Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How to fix the mask value in acl?

I have set the mask value to r-- (group class). When I added a group with rw- using setfacl (setfacl -m g:test:rw- time.txt). I noticed mask value is changed to rwx. I thought mask value is the upper ...
0
votes
1answer
33 views

Add ssh authorized key and hide it in the authorized_keys?

Is it possible to add an ssh key to a system and make hidden (at least at first glance) from the user? UPD: Recently I was participating in a CTF and had access to another team's machine. I wanted to ...
0
votes
0answers
41 views

How to interpret the output of the “who” cmd? - wrong date, non-existing user

On a SLES11, I can see the following output: $ who | grep -i FOOBARUSER FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (::ffff:127.0.0.1::ffff:127.0.0.1:3) FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (:...
2
votes
0answers
43 views

Security issues for passing credentials over a UNIX socket

UNIX sockets often have a mechanism to authenticate their peer processes. However, there is a requirement for care in order to avoid confused deputy attacks. Linux, for example, has two ways to pass ...
-3
votes
0answers
17 views

printk causes kernel panic when used to hook set_uid in sys_call_table

I am working on developing a rootkit for Ubuntu 18.04, kernel 5.0.0.37-generic. I've successfully hooked the sys_call_table using kallsyms, and enabled/disabled write. After hooking get_uid, I've ...
1
vote
1answer
30 views

Which services read the /etc/securetty configuration file?

Which programs / services are parsing contents of /etc/securetty configuration file?
2
votes
1answer
40 views

Why do I get a warning for the sudoers.d when doing an audit with Lynis?

I stumbled upon Lynis - a security auditing tool for linux - and ran it on my Raspberry Pi to see if I could harden it a bit more. I got one warning in the Authentication group that confuses me. - ...
1
vote
1answer
49 views

Debian 10 su command to existing user as root without password

I just installed a brand new VM with Debian 10 (buster) and joined it to our active directory using pbis. what I encountered now is, that: as the root user, I can su to every other available user ...
0
votes
1answer
35 views

Can a Linux partition unnoticeably create files in another partition and, if, how can I prevent it?

Is it possible that my Linux partition creates files in another partition with me not noticing it? If yes, how to prevent it? Background: Manjaro partition encrypted, bootloader on Manjaro, swap ...
1
vote
0answers
28 views

Is there something like HTTP Digest access authentication for SSH?

Apparently, SSH does send (albeit using an encrypted connection) the client's login password to the server if password authentication is being used instead of a pair of public and private keys: Does ...
0
votes
2answers
45 views

How often to update Arch Linux? [closed]

Outside of announcements about critical security flaws, is a period of one month between Arch Linux updates (pacman -Syu) dangerous in terms of security?
0
votes
0answers
23 views

sshd_config: using only the most secure ciphers, KexAlgorithms, MACs

In /etc/ssh/sshd_config I am using the following configuration settings. Can this be further hardened? KexAlgorithms curve25519-sha256@libssh.org MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-512 ...
0
votes
1answer
15 views

Centos SSH & SFTP user restriction to specific directories

I am managing a server running Cantos 7. Some users login to the server via ssh/sftp for development. For them i have created a user devel. For security reasons, i need to confine them to certain ...
32
votes
14answers
4k views

How can I speed up secure erasing of a disk?

I need to securely erase harddisks from time to time and have used a variety of tools to do this: cat /dev/zero > /dev/disk cat /dev/urandom > /dev/disk shred badblocks -w DBAN All of these ...
2
votes
1answer
38 views

RKHUNTER does not recognise common options

At the bottom of rkhunter.conf (I also tried placing it separately in rkhunter.conf.local), and after checking for invisible chars, Unknown configuration file option: CRON_DAILY_RUN="false" ...
0
votes
0answers
40 views

How to implement security profiles during installation of CentOS 8?

I am new to the Linux environment and I found CentOS to be a stable and secure operating system. I do not have much knowledge about the security profiles and how well do they protect the operating ...
4
votes
1answer
48 views

should I leave modifications on /etc/default/intel-microcode and changes in revision number?

