Questions tagged [security]
Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.
2,619
questions
0
votes
0
answers
41
views
Account unlock is not happening even after unlock_time
I want to lock user account after 3 failed attempts, I am following this guide. I am using Ubuntu 14.04 (for jumphost purposes only). However, the automatic unlock is not happening after 10 minutes. ...
- 11
0
votes
2
answers
68
views
Letting a stranger in safely
I have setup a really tiny wireguard server in my home, with my public IP and all. I have used NAT to hopefully protect myself as much as possible, set strong passwords... All these things.
A friend ...
- 109
1
vote
0
answers
27
views
Shutdown after X failed login attempts
I have a laptop with Xubuntu 22.10, whose SSD is encrypted with LUKS, so if it's stolen when shut down, my data should be safe. But it's more likely to be stolen while it's switched on, and then only ...
- 11
0
votes
0
answers
29
views
SSH login: password works not until 3rd attempt (same password)
When trying to log into my vserver the password only works at the 3rd attempt! (Using the same & correct password from clipboard)
Is the system breached?!
Interestingly when using my password ...
- 161
0
votes
1
answer
85
views
Is listing files with ls dangerous as stated on gnu.org documentation?
Is listing files with ls dangerous?
If I run just ls command in a directory with unknown files, can something bad happen?
Can you show me examples how running ls command is dangerous as stated in this ...
- 11
12
votes
3
answers
3k
views
What program in Linux computes the hash of the input password when you log in?
If I understand authentication mechanism correctly, when we input the credentials in the login prompt, the hash of the password is computed and then that hash is compared with the hash stored ...
- 137
0
votes
1
answer
17
views
Make a custom, signed EFI executable? (safeboot.dev)
I'm new Linux, I've used Xubuntu for the past three months so I only know the basics. Recently I came across safeboot, which basically wraps up complex stuff to secure your system.
While reading the ...
- 13
-1
votes
0
answers
113
views
Freeze of Kali-Linux during boot after installation
How to bypass the errors ->
[Firmware Bug]: TSC_DEADLINE disable due to Errata: please update
microcode to version: 0xb2 (or later)
x86/cpu: SGX disabled by BIOS.
RETBleed: WARNING: spectre v2 ...
0
votes
0
answers
34
views
After executing setcap, why I still can't use tar and got an error "operation not permitted"?
Question
I'm doing my internship, working on container security and recently I need to build a container which has security problem to do some tests. Here is my dockerfile
FROM dockerfiles/centos-lamp
...
- 101
0
votes
1
answer
61
views
In dm-verity, why does the entire hash tree need to be verified?
Based on this answer, apparently dm-verity attempts to verify a block when a block is attempted to be accessed. When verifying a block, it goes up the hash tree to verify the root hash.
Why not just ...
- 101
0
votes
3
answers
65
views
Is checking /etc/hosts and /etc/resolv.conf sufficient to know that no server is trying to falsely represent itself as another?
Say I want to make sure that no malicious actor or process has made an attempt to falsely represent a legitimate web server with their own malicious server on Linux, anticipating that the user will ...
- 103
3
votes
2
answers
635
views
SSH host key not recognized
At my new hosting provider, they allowed SSH for my account, but they only sent me port, server address, username, password, but no key.
When I try to log in with PuTTY, it logs in, but I get the ...
- 31
0
votes
0
answers
49
views
PAM: Master Password
I want to create a master password that can log into any user account on a system without needing root privileges (but we can use root to create and set up the master password). In other words, I need ...
- 1
0
votes
1
answer
80
views
Automate securing of Linux services ? (cf. systemd-analyze security)
When you run a command such as systemd-analyze security (or a program such as lynis which, for services, runs systemd-analyze security), you may get, like I do, a list of 'unsafe' or 'exposed' ...
- 55
4
votes
0
answers
68
views
Cygwin inheritance of Windows's security for cross-account file creation/modificaton?
On a Windows 10 laptop, I have an administrator account Admin, a
non-administrator account User.Name, and the default Public
account.
From either Admin or User.Name accounts, files created in the ~/
...
- 379
1
vote
0
answers
22
views
Scrub identifying data from USB stick
I am providing photos related to a legal matter to a lawyer and she is going to give them to law enforcement without giving them my name (under attorney client privilege).
I am not sure if she is tech ...
- 11
1
vote
1
answer
28
views
Error 0x80070035 browsing to samba share from Win2019 Server only
I have a samba v4.17.5 server working well, I can browse all of the shares from Win 10 clients. The clients and the samba host are members of a domain.
