Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

2
votes
2answers
62 views

Why is /etc/sudoers not world-readable?

I'm struggling to think what security risks there could be to knowing who is allowed to use sudo.
3
votes
0answers
41 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
-1
votes
1answer
21 views

Install program in Wine and analyze traffic

I need to install a Windows program in Wine and I would like to analyze how reliable it is, that is, if it does not generate any connection that can transfer my information without realizing it. This ...
0
votes
1answer
42 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
0
votes
3answers
35 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
1
vote
1answer
15 views

How to know if Jenkins is patched on CentOS 7

I've been using rpm -q --changelog package_name to check if a certain cve vulnerability has been patched on my system. However, when I'm doing the same for jenkins, all I got was Sat Apr 19 ...
1
vote
2answers
39 views

What is the reason FreeBSD jails don't get the entropy pool

I've noticed that the FreeBSD script that generates entropy, bails out if it finds it itself is running from within a jail. # uname -srm ## notice: install of mfsBSD (https://mfsbsd.vx.sk) FreeBSD ...
1
vote
0answers
62 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
0
votes
1answer
50 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...
0
votes
1answer
58 views

rkhunter found 7 possible rootkits

Today I installed Ubuntu 18.10 and ran rkhunter on it. At first it said that there are 4 possible rootkits, but after second check it detected 7. During checking there was everything green and ok, ...
3
votes
0answers
40 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
-2
votes
1answer
69 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
0
votes
0answers
31 views

Are packages on snapcraft inherently safe?

Are packages installed by snap from https://snapcraft.io inherently safe? I heard they are sandboxed. Does that mean they can't change my file system, read my files, etc.?
0
votes
1answer
55 views

pf not stopping bruteforce attempts

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I have read many articles on how to get pf to stop brute force attacks and am not having any luck. ...
0
votes
0answers
35 views

Order of scripts run before bash starts

I'm studying the scripts that run before a bash shell started by the user starts. As far as I understand, the order is: /home/username/.bashrc (modifiable by user) /etc/bashrc (modifiable by root) /...
3
votes
1answer
104 views

Is there a way to get security updates for wheezy after EOL

I know the best solution would be to upgrade the server after Debian wheezy has reached End Of LIfe in May 2018, but is there a way to continue running an old wheezy instance and get some minimal ...
2
votes
1answer
17 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
0
votes
1answer
34 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
1
vote
1answer
38 views

Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs

I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
0
votes
1answer
40 views

Running Tor service in the jail environment

I want to torify my FreeBSD old machine purposed to mainly darknet activities. Questions: Should I worry about these errors during creating jail? Warning: Some services already seem to be listening ...
1
vote
1answer
45 views

Spectre V2 on Linux

I have a 64Bit PC Running Ubuntu. The processor (AMD E1-1200) did not receive microcode updates for Spectre protection. What is the best strategy to stay secure? How do you treat the problem?
2
votes
1answer
33 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
1
vote
3answers
35 views

Is it possible to check for DNS-leaks on unix server?

I run a Ubuntu server where I have a split tunnel for VPN. Which means I have a "normal" connection to the internet for most of my services but also a tunneled connection that only a few services use. ...
-1
votes
3answers
94 views

How to prevent “rm -rf ~” from being executed by mistake?

Is there any way to completely prevent this command from being executed, by mistake, in the terminal? I know that bash, for instance, has aliases. Is there a way to use them?
0
votes
1answer
34 views

Who have previously accessed a shared file?

I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, ...
0
votes
1answer
78 views

Update the glibc package Error

I was asked to fix the vulnerabilities for RHEL 7: GLIBC(RHSA-2018:3092). Based on the output given by Nessus. Remote package installed : glibc-2.17-222.el7 Should be : glibc-2.17-260....
2
votes
3answers
60 views

Security issues with “wget”

I was wondering if there are any vulnerabilities that I may face when using "wget" and its options. And specifically, I've used a benchmarking script to test the performance of my VPS. The command is ...
1
vote
2answers
94 views

Is it possible to hide an area of hard disk from root user?

Do linux kernel have a feature that can be used to hide an area of hard disk (e.g last 1GB of hard disk) from root user or at least make that area completely unwritable by any means?
0
votes
1answer
43 views

SSH IP access restriction using tcpwrappers is not working. (hosts.allow and hosts.deny not taken into account)

I am using sles-12 server and i am trying to restrict ssh access to my server to my pc alone. I have tried to use tcpwrappers and it's not working..!!. I am able to ssh to the server from any IP in my ...
0
votes
1answer
64 views

Is there a way to prevent root user from modifing kernel and boot loader?

Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel. Is there a way to prevent ...
0
votes
0answers
44 views

Permanently disable all networking in Tails OS?

I would like to use Tails OS to create a pseudo air-gapped system. The system has WiFi hardware still, but it is "unusable" in Tails due to lack of firmware. I would like to further ensure it remains ...
0
votes
0answers
35 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
1answer
33 views

Intel® SGX™ (Software Guard Extensions™) and Linux Mint 19 driver installation

As I have the 7th gen Intel CPU (i7-7700HQ) and in UEFI BIOS there is a possibility to Enable Intel® SGX™ (Software Guard Extensions™), I would like to do so. In order to do that, I am unsure, if I ...
1
vote
1answer
66 views

What happened to elfsign and elfverify?

In "Uninformed Research -- informative information for the uninformed." 2003 mentions a tool called elfsign and elfverify. This is a tool to checksum and sign an ELF binary. I can't find that tool in ...
1
vote
1answer
77 views

Security review: classifying ssh log-in attempts [closed]

I see my own ssh logins to an AWS EC2 Ubuntu Linux instance as Nov 18 07:32:21 ip-10-20-30-40 sshd[9487]: Accepted publickey for ubuntu from 15.26.37.48 port 46273 ssh2: RSA SHA256:e37A/...
0
votes
1answer
36 views

How to get a working clock on Debian 9? Clock is wrong by a couple minutes

How to get a working clock in Debian 9 with KDE? My clock is almost 10 minutes slow on multiple of my machines running Debian 9 with KDE and (re)setting the timezone via tzselect didn't work. (I ...
0
votes
0answers
12 views

maintain a permanent keyring for a user across reboots

I want to hold credentials for a particular user in the kernel keyring. These credentials must be available across reboots. I was trying to do the following: keyctl add user keyname payload @u <...
-1
votes
0answers
24 views

OpenGPG for collaborative file sharing?

We are trying to create a system where our employees can access are shared encrypted file over a VPN and make edits to it. The file's contents are sensitive, so we want to make it as secure as ...
0
votes
1answer
22 views

Ubuntu 14.04 install “old lamp” stack for penetration testing

I am preparing WAF video for my team and I want to test a sample ubuntu server which will be my victim. I'd like to install "old version" of packages and deploy Wordpress on top of it and use some ...
0
votes
1answer
45 views

How to use sed to obfuscate an IPv6 address

I have the following sed command sed -i 'test.log' -e 's/\([0-9a-fA-F]\{1,4\}\:\)\{7,7\}[0-9a-fA-F]\{1,6\}/\1\w/g' The goal is to erase the last two blocks of the IPv6 address. However, this sed ...
1
vote
0answers
40 views

sedutils vs hpdarm for SED hard disks

According to my reading there are 2 known methods for using Self-Encrypting Drives (SED): hdparm https://www.pugetsystems.com/labs/articles/Introduction-to-Self-Encrypting-Drives-SED-557/ sedutils ...
0
votes
1answer
84 views

Can I lock down access to a TCP port in Linux

I'm trying to secure a single-node Elasticsearch machine. Basically, I want to put Elasticsearch behind a reverse proxy (nginx) and make sure that the only way any user or process can communicate with ...
1
vote
1answer
47 views

Why not allow all users to schedule jobs with crontabs? [closed]

By setting /etc/cron.allow and/or /etc/cron.deny it's possible to restrict what user is allowed to use crontabs to schedule a cron job to run as that user. At least at my office our SAs default to ...
-1
votes
0answers
47 views

sudoers line for sudo user with /bin/su command or runas or /bin/bash

What is the difference between these three sudoers line and which one is more secure and auditable? End goal is anyone in the group 'sudogroup' group should be able to sudo to user 'swuser' or run as '...
6
votes
1answer
95 views

What is the purpose of extrausers?

Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /...
0
votes
1answer
57 views

How to add a new user and disable its root login? [closed]

A sysadmin may want to add a new user that will have no root access (nor sudo). I don't sell hosting services but I can bring this field as an example; an hosting company gives its customers the ...
7
votes
1answer
124 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
0
votes
1answer
223 views

airmon ng ls: cannot access '/sys/class/ieee80211/': No such file or directory

Im using ubuntu bionic (UBUNTU WSL) I can't use airmon-ng! It throws the following ls: cannot access '/sys/class/ieee80211/': No such file or directory I checked airmon-ng: ls: cannot access '/...
5
votes
2answers
180 views

How safe is SSH when used for tunneling?

Scenario: I want to connect from Client A to Client B using SSH/SFTP. I can not open ports on either client. To solve this issue, I got a cheap VPS to use as a relay server. On Client B I connect to ...
0
votes
2answers
53 views

Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?

The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...