I have a quad-core intel machine having i5-7400 CPU @ 3.00GHz . Recently, Intel introduced a new bunch of updates for machines affected by the spectre vulnerabilities. One can see the changelog.gz ...
0
votes
2answers
25 views

Recommendation for securing a external hard disk

I have lost dates (film files and docs) on my external hard disk with dd (hd was on ext4 format, 2TB and had only videos and some files). I "restore" them with PhotoRec, with bad quality... Because I ...
0
votes
0answers
29 views

Securing a private package repository for Debian

I’m setting up a private binary package repository for an embedded device we’ve made. Want to make it secure despite users are allowed to check for, and install, software updates. I’ve generated the ...
0
votes
0answers
9 views

SSSD configured for optimal security Kerberos only no need for LDAPS?

SSSD configured for optimal security Kerberos only no need for LDAPS? I want to ensure I have configured our SSSD for optimal security. Any insight would be appreciated. Should I add any values? ...
1
vote
1answer
36 views

Xorg: Having authenticated in X as a remote user allows me to have access to another users' applications?

I'm trying to run a docker container (for security reasons) from which I want to see a GUI application. I'm between two options at the moment, I'm not sure if I should forward its traffic to my X ...
0
votes
1answer
39 views

Determining source of ulimit change

I have a server built with AWS OpsWOrks, so everything is in configuration. There is a process whose ulimit is set to 4096, as checked from /proc/$PID/limits. This process runs as root. I ran the ...
0
votes
0answers
48 views

Unable to set right access capabilities

I have a process with file capabilities set. This process forks (clone) a child, which should inherit the set capabilities. Actually, the strace below (20897 is the process started with file ...
0
votes
1answer
29 views

Are there drawbacks (security or otherwise) to using 'su <user>' into a lesser-priveleged user to start a web application?

My goal is to manage the startup of a number of applications with an application executed by a user with elevated permissions. The plan is to have the startup manager (a node.js script using require('...
1
vote
1answer
144 views

fprint doesn't find my laptop's fingerprint device but lsusb does?

So when i use lsusb i can find the fingerprint device, the name of it is Generic goodix fingerprint device and my laptop is lenovo thinkpad 530s considering that lsusb can find it then why can't ...
0
votes
0answers
18 views

scan for values in system-auth-ac

I'm working on automating checking password values on my systems. Wondering the easiest way to grab the values on dcredit ucredit etc. from the system-auth-ac file using grep or something similar?
1
vote
0answers
36 views

How to list the packages from 90-updates-available?

The script /etc/update-motd.d/90-updates-available provides a summary of system updates, for example: /etc/update-motd.d/90-updates-available 281 packages can be updated. 209 updates are security ...
-1
votes
1answer
22 views

I have no firewall2 file

I have firewall2.d but no firewall2 file. I am trying to set up a lamp server but all the directions I get are for firewall2 "no d". I looked into firewall2.d but it doesn't have what they are ...
1
vote
2answers
42 views

Avoid Public IP based browsing of website in Apache 2.4

We are hosting a website locally. For this purpose, we have a public IP and corresponding DNS entry. We are using Apache 2.4 web-server. The website is publicly accessible without any problem. But ...
0
votes
1answer
147 views

LUKS: Wrong Password or Corrupt Headers?

I'm trying to gain access to my LUKS partitions after suddenly discovering that my password stopped working on all 4 LUKS partitions. 7 days ago when I tried booting and logging into my linux OS, my ...
1
vote
0answers
58 views

selinux preventing init_t access to httpd_sys_content_t

I have a systemd service file that runs a script. It is getting blocked by selinux: type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index....
0
votes
0answers
18 views

Is it possible to install smtp-user-enum on macOS?

