Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Can SELinux limit the scope of a binary which has capabilities set?

I would like to give my application (running unprivileged) a set of capabilities which allows it to: chown/delete some files not owned by it set quota for users but limit the scope of its "...
user avatar
0 votes
1 answer
40 views

Does this prevent leaks out of homedirs without SELinux?

I would like to prevent certain users from leaking info out of their home dir trees, even if they chmod their home dir. In other words, I have users alice and bob, and I want to prevent alice from ...
user avatar
-5 votes
0 answers
55 views

How to get root privilege in linux as normal Linux user [closed]

I am a Web app Penetration Tester and recently i have exploited a web server running Linux-x86. I was able to access admin panel of the website and upload any file to the website which then gets ...
user avatar
1 vote
1 answer
45 views

Avoid symlink race rcondition with "mv" in Bash

I want to safely write to a destination file (as root, unter common Linux'es) with "echo" (or catany other Bash built-in stuff) like this echo "foo" > /destination/dir/filename ...
user avatar
0 votes
0 answers
16 views

Simple ebpf code with global variables: failed in the assignment

I have a simple ebpf test code where there are few global variables (As far as I could tell, global variables are accessed vis the map mechanism in my version (5.13 Linux)). Here is the code. int ...
user avatar
0 votes
0 answers
16 views

Docker and UFW exposing internal ports

When I first installed Docker and UFW on my Raspberry Pi 4 two years ago, I stumbled across this post: How to fix the Docker and UFW security flaw Last weekend I reinstalled my Raspi and switched to ...
user avatar
  • 103
0 votes
0 answers
25 views

No Authentication Agent Found Although Already Running

I have an Alpine-Linux based system (PostmarketOS) running with the LXQT DE. Ever since I set up the system, out of the box it came with a bunch of problems with user authentication. I have various ...
user avatar
0 votes
0 answers
13 views

Is there a way to apply security policy from pre-installation setup, but post installation?

Good Afternoon! I have a RHEL 7.9 Server I set up and it is off the network. I am trying to find a way to apply those default security policies (DISA STIG) from during the installation process without ...
user avatar
0 votes
0 answers
16 views

Security concerns for gpg-agent caching the passphrase?

https://www.gnu.org/software/emacs/manual/html_node/pgg/Caching-passphrase.html When using GnuPG (gpg) as the PGP scheme, we recommend using a program called gpg-agent for entering and caching ...
user avatar
  • 255
0 votes
0 answers
26 views

Executable permissions on files that do not need it

I would like to ask you who are familiar with security on unix-like systems how do you rate potential risk on for example config files (ASCII) that have executable flag configured on them. Common ...
user avatar
  • 1
0 votes
1 answer
30 views

Securing GRUB password from linux installation

I recently came across the Linux password change method via the GRUB by entering single user mode. After some digging around I found some articles on how to secure it with a sha512 hashed password....
user avatar
-4 votes
1 answer
37 views

Step by step Red Hat Update for OpenSSL [closed]

How to update Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2022:1066) Red Hat Update for java-11-openjdk security (RHSA-2022:1440) Please guide me step by step, because I have no ...
user avatar
0 votes
1 answer
45 views

How to tell which application UFW is blocking

I have a Debian system running ufw. I have "default deny" on all outgoing connections and I open specific communications (ports and/or IP addresses) as needed. I use the dmesg log to see if ...
user avatar
  • 175
0 votes
0 answers
114 views

unattended-upgrades not working on Ubuntu 20 LTS server

I have been trying to enable automatic security updates on Ubuntu 20 server, with no success. The service is running, but is waiting for signal? : root@u20s:~# sudo systemctl status unattended-...
user avatar
1 vote
0 answers
20 views

Figuring out which user is best to start pm2

I'm about to deploy a highly secure production server, which is running an nginx reverse proxy, which points to the backend server on nodeJS. When a user starts the server by typing in the "pm2 ...
user avatar
0 votes
1 answer
33 views

How to debug source IP which try to access SSH server through port forwarding by SSH

my case is likely following case: SSH client(192.168.0.11) -> public cloud VM with SSH server and setup port forwarding (139.90.90.90)(CentOS7.9)-> one internal SSH server(10.24.24.24)(CentOS 7....
user avatar
  • 1
0 votes
2 answers
28 views

Linux local Password Policy doesn't apply when creating new user

I'm trying to implement a password security policy on my Linux Mint machine. I configured the /etc/pam.d/common-password file with the following lines. password requisite pam_pwquality.so retry=3 ...
user avatar
  • 1
15 votes
2 answers
2k views

Are there security consequences from not giving printf a format to use?

