Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

0
votes
2answers
21 views

iptables allow everything, is it safe?

The os is Ubuntu Server 18 and I am running a web server on it. Is it safe to accept all traffic on all ports? iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT I tried ...
2
votes
1answer
20 views

The password of previously encrypted volume got changed by the Debian installer

I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community. Short version of the issue: ...
2
votes
0answers
16 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
4
votes
1answer
72 views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
0
votes
0answers
36 views

How to fill a device with zeros, without overwriting the bytes that are already zeros?

I have a USB flash drive usb 3, the reading speed is much more than the writing speed. Let's say that 99% of the flash memory is already full with zeros, and I would like to fill it with zeros until ...
3
votes
2answers
54 views

Avoid GRUB infection which would crack my encrypted linux

I have an unencrypted /boot partition with GRUB and an encrypted partition, where my Linux is located. An attacker, who wants to read my encrypted partition, could gain physical access to my computer ...
3
votes
1answer
23 views

How can I monitor, record and check about the ports on my LUbuntu having been scanned or connected to by other computers?

I have installed some servers on LUbuntu 18.04, such as postgresql server, mysql server, vino server, and I may have installed and run some servers without knowing it. I rarely intend them to be ...
1
vote
0answers
22 views

LUKS secure automated decryption

I have critical data, let's say machine learning code, GPG keys,... etc. I would like to create a workstation that will work somewhere else- in someone else's premises. I don't have concern that ...
2
votes
2answers
156 views

How to intercept temporary files created by a program? [duplicate]

TL;DR: I know a program creates and then deletes files in /tmp. How can I intercept them for examination ? Context: There's a particular .jar file, which I don't trust; for some reason its source ...
0
votes
2answers
66 views

Where to store proprietary code and executable scripts? [closed]

I have Python code that is run using a bash script. I want non-sudo users to be able to run it without making the Python code readable. What is the recommended pattern? Two ways I considered: Put ...
1
vote
1answer
23 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
2
votes
3answers
26 views

Are there any practical reasons for setting a maxlogins limit for users in limits.conf? What are the benefits?

Why should I set a maxlogins limit in /etc/security/limits.conf? In other words, are there any performance-related and security-related benefits to be gained? I have only three users on my machine, ...
0
votes
0answers
18 views

restricted shell for backup

I was thinking about creating some backup solution for my NAS. My idea is that I could set up a remote system with ssh access and backup tool (whichever I choose to use) would upload files there. All ...
19
votes
2answers
3k views

Should I delete users' passwords once I set up public key authentication for SSH?

It's best to use public keys for SSH. So my sshd_config has PasswordAuthentication no. Some users never log in, e.g. a sftp user with shell /usr/sbin/nologin. Or a system account. So I can create ...
1
vote
2answers
53 views

ls -F OR ls -al - What does the red highlighting mean? [duplicate]

So I ran a ls -F or ls -al on my /usr/bin directory and some of my files showed up with a red background and white text. What does this mean?
4
votes
1answer
43 views

Safely handling PDFs and other ebook formats on Linux [closed]

I'm running Arch Linux and using Okular for opening PDF files and FBReader for other ebook formats (Epub, Mobi, etc.). Simply put, here's my question: Assuming some of those documents come from ...
-1
votes
1answer
32 views

SELinux - workaround using audit2allow?

I read carefully tutorial and got to explanations on using audit2allow which allows access for denied process. audit2allow tutorial After reading about audit2allow it seems that this tool can always ...
0
votes
1answer
42 views

How to create a restricted shell for a specific user

I'm trying to create a restricted shell for a maintenance user. This user should only be allowed to execute a single bash script within his home folder. The user should not be allowed to execute any ...
1
vote
0answers
68 views

Are these SELinux messages suggestive of intrusion?

