Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

0
votes
1answer
8 views

Setting soft limit above hard does not fail in terms of exit code?

root@Andromeda:/# ulimit -n -S 2048 root@Andromeda:/# ulimit -n -H 2048 root@Andromeda:/# ulimit -n -S 4096 2048 root@Andromeda:/# echo $? 0 Failure to set soft limit above the hard one makes sense. ...
0
votes
1answer
23 views

How to handle Nginx and PHP ownership of log files?

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log ...
0
votes
0answers
16 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
1
vote
1answer
25 views

extracting security profile specific files RHEL CentOS

during the install of RHEL 7.x or CentOS one can choose (or not choose) to apply one of these security profiles these are from 7.6: United States Government Configuration Baseline Standard System ...
0
votes
1answer
42 views

Is plain text in index.html secure?

So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file. I ...
3
votes
1answer
39 views

What is Date_Spec in sudoers policy?

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec. User_Spec ::= User_List ...
3
votes
1answer
73 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
0
votes
0answers
15 views

Screenlock backdoors and how to close them

There is a warning in the Archlinux List of security applications. It says that of all possible screen-lockers, only four block tty access: sflock, physlock, Cinnamon Screensaver, MATE Screensaver and ...
0
votes
1answer
13 views

PackageKit logs a message about “only_trusted:0”

I ran pkcon update force. I noticed PackageKit is logging about only_trusted:0. That is, an operation where the only_trusted option is disabled. Even though I did not pass --allow-untrusted to ...
2
votes
1answer
24 views

How is find's {} substitution pattern vulnerable to injection attack? [duplicate]

I'm trying to understand more about this edit that was made to an answer of mine: https://unix.stackexchange.com/revisions/510388/5 How does running cd "{}" in the context of a find command ...
0
votes
0answers
26 views

show history of curl requests including executing user or program?

Little Snitch just told me that curl made a silent connection to tools.google.com. I'd like to know why. is there a way to get the history of commands on my system including who executed them?
1
vote
2answers
102 views

Understanding the audit log - file permissions and file content changed

I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well. I've got something in my audit but can't really tell what and how it ...
1
vote
0answers
32 views

Encouraging the CPU to perform out of order execution [migrated]

I am attempting to exploit the meltdown security flaw on Ubuntu 16.04, with an unpatched kernel 4.8.0-36 on an Intel Core-i5 4300M CPU. First, I am storing the secret data at an address in kernel ...
2
votes
1answer
22 views

rpm -V verify purpose

I am told I should do rpm -Va because: operating system must be configured so that the cryptographic hash of system files and commands matches vendor values... Without cryptographic integrity ...
14
votes
4answers
3k views

If the heap is zero-initialized for security, then why is the stack merely uninitialized?

On my Debian GNU/Linux 9 system, when a binary is executed, the stack is uninitialized but the heap is zero-initialized. Why? I assume that zero-initialization promotes security but, if for the ...
0
votes
1answer
21 views

Should I remove ICMP Protocol from firewall rules base on security concern?

As you can see from the screenshot of GCP firewall rule page, should I remove ICMP Protocol from firewall rules base on security concern? Will it lower the chance of being attacked? I'm using CentOS ...
2
votes
1answer
36 views

How quickly are Debian security patches moved to “stable”? [closed]

Debian is known for its stability. As they require rigorous testing, packages are known to take a long time to become Stable, comparing to other distributions. In light of the extended review ...
0
votes
1answer
39 views

uninitialized pointers dangerous?

I read, that pointers (in C), that are not initialized, could point to an address that contain data or program code from other programs. In the book it says, that this can cause damage. Is this issue ...
3
votes
1answer
72 views

Why is +::0:0::: not supposed to be found in /etc/passwd?

I was reading the BSI Security Guidelines (GERMAN), on NIS and it explicitly mentioned that one should prevent the entry +::0:0::: from occuring in the /etc/passwd file of the NIS server. From my ...
2
votes
1answer
39 views

How to scan my computer's UDP ports

I have tried running nmap 192.168.0.97 to port-scan my computer, and I noticed it only lists TCP ports. For both TCP and UDP ports, I would start by asking the OS on my computer. I.e. How do I list ...
1
vote
1answer
55 views

Is this SSHD config appropriate / secure [closed]

On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions. no root login no password authentication / force public key authentication authentication by ...
14
votes
6answers
2k views

Echo with obfuscation

I need to print some variables to the screen but I need to preferebly obfuscate the first few characters and I was wondering if there was an echo command in bash that can obfuscate the first ...
2
votes
1answer
43 views

Does `sshfs -o allow_root` open any security holes? Why isn't allow_root enabled by default?

allow_root This option is similar to allow_other but file access is limited to the user mounting the filesystem and root. This option and allow_other are mutually exclusive. From mount.fuse(...
4
votes
2answers
68 views

What is the best next step when faced with curl <url> | sh

Most installation scripts these days have this particular pattern: curl -fsSL <url> | sh --- and usually run as root Some sites might even have a disclaimer about running this as root and to ...
2
votes
0answers
36 views

Why is a critical security patch in chromium/F29 still open after two weeks time? [closed]

I am running a daily updated F29 and still have the old, vulnerable chromium package (Version 71.0.3578.98 (Developer Build) Fedora Project (64-bit)). Google warned (3/1/2019) to upgrade asap because ...
0
votes
0answers
23 views

SSH - root login disabled, password disabled. Still need a complex root password for local sessions?