A well-formed printf usually has a format to use: $ var="Hello" $ printf '%s\n' "$var" Hello However, what could be the security implications of not providing a format? $ printf &...
user avatar
0 votes
0 answers
64 views

Why does OpenBSD consider xterm mouse tracking a security issue?

In the OpenBSD 7.1 release notes: Security improvements: Disabled xterm(1) mouse tracking by default. From the commit: Disable mouse tracking by default. This causes extra control sequences to be ...
user avatar
1 vote
1 answer
130 views

After disabling weak ssh ciphers I cannot ssh in at all

My goal is to disable weak ssh ciphers on a linux machine (specifically Lubuntu 14.10--yes, old, there are hardware compatibility reasons that it cannot be changed right now). First thing, I checked ...
user avatar
1 vote
1 answer
36 views

What is "utility" in Solaris when referred to by the Solaris section of Oracle's CPU?

Within the Oracle CPU (Patch information) on Solaris some patches are referred to and reflect "Oracle Systems (component: Utility)." You can see it here referred to also in the CVE ...
user avatar
1 vote
1 answer
41 views

Is it secure to copy packages directly to /var/cache/apt/archives/?

After a fresh install, instead of downloading some .deb packages from a Debian mirror, I would like to copy the files directly from thumb drive to /var/cache/apt/archives/ Would it offer the same ...
user avatar
2 votes
1 answer
45 views

How to log out all inactive terminal sessions in GNU/Linux?

Since I switched to Wayland on Debian11/KDE starting the computer from standby in around 90% of cases shows a black screen and one needs to use ctrl+alt+f{id} and run loginctl unlock-session {id2} to ...
user avatar
  • 3,500
2 votes
0 answers
53 views

Automatically lock my Linux computer when I walk away from it

I would like to lock my Linux (GNOME) machine after I walk away from it. Ideally, it should be a small Bluetooth tag / card that I carry in my pocket with a proximity sensor. Is there some software ...
user avatar
0 votes
2 answers
45 views

when Linux standard account daemon is /sbin/nologin, is there any way to change a file owned by it?

I'm doing the threat hunting. I found one file, it's username is daemon, groupname is root. the file permission is set in SGID (when any user run it, it would run as root). In my user setting, daemon, ...
user avatar
0 votes
0 answers
29 views

Why VNC Client gives Too-Many-Authentication-Failures message despite Fail2Ban?

On server have fail2ban only and no ufw (this is deliberate and part of the spec). Have a specific jail for tightvnc-auth; and when I look at logs -- no failed connection attempts made. I do have ...
user avatar
0 votes
0 answers
37 views

NIST CPE Name of installed package?

Is there way to get the NIST CPE matching string of a installed package (peferably for debian)? E.g. Apache HTTP2 is vendor apache and product http_server I found that out by searching/playing with ...
user avatar
  • 489
0 votes
0 answers
27 views

I need security help with .htaccess HTTP Headers (Apache Server) please!

I have now read through the handbook of Apache and tips in online forums. But unfortunately I don't understand it at all. https://httpd.apache.org/docs/current/mod/mod_headers.html The optional ...
user avatar
23 votes
3 answers
4k views

Has Linux always separated User and Kernel space?

I was thinking back to my introduction to programming recently and remembered writing a C++ program that deliberately read and wrote to memory addresses at random. I did this to see what would happen....
user avatar
  • 341
0 votes
0 answers
72 views

Exposing a systemd service to systemd-nspawn container

I have a system with a bunch of services running on them. Some tasks require the ability to stop and start these services. Given an nspawn container running on a host, is there any way whatsoever to ...
user avatar
  • 53
0 votes
0 answers
65 views

How to find out what program is trying to open the GNOME keyring?

Some tens of minutes after I login with a KDE session, I get a modal gcr-prompter window asking for the master password of the GNOME keyring. The prompt does not include any information about what ...
user avatar
  • 887
0 votes
1 answer
87 views

List running hidden processes after libprocesshider

I make a project in Python3 for Raspberry Pi 4 I use few cli applications that. In ps/htop/top I wanted to hide the command line used on it due to some security concerns. I tried libprocesshider and ...
user avatar
  • 3
0 votes
0 answers
34 views

RHEL 6 Password policy

I've setting my password policies in RHEL 6 using pam_passwdqc. This is what I've set into system-auth & password-auth files: password requisite pam_passwdqc.so min=disabled,disabled,disabled,...
user avatar
0 votes
1 answer
50 views

Is there an enterprise service or native method that provides remote disable for Linux laptops for corporate IT? Like jamf but for Linux

I'm trying to work with our IT to provide a Linux option for laptops. The main sticking point is the ability for IT to disable the possibility for anyone to login to the machine in the event of a lost ...
user avatar
  • 932
-2 votes
2 answers
449 views

Why does Arch Linux install applications to root, instead of home folder like other Distros? Is this a security risk?