In the CentOS7 GUI, I have been seeing a smattering of messages such as: SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance: /etc/default/grub /etc/rc.d/...
0
votes
0answers
6 views

Apache mod_dbd: DBDParams with encrypted password

We're trying to configure Apache 2.4 with mod_dbd to connect to PostgreSQL for user authentication. (Ref: https://httpd.apache.org/docs/2.4/mod/mod_dbd.html) Is there a possibility to store the ...
0
votes
1answer
126 views

Does kernel package version 3.10.0-862.11.6.el7.x86_64 fix CVE-2017-16939?

I know that in order to fix CVE-2017-16939 we need to install patch version 3.10.0-862.2.3.el7 as shown in https://access.redhat.com/errata/RHSA-2018:1318. We currently have 3.10.0-862.11.6.el7....
14
votes
4answers
4k views

Would globally aliasing the fork bomb prevent its execution?

If you were to globally set alias ':(){ :|:& };:'='echo fork bomb averted' would that be an effective security strategy to avoid the Bash fork bomb execution or would there still be a way to ...
-1
votes
2answers
42 views

What do Linux upgrades provide?

Relatively often there are new kernel upgrades. But every time I install them, I do not see any difference between before and after. What do they exactly provide? How can I feel their presence on me? ...
-1
votes
1answer
50 views

how to protect the directory using password in LINUX (Need to add or modify files after encrypted )? [duplicate]

Is there any possibilities to protect the directory using the PIN number in Linux. But we need to add or modify files inside the encrypted directory.
0
votes
1answer
22 views

Hide password in dmenu

I'm new to dmenu. I'm trying to run programs which need sudo permission with dmenu. I've followed this link. So I have script ./dpass in my bin folder which says: #!/bin/bash dmenu -p "$1" <&- ...
2
votes
3answers
53 views

Is `users` guaranteed to indicate all users on host?

I have what I believe to be a very basic question about Linux hosts: Is the users command guaranteed to indicate all of the users on the host, or are there ways for users to hide the fact that they'...
1
vote
0answers
17 views

Regulating user-daemons from listening on unprivileged ports (preventing server spoofing)?

If I have a port >1024 but that I want to reserve to one executable how can I ensure that no other executable can open and listen to a socket on that port? /usr/bin/foo_srv -p 8080 /usr/bin/bar_srv -...
0
votes
2answers
36 views

Can I trust initramfs and vmlinuz images?

I am running an Arch Linux installation on my laptop with the following partition scheme: /dev/sda1 is my /boot partition, which is also my ESP /dev/sda2 is my LUKS encrypted root partition I use ...
4
votes
1answer
110 views

“ALL ALL=(ALL) NOPASSWD:ALL” was auto added in my /etc/sudoers file. Is this a Security Breach?

ALL ALL=(ALL) NOPASSWD:ALL line was auto added twice at the end of my /etc/sudoers file. My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the ...
0
votes
0answers
5 views

Script for Logon Specific Key-Combination Or Shutdown

I'd like to add an additional layer of security to my Linux Mint 19 install - namely running a script at launch that, unless aborted by a certain keystroke combination, shuts down the computer. ...
0
votes
0answers
28 views

How to check if another user has access to an environment variable in Linux [duplicate]

I am using environment variables for some configurations. I want www-data user (runs nginx) to have access to these variables but I don't think it does because the variables seem to be blank. How can ...
0
votes
0answers
18 views

tighten security on /etc/sudoers execution grants

I have been adding lines similar to this to a file in /etc/sudoers.d/: %mygroupname ALL=(ALL) NOPASSWD: /sbin/mount, /sbin/umount However, I believe that can be improved upon. For example, I am ...
2
votes
1answer
28 views

Looking at htop, I see a process associated with a tab in firefox that isn't open. What gives?

Earlier today I was ordering a yard sign for a local politician, via their website, through Firefox. Just now I was doing some work in R, and checking htop to make sure I wasn't going to make my ...
0
votes
0answers
17 views

Disable commands in Alpine Linux

I want to attempt to increase the security of some Alpine Linux Docker containers which run Nginx and other servers. I would like to disable commands like ls, cat, ed or sed, so that they are ...
0
votes
0answers
12 views

CSF.deny file keeps changing?

