Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

1
vote
1answer
16 views

Scanning my UDP ports

You appear to only have scanned TCP and not UDP. There might also be UDP services you want to worry about :-). UDP scanning has a number of issues that do not apply to TCP scanning. In ...
1
vote
0answers
35 views

Is this SSHD config appropriate / secure

On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions. no root login no password authentication / force public key authentication authentication by ...
14
votes
6answers
2k views

Echo with obfuscation

I need to print some variables to the screen but I need to preferebly obfuscate the first few characters and I was wondering if there was an echo command in bash that can obfuscate the first ...
1
vote
1answer
34 views

Does `sshfs -o allow_root` open any security holes? Why isn't allow_root enabled by default?

allow_root This option is similar to allow_other but file access is limited to the user mounting the filesystem and root. This option and allow_other are mutually exclusive. From mount.fuse(...
4
votes
2answers
67 views

What is the best next step when faced with curl <url> | sh

Most installation scripts these days have this particular pattern: curl -fsSL <url> | sh --- and usually run as root Some sites might even have a disclaimer about running this as root and to ...
2
votes
0answers
33 views

Why is a critical security patch in chromium/F29 still open after two weeks time? [on hold]

I am running a daily updated F29 and still have the old, vulnerable chromium package (Version 71.0.3578.98 (Developer Build) Fedora Project (64-bit)). Google warned (3/1/2019) to upgrade asap because ...
0
votes
0answers
23 views

SSH - root login disabled, password disabled. Still need a complex root password for local sessions?

If this computer's openssh server requires keys for SSH logins, do I still need to have a complex password? Given that this is a private single-user computer in a secure building.
1
vote
0answers
9 views

Protecting access to NFS shares in Docker

I would like people to access NFS shares from within Docker. Problem is inside of Docker they can become root, and then they can have write access to anyone's files by becoming that user. Is there a ...
3
votes
2answers
63 views

Reading and writing data temporarily without using the filesystem

I'm using ansible in a vagrant environment managing a debian box. Due multiple ansible provisioners with vault encrypted data (e. g. database root password) I have to enter the vault password once by ...
3
votes
2answers
157 views
+50

Has the filtering of all kinds of TCP attacks using iptables become obsolete as they get filtered elsewhere or something else?

Background I am on Debian 10 Buster. I started running a Tor relay on my home IP address. A dedicated full-fledged server is probably not the most energy efficient way, but I want to try it out. And ...
0
votes
0answers
17 views

Can some or all profile/login scripts be bypassed on local console login?

The situation I'm thinking of is that something in /etc/profile or ~/.profile or ~/.login or similar is causing you to be logged out immediately or some other problem/mischief, and you're at a text-...
0
votes
1answer
45 views

How to Disable Kernel module installation capability in Unix Based operating system?

As we are living in the Linux kernel rootkit era, Is there any way to Disable any additional module to load into operating system kernel by any user or any operation or command , in Unix? some sort of ...
0
votes
1answer
40 views

is it possible to detect ssh activity on port 443

I would like to detect the usage of ssh on port 443 on a linux gateway. A kind of counter measure against stuff like sslh. I think netfilter and iptables would be the solution, but can't find module ...
1
vote
1answer
24 views

Can the Samba security setting `wide links` be bypassed using a race condition?

Apache has options FollowSymLinks and SymLinksIfOwnerMatch. However, they "should not be considered a security restriction, since symlink testing is subject to race conditions that make it ...
0
votes
0answers
47 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
3
votes
1answer
104 views

Someone Remote Executing a Script On My Server

I've been noticing over the last couple of weeks that the CPU on our server has been seeing a very high load, upon inspecting htop there have been a number of [sync_supers] processes running at 100%. ...
-1
votes
0answers
13 views

How to enable EVM feature?

I want to enable IMA and EVM on an embedded device based on Debian. I've installed evmctl (ima-evm-utils) on the machine. The boot parameters related to IMA/EVM are: ima_policy=tcb ima_appraise_tcb ...
2
votes
0answers
55 views

How does the rsync symlink exploit work?

munge symlinks [...] The way rsync disables the use of symlinks is to prefix each one with the string "/rsyncd-munged/". This prevents the links from being used as long ...
0
votes
1answer
27 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
0
votes
1answer
31 views

Why does first yum update on CentOS 7 ask to accept keys

I ran yum update on a newly built machine. Why does it ask to accept keys? Is it safe to accept the keys? base/7/x86_64/signature ...
1
vote
0answers
19 views

lastb output empty even after 3 failed login (su) attempts

On one terminal root@Andromeda:~# lastb btmp begins Sat Mar 2 10:03:44 2019 On another one: $ sudo su - [sudo] password for pkaramol: Sorry, try again. [sudo] password for pkaramol: Sorry, try ...
2
votes
1answer
51 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I dont know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct one ...
0
votes
1answer
20 views

restrictions on a directory on shared server

I have 1 directory on a Unix server which is accessible to all currently as users logged in user name is common but they logged in to that user via sudo su -iu. I want only 10 users to have access on ...
-1
votes
1answer
75 views

How can you secure a server? [closed]

A while ago, I ran a vino server inside my local wifi network, and the vino server wrote messages on stdout that some strange IPs from the Internet tried to connect to it. I wondered, "Is my server ...
0
votes
1answer
419 views

How to be safe against CVE-2019-8912?