However, when I try to browse the samba server ...
- 1,620
0
votes
0
answers
37
views
Difference between chage -I and passwd -i
I'm looking into ways to read and write expiry dates for temporary passwords (i.e.: If we grant users a temporary password and they don't log in and change the temporary password within N days, then ...
- 101
0
votes
0
answers
42
views
Mount home partition after login
I am looking for a way to set up a Linux box where I would have a user's home folder reside on a separate encrypted password-protected partition (perhaps using LUKS? Not sure what the current best ...
- 101
0
votes
1
answer
19
views
How to change the private key passphrase in lsh?
info lsh manual covers how to create a keypair and protect the private key with a passphrase. The manual does not tell how to change the passphrase or how to decode the private key, which is stored as ...
- 2,155
1
vote
1
answer
63
views
What over-wrote my .ssh/id_rsa with a non-sense - malicious code?
This is rather strange story I want to share in case this originates from some kind of hack, so we can better identify signature of the attack.
I work as web developer, I run Ubuntu 20.04, I run ...
- 113
1
vote
1
answer
32
views
Remote SMTP traffic appears to come from LXC Host to container
Summary: I have a mail server (exim 4, Debian 10) in an LXC container. The host is running Debian 11. Since yesterday evening spam traffic has been coming in that appears to come from the LXC Host. ...
- 13
0
votes
1
answer
39
views
With hdparm, why do I need to set a password before secure-erasing the drive?
To use hdparm's --security-erase, I need to provide a password; and for that to work, I need to first set a password. Why is that? i.e. if I've never set a security password for my drive, why wouldn't ...
- 8,822
0
votes
0
answers
15
views
Logins for "default" user accounts? [duplicate]
On a server I am accessing with SSH I checked the auth.log and it is mostly login tries for invalid users or root, however occasionally there are login attempts for the accounts www-data, sshd and so ...
- 1
0
votes
0
answers
44
views
weston user with super user permission on Wayland
TL;DR;
weston initializes as weston user, without super user permissions.
However the application needs some su permissions and share some files with the root user.
What is the correct way to ...
- 101
0
votes
0
answers
17
views
how to get rid of deprecated ciphers in FreeIPA?
FreeIPA 4.8 deprecated a lot of old ciphers (https://freeipa.org/page/Releases/4.8.0). However, they are still in. Example:
# klist -ke /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO ...
- 1
1
vote
2
answers
235
views
fail2ban SSH jail change action REJECT to DROP
I am trying to configure a simple SSH jail with fail2ban.
Below is the configuration of the jail in /etc/fail2ban/jail.conf :
[sshd]
# To use more aggressive sshd modes set filter parameter "...
- 13
-4
votes
1
answer
55
views
Separating work and personal network activity [closed]
I asked a question here that got no answers and only one comment (and then my own answer), so maybe I was asking the wrong question.
I use the same computer for work and for personal use. I keep the ...
- 33
20
votes
4
answers
1k
views
How to safely use gawk's -i option or @include directive?
Using gawk -i inplace some-awk-code some-file (or @include "inplace" within an awk script) to edit a file in-place (or any other extension) is a security vulnerability.
Why?
How do I work ...
- 525k
1
vote
1
answer
60
views
How to prompt "su" to re-request a password on an incorrect entry?
Default su behaviour :
system@sword:/etc/pam.d$ su - test
Password:
su: Authentication failure
<su exits>
I need to configure "delay" when someone enters an incorrect password for ...
- 11
1
vote
1
answer
113
views
Random wipe free space: dd if=/dev/urandom vs LUKS format-erase, which is more secure, any pitfalls?
The ArchLinux Wiki on dm-crypt advices overwriting new storage devices or partitions with random data before using them for encrypted volumes. There are two ways I have used to achieve this, but I ...
- 11
0
votes
2
answers
99
views
Why is an open inode system call a security risk?
According to the accepted answer here, it is simply because you would not make the access checks at the directories leading up to that file. For example, with a call to openinode(inode #, flags).
My ...
- 143
0
votes
0
answers
38
views
Is local port forwarding to untrusted remote safe?
Suppose I ssh -L 5901:localhost:5901 user@ip_address into a untrusted machine and do nothing else (not running sudo, not running any commands, just leaving the connection open).
Could the -L 5901:...
- 366
1
vote
1
answer
108
views
Where is the mapping between SElinux source and target contexts
I am learning about SELinux and have a question:
There doesn't appear to be a direct correlation between the fields of the source and the target. For example Apache may run with Type httpd_t and the ...