Hi I'm wondering if I'm being hacked. On my csf.deny file I have several block of IP's that I'm blocking including a test static IP of my own. When I activate this I can see that the block is ...
0
votes
1answer
31 views

IBM AIX Spectre/Meltdown - meaning of affected Lower & Upper Levels

Can someone explain to me the IBM spectre/meltdown patch. According to IBM, for example. bos.mp64 is affected and these levels. Fileset Lower Level Upper Level KEY ----------------...
2
votes
1answer
70 views

How to avoid apache allow download certain files?

How to avoid apache allow download certain files? (for example .py and .sh) I want to avoid files to be served and downloaded like www.site.com/file.sh www.site.com/file.py but I've tried to do ...
3
votes
3answers
33 views

Sudo tickets and subsequent non-sudo sibling process

Imagine that locally on my system sudo is configured with a timeout, so that once I authenticate after running sudo once in some terminal, I don't need to re-authenticate for another 10 minutes. Does ...
0
votes
1answer
19 views

Why does rpmfusion recommend the nogpgcheck switch?

See the commandline RHEL/CentOS section at https://rpmfusion.org/Configuration/ Doesn't this --nogpgcheck switch allow for tampering to happen unnoticed?
2
votes
2answers
54 views

How to start a root service from a GUI

So I get that running a GUI application as root in a Linux environment is a Bad Idea, and the prevailing wisdom seems to be that it's better to run such a service by having separate processes: a GUI ...
1
vote
1answer
21 views

Clam Antivirus auto scan on certain time on Linux?

I required to know from experts, how can we run Clam Antivirus (https://www.clamav.net/) and auto scan at a certain time on a Linux machine. I don't know how this will be done, I need to create a ...
4
votes
1answer
324 views

Why isn't it a security risk to add to sources.list?

To install Sublime, it wants me to add a GPG key and a sources.list entry so that apt-get can find it. A couple of other programs have asked for the same. Why isn't it a security risk to add more ...
1
vote
0answers
10 views

May I shut down xfce4-power-manager on Qubes OS 3.2? Is it going to cause security issue?

After some time use, I see that xfce4-power-manager is using a lot of resources (RAM and CPU). I think this is a natural thing. But given my limited computer ability then I thought to kill this ...
0
votes
1answer
13 views

Securing my Web Server with NAS

I have been researching about the security threats to a web server. It makes me want to secure my own on my Raspbian OS system. What are the list of things that are recommended or optional to install ...
0
votes
1answer
49 views

How to fix Spectre variant 3a and variant 4? [duplicate]

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'. My status for them is VULNERABLE. I have Intel CPU and using ...
16
votes
2answers
2k views

Is it safe to use echo to pass sensitive data into chpasswd?

I am trying to mass set a few user account passwords using chpasswd. The passwords should be generated randomly and printed to stdout (I need to write them down or put them in a password store), and ...
0
votes
0answers
58 views

Firefox and bubblewrap?

I have asked this question on the bubblewrap issue tracker, but no one has been able to provide an answer, so I'm hoping this is a more appropriate place to ask. 1. I do not have much experience with ...
0
votes
0answers
24 views

Insecure repository: Xenial Bodhi?

Jammed up with installing Bodhi onto an old MacBook. Running updates generates an error, as I recall, that the Xenial Bodhi repo itself was unprotected due to, I think, a lack of encryption. I'm ...
0
votes
0answers
182 views

Useradd/groupadd fails: failure while writing changes to /etc/passwd and /etc/group. Contexts problem

Good day, ladies and gentlemen, I need your help. I have a virtual machine with Ubuntu 18.04 LTS, and I'm trying to enforce in with SELinux. I had to build and install a custom kernel out of current ...
1
vote
1answer
69 views

How do hard links, symbolic links, and ACL folder permissions interact?

This one was a bit tricky for me to realize, but I came across a very weird behavior involving ACL extended file permissions and hard/symbolic links. I'll do my best to keep my question short and to ...