setup, they probably won't break anything. First you need to determine which version of Debian your distribution is based on; then if it's ...


2

In order to prevent root or any one from being able to read your files, you need to encrypt them. File Encryption is a very convenient option to look into if you wish to avoid having to deal with complex file system manipulations. Encryption Options: Encrypt ordinary files and prevent everyone but yourself from being able to view them Encrypt Shell ...


1

I was able to do the above with a tool named passe-partout. See the answer posted by Nathan Osman for further details here http://serverfault.com/questions/549298/retrieving-an-rsa-key-from-a-running-instance-of-apache


3

chsh is setuid, so it can run in a context that means users can perform actions with root's privilege. Anything setuid has to be written very carefully to not allow a privilege escalation. chsh is written in C, and it appears to check that the person running the program is the same as the user that you're asking to change.


2

First sorry for my bad english. Lets show something for you using only unix concepts, cause i think it can help (or maybe not). Imagine that i want that the executable nano can be executed by every users, but must never run as the user that call its executable, but with a limited environment, with access to edit the apache configuration only or files in ...


2

[Inspired by this answer by cas.] But what if …? But what if my script sets a variable to a known value before using it?  In particular, what if it sets a variable to one of two or more possible values (but it always sets it to something known), and none of the values contain space or glob characters?  Isn’t it safe to use it without quotes in ...


0

To find world writable directories, you can use find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print For files change type to f For symlinks type to l To set sticky bit: find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print0| xargs -0 chmod +t



Top 50 recent answers are included