I'd like to see if there might be a workaround to install smtp-user-enum on macOS, or does it only have to be installed on Linux? I'm copying the installation part of the documentation below, not ...
0
votes
0answers
23 views

Configure PAM to ask for 2FA token even if password is incorrect

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the ...
59
votes
2answers
9k views

Suspicious crontab entry running 'xribfa4' every 15 minutes

I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing. Crontab entry: */15 * * * ...
0
votes
1answer
33 views

Securing Tomcat-Server where to set deployXML = false?

For Securing my Apache Tomcat server on Ubuntu Server 18.04 LTS, I wanted to set attribute deployXML = false, but I don't know in which xml file. In the tomcat folder, I have the files server.xml / ...
0
votes
1answer
66 views

Performance and security differences between Ubuntu and other linux distros [closed]

Assume I have a physical server with vanilla Ubuntu Server 18.04 LTS where I'll do some minimal configuration adjustments in iptables and /etc/ssh/sshd_config and only install docker. Using docker I'...
0
votes
0answers
49 views

Firefox v.s. security updates on Debian 10 Desktop

A new version of Debian, a new set of "quirks". Since a previous version broke security updates, I make sure to be very suspicious of this in particular... I installed "Debian Standard" from the Live ...
-3
votes
1answer
65 views

Can shell-scripting help secure a client-side email address? [closed]

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
1
vote
1answer
743 views

Unauthorized access to cron

I was hacked this morning! Does anyone have an idea of what the entry of the crontab below might mean? 1st They created a dir structure .rsync/ ├── a │ ├── a │ ├── anacron │ ├── cron │ ├── ...
0
votes
0answers
24 views

How to setup an SELinux policy to allow only a specific context permission to 'execheap'

I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap. The SELinux troubleshooter suggests: You must ...
1
vote
0answers
96 views

Why would reading a passphrase from STDIN be disallowed but not from a PTY or argument?

I have a program that receives a secret passphrase. The options I have are to type it in manually on the terminal or to provide it as a command line argument. This makes it hard to automate in a ...
-1
votes
1answer
53 views

Passing an executable command using USER environmental variable

Is it possible to pass some executable shell code by setting env USER=..some code... ./script.sh, given that the script itself either uses echo $USER or tmpdir=/var/tmp/log-$USER
0
votes
1answer
25 views

Visualisation for etc_security_lastlog

I am looking for an easy way to visualise data from etc_security_lastlog for reviewing inactive user IDs. "Inactive" users would be determined based on their time_last_login being old enough. How do I ...
1
vote
0answers
48 views

Why does rootless podman does not support overlfayfs mounts in non-ubuntu distributions?

In the rootless podman doc, it is stated that: Can not use overlayfs driver, but does support fuse-overlayfs Ubuntu supports non root overlay, but no other Linux distros do. So ...
0
votes
2answers
67 views

Encrypt a disk without having to log in to enter the password

I am using eCryptfs to encrypt the home directory and would like to access files without having the user log in. The program pam_mount will automount encrypted file systems, but it seems like that ...
2
votes
2answers
102 views

Is Linux as safe as I thought it would be?

I started learning and investing time in Linux because I liked the idea that it isn't as prone to viruses, hackers etc. Or at least that's what I read somewhere. In my testing I found myself ...
0
votes
1answer
85 views

Update Centos without upgrading kernel or OS

I tried to find answers to this issue but I am having a hard time to find the right keywords. So here is my issue. Dongled mini PC with some itchy software when it comes to patching the system. Is it ...
-1
votes
2answers
46 views

Limit User To Run Specific Commands

I have a user test1 that i want to limit it to only run specific commands. I found this solution and I tested it (logged in with test1 and ran some random commands. none of them worked but date) and ...
0
votes
1answer
55 views

OpenJDK 8 support period in Debian Stretch 9

According to the Debian releases page Stretch 9 has support until ~2022. What does this mean for the OpenJDK 8 package? How long will security updates be available for OpenJDK 8?
0
votes
0answers
17 views

How to check the Integiry of the each PHP files in linux server using lighthttpd server?

I have a project requirement, Where I have to check the integrity of each PHP files before executing it using md5 or some method. The hash value is stored safely within the server. What I have done: ...