I've read in news that there is a new Kernel bug https://security-tracker.debian.org/tracker/CVE-2019-8912 Is it safe to use my PC until it gets fixed ? Can someone use this exploit to steal my paypal ...
4
votes
2answers
104 views

secure read-only self hosted git repository for scripts

I need to build a git server where certain users have a read-write access to the repository and management server running certain scripts using this repository has the read only access to the same ...
0
votes
0answers
26 views

Allow sudo su - only to one user

Allow sudo su - on visudo only to one or some users of a group that access by ldap For example, I have visually defined the following: % dev ALL = (ALL) ALL What I need is that only some users or ...
0
votes
0answers
16 views

System wide default-deny (process whitelisting) via AppArmor

I wanted a quick check to see if my understanding of AppArmor is correct. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run ...
0
votes
1answer
79 views

Firewall-like software for udev usb devices?

O.MG Cable is here and the way technology is going, more of those devices will be available to the common user. This kind of USB attack isn't new and there is plenty of devices out there ready to do ...
0
votes
1answer
35 views

Open file limits not increased for redis user despite change in /etc/security/limits.conf

I got ERR max number of clients reached from my redis server so I decidied to increase the allowed max client connections in its configuration. This also requires according to the documentation, ...
3
votes
1answer
89 views

how to find ssh key in audit log file?

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works: ssh-keygen ssh-copy-id -i /root/.ssh/...
-3
votes
1answer
32 views

Scientific Linux 7x - Too much system hardening!

Some Linux users like my company build Linux servers to use on factory production lines. We write software to load BIOS and FLASH memory and test our products. We constantly need to reboot these ...
-2
votes
1answer
49 views

How to reset entire system permissions back to default in Linux?

I found I've a kind of messed up most part of my system permissions. Some places that only owner should have access is now exposed to world. How can I reset the folder permissions to default like i ...
1
vote
1answer
38 views

Firewall software similar to Outpost for linux

I'm corrently using Windows for my machines with Outpost firewall(Agnitum), but want to switch for linux(not sure what disto yet) and would love to know from you what are my options with linux's ...
0
votes
1answer
28 views

MESSAGE=anthony … USER=root <— Does this mean that the root user is the actual user but “anthony” will be displayed as being the user anyway?

I found this in /run/log/journal/... MESSAGE=anthony : TTY=pts/10 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/find / -name *systemctI* I'm wondering what this means? I'm suspicious of this process "...
2
votes
0answers
13 views

yum list-security no longer reports package as needing security update

We have an audit system that, daily, tracks packages in need of a security update using: yum list-security --security -q 2 For better or worse, some machines are not patched timely or missed, or are ...
-1
votes
1answer
71 views

Protecting an email-proxy (Gmail) account being used by a Mail Transfer Agent (MTA)

On Debian LAMP with different PHP based CMSs I use the MTA sSMTP to send email via an email proxy (Gmail); the emails I send are only contact-form inputs transferred from any such CMS to my own email ...
0
votes
1answer
27 views

sudo - How insecure is it to modify caching time? [closed]

We can modify sudo caching time with the option: timestamp_timeout How insecure is that? I wanted to increase it to several hours (the time of my sessions)
0
votes
0answers
32 views

Securing an open FTP on FreeBSD for visitor wifi speed testing?

I'd like to add a really simple local FTP server to my FreeBSD system, to allow guests to do wifi speed testing. Because of the use, I don't need more than very basic functionality - anon R/W to a ...
1
vote
0answers
44 views

DPAPI / MacOS-style Keyring for Linux or BSD?

Windows and Mac both have a handy way to secure data using the users' login credentials. The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted ...
1
vote
1answer
45 views

How should I create a user that I can use to safely run web apps etc.?

I'm doing this over ssh. I want to create a user that: can't be accessed via ssh can be impersonated with su doesn't have a password (is this a good practice?) can run web apps (specifically ...
0
votes
0answers
89 views

The JNLP application is not fully signed

I am trying to run a .jnlp file using javaws. It produces this error: Caused by: net.sourceforge.jnlp.LaunchException: Fatal: Application Error: The JNLP application is not fully signed by a single ...
3
votes
1answer
65 views

sudo escalation password fails - /etc/shadow hash ok, group ok, /etc/sudoers ok

After system update/upgrade, I cannot escalate with sudo using correct password: user $ sudo -s [sudo] password for user: ******************** Sorry, try again. [sudo] password for user: *************...
1
vote
0answers
22 views

Freeze Linux when log is full

Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
4
votes
1answer
38 views

How do I simulate /proc/sys/kernel/grsecurity/deny_new_usb without grsecurity?

How do I flexibly enable and disable plugging in new USB devices (running driver code responsible for those devices) at runtime without Grsecurity patch? Are there other approaches or alternative ...
2
votes
0answers
64 views

Headless Server? [closed]

I am running Nessus on a closed network. My OS is Redhat 7.4. I have Bare Metal machines in my data center and Virtual Machines on AWS. When Nessus scans my Bare Metal machines, it correctly ...
0
votes
1answer
51 views

Should I go for Debian Stable or Testing? [closed]

I've been using Debian Stable for 1 year. I like Debian for their Privacy Policy, no telemetry and security. Now I need to reinstall my distro and I want to go for security distro. I don't know ...
0
votes
3answers
32 views

How to set the passphrase that different keys are discriminable

Can I change my phassword/-phrase('s settings) in a way that it's important which key of multpile ones (e. g. the left shift key instead of the right one) is chosen? Could I go a step further and ask ...
2
votes
0answers
64 views

How to check If my PC was exploited after apt exploit? [closed]

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 Is there a way to check if my PC got exploited/hacked/virused ?
0
votes
1answer
54 views

Is a php file with SGID bit and read-only & execute a security problem? [duplicate]

I find php files with SGID bit and read-only & execute. The group is root. Is this a problem? Because a user will need to run the php interpreter with their our account, could it led to privilege ...