If this computer's openssh server requires keys for SSH logins, do I still need to have a complex password? Given that this is a private single-user computer in a secure building.
5
votes
4answers
123 views

Protecting access to NFS shares in Docker

I would like people to access NFS shares from within Docker. Problem is inside of Docker they can become root, and then they can have write access to anyone's files by becoming that user. Is there a ...
3
votes
2answers
69 views

Reading and writing data temporarily without using the filesystem

I'm using ansible in a vagrant environment managing a debian box. Due multiple ansible provisioners with vault encrypted data (e. g. database root password) I have to enter the vault password once by ...
3
votes
2answers
168 views

Has the filtering of all kinds of TCP attacks using iptables become obsolete as they get filtered elsewhere or something else?

Background I am on Debian 10 Buster. I started running a Tor relay on my home IP address. A dedicated full-fledged server is probably not the most energy efficient way, but I want to try it out. And ...
0
votes
0answers
17 views

Can some or all profile/login scripts be bypassed on local console login?

The situation I'm thinking of is that something in /etc/profile or ~/.profile or ~/.login or similar is causing you to be logged out immediately or some other problem/mischief, and you're at a text-...
0
votes
1answer
50 views

How to Disable Kernel module installation capability in Unix Based operating system?

As we are living in the Linux kernel rootkit era, Is there any way to Disable any additional module to load into operating system kernel by any user or any operation or command , in Unix? some sort of ...
0
votes
1answer
53 views

is it possible to detect ssh activity on port 443

I would like to detect the usage of ssh on port 443 on a linux gateway. A kind of counter measure against stuff like sslh. I think netfilter and iptables would be the solution, but can't find module ...
1
vote
1answer
27 views

Can the Samba security setting `wide links` be bypassed using a race condition?

Apache has options FollowSymLinks and SymLinksIfOwnerMatch. However, they "should not be considered a security restriction, since symlink testing is subject to race conditions that make it ...
0
votes
0answers
96 views

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 ...
3
votes
1answer
114 views

Someone Remote Executing a Script On My Server

I've been noticing over the last couple of weeks that the CPU on our server has been seeing a very high load, upon inspecting htop there have been a number of [sync_supers] processes running at 100%. ...
2
votes
0answers
63 views

How does the rsync symlink exploit work?

munge symlinks [...] The way rsync disables the use of symlinks is to prefix each one with the string "/rsyncd-munged/". This prevents the links from being used as long ...
0
votes
1answer
36 views

SElinux and TCP Traceroute

I need to run a TCP Traceroute in the browser but are getting a few SElinux alerts. I have tried creating a policy with audit2allow, e.g ausearch -c 'traceroute' --raw | audit2allow -M my-traceroute ...
0
votes
1answer
57 views

Why does first yum update on CentOS 7 ask to accept keys

I ran yum update on a newly built machine. Why does it ask to accept keys? Is it safe to accept the keys? base/7/x86_64/signature ...
1
vote
0answers
23 views

lastb output empty even after 3 failed login (su) attempts

On one terminal root@Andromeda:~# lastb btmp begins Sat Mar 2 10:03:44 2019 On another one: $ sudo su - [sudo] password for pkaramol: Sorry, try again. [sudo] password for pkaramol: Sorry, try ...
2
votes
1answer
94 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
0
votes
1answer
20 views

restrictions on a directory on shared server

I have 1 directory on a Unix server which is accessible to all currently as users logged in user name is common but they logged in to that user via sudo su -iu. I want only 10 users to have access on ...
-1
votes
1answer
76 views

How can you secure a server? [closed]

A while ago, I ran a vino server inside my local wifi network, and the vino server wrote messages on stdout that some strange IPs from the Internet tried to connect to it. I wondered, "Is my server ...
0
votes
1answer
452 views

How to be safe against CVE-2019-8912?

I've read in news that there is a new Kernel bug https://security-tracker.debian.org/tracker/CVE-2019-8912 Is it safe to use my PC until it gets fixed ? Can someone use this exploit to steal my paypal ...
4
votes
2answers
109 views

secure read-only self hosted git repository for scripts

I need to build a git server where certain users have a read-write access to the repository and management server running certain scripts using this repository has the read only access to the same ...
0
votes
0answers
29 views

Allow sudo su - only to one user

Allow sudo su - on visudo only to one or some users of a group that access by ldap For example, I have visually defined the following: % dev ALL = (ALL) ALL What I need is that only some users or ...
0
votes
0answers
23 views

System wide default-deny (process whitelisting) via AppArmor

I wanted a quick check to see if my understanding of AppArmor is correct. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run ...
0
votes
1answer
87 views

Firewall-like software for udev usb devices?

O.MG Cable is here and the way technology is going, more of those devices will be available to the common user. This kind of USB attack isn't new and there is plenty of devices out there ready to do ...
0
votes
1answer
87 views

Open file limits not increased for redis user despite change in /etc/security/limits.conf

I got ERR max number of clients reached from my redis server so I decidied to increase the allowed max client connections in its configuration. This also requires according to the documentation, ...
3
votes
1answer
126 views

how to find ssh key in audit log file?

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works: ssh-keygen ssh-copy-id -i /root/.ssh/...
-3
votes
1answer
32 views

Scientific Linux 7x - Too much system hardening!

Some Linux users like my company build Linux servers to use on factory production lines. We write software to load BIOS and FLASH memory and test our products. We constantly need to reboot these ...