Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

-1
votes
0answers
25 views

Is there a generally trusted list of tools I should be using to detect and prevent hacking? [on hold]

When I used to use Windows some years ago the general idea that I came to know was. That on a new system first thing to do, setup some ad block, install something to scan for viruses, don't be stupid ...
-1
votes
0answers
15 views

How secure would it be to use a raspberry pi router + 4g modem? [on hold]

I would like to create my own router which would run DHCP server and allow access to 4g over local network. How secure would something like that be? My concern is somebody gaining access to my local ...
0
votes
0answers
10 views

maintain a permanent keyring for a user across reboots

I want to hold credentials for a particular user in the kernel keyring. These credentials must be available across reboots. I was trying to do the following: keyctl add user keyname payload @u <...
0
votes
0answers
19 views

OpenGPG for collaborative file sharing?

We are trying to create a system where our employees can access are shared encrypted file over a VPN and make edits to it. The file's contents are sensitive, so we want to make it as secure as ...
0
votes
1answer
16 views

Ubuntu 14.04 install “old lamp” stack for penetration testing

I am preparing WAF video for my team and I want to test a sample ubuntu server which will be my victim. I'd like to install "old version" of packages and deploy Wordpress on top of it and use some ...
0
votes
1answer
40 views

How to use sed to obfuscate an IPv6 address

I have the following sed command sed -i 'test.log' -e 's/\([0-9a-fA-F]\{1,4\}\:\)\{7,7\}[0-9a-fA-F]\{1,6\}/\1\w/g' The goal is to erase the last two blocks of the IPv6 address. However, this sed ...
1
vote
0answers
26 views

sedutils vs hpdarm for SED hard disks

According to my reading there are 2 known methods for using Self-Encrypting Drives (SED): hdparm https://www.pugetsystems.com/labs/articles/Introduction-to-Self-Encrypting-Drives-SED-557/ sedutils ...
0
votes
0answers
23 views

How to configure an audit to a folder in Debian?

I am interested in the security of the operating system that I have installed and I would like you to recommend commands that are used for the audit and also, if possible, explain how you can get to ...
-2
votes
0answers
28 views

Harden linux workstation suggestions [closed]

I'm planning to switch for ever to linux - archlinux: I implemented nft firewall to block all input comming to the box, no port expose, no daemon listening on a port. further I'm considering to use ...
0
votes
1answer
59 views

Can I lock down access to a TCP port in Linux

I'm trying to secure a single-node Elasticsearch machine. Basically, I want to put Elasticsearch behind a reverse proxy (nginx) and make sure that the only way any user or process can communicate with ...
1
vote
1answer
43 views

Why not allow all users to schedule jobs with crontabs? [closed]

By setting /etc/cron.allow and/or /etc/cron.deny it's possible to restrict what user is allowed to use crontabs to schedule a cron job to run as that user. At least at my office our SAs default to ...
0
votes
0answers
27 views

sudoers line for sudo user with /bin/su command or runas or /bin/bash

What is the difference between these three sudoers line and which one is more secure and auditable? End goal is anyone in the group 'sudogroup' group should be able to sudo to user 'swuser' or run as '...
6
votes
1answer
81 views

What is the purpose of extrausers?

Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /...
0
votes
1answer
50 views

How to add a new user and disable its root login? [closed]

A sysadmin may want to add a new user that will have no root access (nor sudo). I don't sell hosting services but I can bring this field as an example; an hosting company gives its customers the ...
7
votes
1answer
112 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
0
votes
1answer
57 views

airmon ng ls: cannot access '/sys/class/ieee80211/': No such file or directory

Im using ubuntu bionic (UBUNTU WSL) I can't use airmon-ng! It throws the following ls: cannot access '/sys/class/ieee80211/': No such file or directory I checked airmon-ng: ls: cannot access '/...
-2
votes
0answers
53 views

Preserving Unix code privacy [duplicate]

I need to protect the Unix scripts which I have created. How can I create a password protected binary executable version of the same? I have to submit them to a different team for deployment, and I ...
5
votes
2answers
168 views

How safe is SSH when used for tunneling?

Scenario: I want to connect from Client A to Client B using SSH/SFTP. I can not open ports on either client. To solve this issue, I got a cheap VPS to use as a relay server. On Client B I connect to ...
0
votes
2answers
37 views

Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?

The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
-1
votes
1answer
32 views

Is someone spying me through my webcam?

I executed the following command in terminal and got the output: Command: lsmod | grep uvcvideo Output: uvcvideo 86016 0 videobuf2_vmalloc 16384 1 uvcvideo ...
1
vote
1answer
31 views

max no of tcp connections on a linux system

I know that /etc/security/limits.conf provides the persistent soft and hard limits for several values. However, in the relevant list there is no indication about imposed limits on: a) concurrent ...
-1
votes
1answer
79 views

SSH and VNC security issue question

My Centos 7.5 server in the past few days got thousands of incoming SSH login attempts and today I couldn't log in to my VNC clients because it just said "Too many security failures". So would like to ...
2
votes
3answers
40 views

Is it safe to auto-login if the system is encrypted?