- 4,098
0
votes
1
answer
36
views
Detect changes made to VPS linux image by hosting company
My VPS hosting company injects "extras" into new Debian (and other) VPS images - scripts, network config, telemetry, etc.
How can I compare a new VPS against the official image, to see what ...
- 1,639
0
votes
1
answer
51
views
how to allow running a suid exe only with restricted params/env/context?
I have a suid-to-root executable that users should run only with certain parameters, env var settings and context setup. I can't modify that exe.
I will wrap the exe in arg-less scripts, one for each ...
- 21
0
votes
1
answer
62
views
`chroot` bash not working after copying both the binary and its dependencies
I have reviewed the existing questions and responses but none worked in my case. So I'm opening a new question.
OS: Debian
Here are my steps:
First, copy /bin/bash:
$ sudo mkdir -p /mychroot/bin
$ ...
- 11
0
votes
0
answers
70
views
Cannot change or remove a file as root
This is driving me nuts... There's a lot of info over the place and I've spent quite some hours already without any success. A customer of mine haves a website compromised with some japanese SEO spam (...
- 101
0
votes
2
answers
348
views
Triggering "Reset Password" option in macOS Ventura for a specific account from the command line
I ran this command first to open the "Users and Groups" preferences on macOS Ventura:
open /System/Library/PreferencePanes/Accounts.prefPane
Next, I want to run a command that triggers the &...
- 11
0
votes
0
answers
79
views
How to deploy root certificate in embedded Linux system?
I am working on an embedded Linux system (kernel-5.10.24).
And there runs a web application, which connects to server through security protocol.
So it links to libssl.so and libcrypto.so.
When it is ...
- 327
0
votes
3
answers
148
views
How can some executable automatically run as root
Why some executable as being launched, it's automatically run as root by requiring user to put in password (by its ls -l info below) ?
-rwxr-xr-x 1 root root 975856 Feb 9 13:02 <filename>
...
user572119
0
votes
1
answer
37
views
Force close port 22 on GCP VM
For security reasons, I want to close port 22 (ssh) of my VM that is on GCP.
Currently, if I execute the command telnet xx.xx.xxx.xxx 22 the server responds to me:
Trying xx.xx.xxx.xxx...
Connected to ...
1
vote
1
answer
94
views
Log all commands executed regardless of shell?
Suppose a user runs the following command:
zcat file.gz | grep something | gzip > grepped.gz
I'm looking for a kernel feature (a BPF filter perhaps?) that would note all of the execves, chain ...
- 1,361
3
votes
1
answer
105
views
What effect has "+:ALL:cron crond" in /etc/security/access.conf?
I am refining our rules in /etc/securiy/access.conf. I found the following rule and I am not sure what it is used for:
+:ALL:cron crond
According to the man page of access.conf it means something ...
0
votes
0
answers
15
views
Preventing a Linux package modifying, appending a certain file
how prevent any Linux package installer and its sub processes modifying, appending the ~/.bashrc, or any certain file, which remains can normally unimpededly be used, edited etc by the login user ?
user570260
0
votes
1
answer
61
views
Using iptables, how can i open a port only when i'm in my home network?
I want to host a service for syncing stuff between my laptop and my phone. Since I don't own a server, I decided i would host the services on my laptop. For my phone to be able to connect to that ...
- 145
0
votes
1
answer
59
views
Difference between passwd and passwd- file as well as shadow and shadow- file
on my server running UnraidOS I got a bit suspicious. There are both 'passwd' and 'passwd-' files (same goes for shadow(-)). These ones should be only backups as I understood.
Running:
root@Unraid-...
- 1
0
votes
1
answer
48
views
Reasons firmware checksums are wrong
What are the possible reasons that running fwupdmgr verify fails?
$ fwupdmgr verify 230c8b18-8d9b-53ec-838b-6cfc0383493a
Reading… [- ]Selected ...
- 1,878
1
vote
1
answer
74
views
Discover which process is asking for sudo?
I have a fairly long-serving Ubuntu 18.04 LTS desktop computer onto which I have installed a great many apt packages from mainstream and non-mainstream repositories as well as numerous random tarballs ...
- 11
1
vote
0
answers
36
views
How would you assign read-only permissions to run ls -l /proc/{pid}/fd for processes you don't own using SELinux in Android
I am developing an application on Android as a non-root user.
However, I need read access to all the /proc/{pid}/fd files so as to check the inode numbers from the symlink under fd.
How do I do that ...