I have recently come to understand that Arch Linux install all applications in /root directory only, while other Distro provide an option to the user to install in /home directory ? Why is this the ...
user avatar
  • 17
1 vote
1 answer
74 views

Can a malicious docker image running on GNOME-Boxes compromise the host?

I'm using GNOME-Boxes to run a Fedora 35 guest inside a Fedora 35 host. If I ran a docker container, using the --privileged flag (among others), what's the most harm it could cause? I read a malicious ...
user avatar
0 votes
1 answer
33 views

When is a via ssh accessible remote machine considered secure?

To start; I'm not completely sure, if this is the correct Exchange site for this question, but I couldn't find a better one - so I'll ask it here anyways. Recently i started to think about the ...
user avatar
  • 115
0 votes
2 answers
92 views

Why is Gnome Keyring or a program like it necessary? (NOT a question about how to get rid of it)

I read about what Gnome Keyring does and why it exists and lacking more detailed information I believe its a foolish concept. Why somebody thought that putting all your passwords into one place that ...
user avatar
  • 33
1 vote
0 answers
80 views

Can I avoid having chrome-sandbox as SUID?

I've checked my system for SUID executables and chrome-sandbox is one. It is shipped with Google Chrome and some other apps like Signal or Discord. Is having this executable a security risk while ...
user avatar
  • 231
0 votes
1 answer
90 views

Store Username and Password securely for xfreerdp

I am xfreerdp to login to my other pcs. I am storing the connection on bash file, xfreerdp /multimon /u:{username} /v:{ip:port} /p:{password} -d:{domain} /f /floatbar /multitransport /network:auto ...
user avatar
1 vote
1 answer
262 views

What could this portion of the 'Information Security Handbook' by John M.D Hunter possibly mean?

So I am reading this Information Security Handbook by John M.D. Hunter. I quote two paragraphs of the book below: "An operating system is usually capable of preventing users from performing ...
user avatar
  • 169
1 vote
1 answer
62 views

Why are environment variables being passed to sudo session and is it a concern?

I came across some readings about how allowing environment variables to be passed to root when sudoing is a security concern. This led me to check my environment to make sure I had the proper setup. I ...
user avatar
2 votes
0 answers
29 views

IPv4 iptables - known TCP attacks - nowadays irrelevant it seems, please elaborate [duplicate]

Are the below iptables rules made obsolete by recent kernel versions for example? Having zero hits on these for ages, and I do look quite often - before reboots usually. Our endpoint machines are ...
user avatar
0 votes
0 answers
29 views

Update dm-verity device content

Suppose I have a device /dev/disk0 with dm-verity. I need to update a file on it. So I boot into another (say recovery) and update the file and regenerate verity tree hash and sign it. What I'm ...
user avatar
0 votes
0 answers
18 views

Recursive bind mount not working android x86 7.1.1

I have 3 directories: a, b and c. Directory 'a' contains the subdirectories '1' and '2', and these sud-directories both contain files 'foo' and 'bar'. Directory 'b' also has subdirectories with the ...
user avatar
0 votes
0 answers
46 views

"You can now switch to a Let’s Encrypt certificate." - should I?

I recently apt-get dist-upgraded my Devuan GNU/Linux Chimaera machine. after upgrading the package jitsi-meet-web-config to version 1.0.5818-1, I get a message saying: You can now switch to a Let’s ...
user avatar
  • 7,311
1 vote
0 answers
178 views

systemd-analyze does not detect changes made by systemctl edit

I am hardening my existing systemd services for Ubuntu 20.04 as recommended by a Lynis audit using systemd-analyze. I would like to use systemctl edit to make the changes, but systemd-analyze does ...
user avatar
-4 votes
1 answer
41 views

Avoiding Proxy Server by using Unix for Domain Controller?

Am wondering if Unix can be set to avoid a Proxy Server (Middle-man attack) that has likely been physically established on a cable internet line at the pole (via a physical, "jumper," or ...
user avatar
  • 1
0 votes
1 answer
54 views

How can the integrity of firmware be ensured? (Preinstalled and fwupd updates)

For packages in Debian's repositories, hashes and signatures are checked as described here (and questions linked there) to ensure the integrity of the software to at least some degree (under ...
user avatar
  • 3,500
1 vote
1 answer
60 views

when did I give the application a root permissions?

I've installed azure storage explorer with "sudo snap install". I don't remember giving it root permissions during the installation. Now it's creating directories owned by root for ...
user avatar

1
2 3 4 5
50