I'm running linux (specifically Debian 9) on my everyday-use laptop, where the disk with the system is encrypted, so whenever I boot it up, the password is required prior to entering the system. In ...
1
vote
1answer
88 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
1
vote
1answer
30 views

LUKS header modified? [closed]

When a LUKS password is sent to the LUKS header for decryption, can it be stolen by a hacker who modified the LUKS header? Suppose my boot partition is healthy.
0
votes
0answers
17 views

can iptables or BPF be used to detect and drop replay attack traffic?

I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is ...
0
votes
0answers
15 views

How to install SSL and DSC certificates?

I generated a keystore and using that I got the SSL. I imported CA certificates and trust certificates to the keystore. After that, I need to implement the DSC so I had kept a backup of the keystore ...
2
votes
0answers
63 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
1answer
46 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
1
vote
1answer
40 views

Is 'xhost local' (no colon) allowing malicious access?

I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly ...
0
votes
2answers
30 views

iptables allow everything, is it safe?

The os is Ubuntu Server 18 and I am running a web server on it. Is it safe to accept all traffic on all ports? iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT I tried ...
2
votes
1answer
29 views

The password of previously encrypted volume got changed by the Debian installer

I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community. Short version of the issue: ...
2
votes
0answers
28 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
4
votes
1answer
94 views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
1
vote
1answer
51 views

How to fill a device with zeros, without overwriting the bytes that are already zeros?

I have a USB flash drive usb 3, the reading speed is much more than the writing speed. Let's say that 99% of the flash memory is already full with zeros, and I would like to fill it with zeros until ...
3
votes
2answers
74 views

Avoid GRUB infection which would crack my encrypted linux

I have an unencrypted /boot partition with GRUB and an encrypted partition, where my Linux is located. An attacker, who wants to read my encrypted partition, could gain physical access to my computer ...
2
votes
1answer
30 views

How can I monitor, record and check about the ports on my LUbuntu having been scanned or connected to by other computers?

I have installed some servers on LUbuntu 18.04, such as postgresql server, mysql server, vino server, and I may have installed and run some servers without knowing it. I rarely intend them to be ...
1
vote
0answers
34 views

LUKS secure automated decryption

I have critical data, let's say machine learning code, GPG keys,... etc. I would like to create a workstation that will work somewhere else- in someone else's premises. I don't have concern that ...
2
votes
2answers
169 views

How to intercept temporary files created by a program? [duplicate]

TL;DR: I know a program creates and then deletes files in /tmp. How can I intercept them for examination ? Context: There's a particular .jar file, which I don't trust; for some reason its source ...
0
votes
2answers
69 views

Where to store proprietary code and executable scripts? [closed]

I have Python code that is run using a bash script. I want non-sudo users to be able to run it without making the Python code readable. What is the recommended pattern? Two ways I considered: Put ...
1
vote
1answer
55 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
2
votes
3answers
37 views

Are there any practical reasons for setting a maxlogins limit for users in limits.conf? What are the benefits?

Why should I set a maxlogins limit in /etc/security/limits.conf? In other words, are there any performance-related and security-related benefits to be gained? I have only three users on my machine, ...
0
votes
0answers
19 views

restricted shell for backup

I was thinking about creating some backup solution for my NAS. My idea is that I could set up a remote system with ssh access and backup tool (whichever I choose to use) would upload files there. All ...
19
votes
2answers
3k views

Should I delete users' passwords once I set up public key authentication for SSH?

It's best to use public keys for SSH. So my sshd_config has PasswordAuthentication no. Some users never log in, e.g. a sftp user with shell /usr/sbin/nologin. Or a system account. So I can create ...
1
vote
2answers
136 views

ls -F OR ls -al - What does the red highlighting mean? [duplicate]

So I ran a ls -F or ls -al on my /usr/bin directory and some of my files showed up with a red background and white text. What does this mean?
4
votes
1answer
46 views

Safely handling PDFs and other ebook formats on Linux [closed]

I'm running Arch Linux and using Okular for opening PDF files and FBReader for other ebook formats (Epub, Mobi, etc.). Simply put, here's my question: Assuming some of those documents come from ...
-1
votes
1answer
44 views

SELinux - workaround using audit2allow?

I read carefully tutorial and got to explanations on using audit2allow which allows access for denied process. audit2allow tutorial After reading about audit2allow it seems that this tool can always ...
0
votes
1answer
56 views

How to create a restricted shell for a specific user

I'm trying to create a restricted shell for a maintenance user. This user should only be allowed to execute a single bash script within his home folder. The user should not be allowed to execute any ...
1
vote
0answers
71 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
0
votes
0answers
9 views

Apache mod_dbd: DBDParams with encrypted password

We're trying to configure Apache 2.4 with mod_dbd to connect to PostgreSQL for user authentication. (Ref: https://httpd.apache.org/docs/2.4/mod/mod_dbd.html) Is there a possibility to store the ...