Skip to main content

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
30 votes
2 answers
32k views

Where to find logs/information about unattended-upgrades (apt)?

Where can I find infos about when the unattend updates/upgrades run and what ist done (or IF something was done)? I want to enable the unattended-upgrades (for security updates) on a debian virtual ...
-1 votes
3 answers
52 views

What openssh version is best on Linux when it comes to stability and security ( sftp security )?

I work in a government agency. We are running a sftp client and sftp-server on a DMZ system where we receive and send files over the internet. Our environment: OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 ...
2 votes
1 answer
2k views

How to scan for malware on Linux

So a few days ago, I've noticed the new pattern with PC fan speeds on my Fedora workstation. Every now and then some of the fans will start spinning slightly faster than usual and will continue to do ...
0 votes
1 answer
47 views

Ensuring no sensitive information is left unencrypted on disk after editing text file

I used a bootable Linux Mint USB to open a sensitive text file and add sensitive information to it. This text file is encrypted by Veracrypt and was only opened and edited while I was offline. After ...
1 vote
1 answer
2k views

After disabling weak ssh ciphers I cannot ssh in at all

My goal is to disable weak ssh ciphers on a linux machine (specifically Lubuntu 14.10--yes, old, there are hardware compatibility reasons that it cannot be changed right now). First thing, I checked ...
1 vote
0 answers
26 views

Handling the putty SSH Warning Potential Security Breach (changed host key)

Scenario: Linux server, allowing users to connect via SSH using the putty-0.80.exe ssh client on Windows 10. Work environment, 100+ users mostly NOT computer savvy Linux Server updated from Redhat-7 ...
5 votes
4 answers
3k views

From a security standpoint, why should unused software be deleted? [closed]

I read the Wikipedia article on Unix security and the first sentence under "services" used to say that unused software should be deleted. I could not think of a reason, can you help me?
0 votes
0 answers
24 views

How to set up 'git push remote master' to automatically update files on production web server?

I have my website running on a remote server with gunicorn/nginx. The nginx runs from /var/www directory and its owned by root:www-data drwxrwxr-x 5 root www-data 4096 Apr 8 17:32 www I also ...
0 votes
1 answer
29 views

Why do some repositories configured in /etc/apt/sources.list.d/ not have a signed-by= set? - Is that a problem?

Most third-party repositories configured in /etc/apt/sources.list.d have a signing key configured like this for example: deb [signed-by=/etc/apt/keyrings/lutris.gpg] https://. However, some like the ...
1 vote
2 answers
2k views

Debian Bullseye - Disable Console TTY Login for Root

how does one restrict logging into the TTY consoles as 'root' in Debian 11 (bullseye)? In past versions I would empty the contents of /etc/securetty and that would prevent a direct login as 'root' ...
1 vote
1 answer
3k views

Rocky Linux 9 not accepting SFTP connections from old Dreamweaver version (no matching host key type found. Their offer: ssh-rsa,ssh-dss)

Running Rocky Linux 9 on server and I am trying to connect by password, not by key... It works when connecting with Putty on port 22, but when I try to connect with an old Dreamweaver version, ...
1 vote
1 answer
423 views

How to get a working clock on Debian? Clock is off by a couple minutes (time accuracy)

How to get a working clock in Debian 9 with KDE? My clock is almost 10 minutes slow on multiple of my machines running Debian 9 with KDE and (re)setting the timezone via tzselect didn't work. (I ...
0 votes
1 answer
47 views

LUKS encryption: Hide disk unlock target on boot

I would like to hide the device name of the LUKS-encrypted disk that is supposed to be unlocked during boot on Kali Purple. Currently whenever I boot my system there is a password prompt and below a ...
0 votes
1 answer
41 views

Are all packages necessarily reproducible on GUIX?

By default, what will happen if I try to install a package with GUIX and it's not bit-for-bit reproducible? I'm very concerned about the state of package managers in 2024 (and the risks of supply ...
3 votes
2 answers
111 views

Is it possible to find out when a user changed their password?

Or to see which user caused the security notice that /etc/spwd.db was changed?
4 votes
1 answer
3k views

firewalld port still open after removing port and services

I have created a script to install and configured firewalld on Centos 7. Most of the rules have worked correctly, but the SSH port still shows as Open when running a nmap scan. I know this is not a ...
0 votes
1 answer
14 views

Safety of thunderbird credentials with Firefox and websites with file-browsing scripts on Linux

I'd like to set up an instance of Thunderbird on a Fedora VM (with a VPN). I want it to use ONLY an alias I have set up with the email providers. But I will still have to use my real credentials to ...
0 votes
0 answers
17 views

dm-verity: development flag to allow changes

I have two partitions; on for the root file system and one for my application. I've set up dm-verity for the rootfs, but not for the appfs. Sometime I want to add something to the rootfs without ...
9 votes
1 answer
3k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
1 vote
1 answer
2k views

GUFW or Firestarter in Fedora

Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
1 vote
0 answers
71 views

Two users logged in when connected to internet

I am on Debian 12.5. I am worried, because on my system I always see two users logged in immediately after I enable internet connection! Otherwise I can only see one user logged in. Could this be a ...
4 votes
1 answer
361 views

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
0 votes
2 answers
26 views

pkexec asking for password multiple times

I have an application foo that starts other applications (bar and baz) under the hood.  I start foo using pkexec and I have written a policy file for foo with: <allow_any>yes</allow_any> &...
0 votes
0 answers
25 views

Does bash explicitly allow commands like passwd, su, etc., to run in setuid while disabling other custom binaries? [duplicate]

I know that /bin/bash has certain built-in protections that prevent the abuse of the Set-UID mechanism. So if I create a custom binary and execute it, it won't run with SUID 0 (refer the below image). ...
0 votes
1 answer
32 views

Error when rebuilding SELinux policy after adding rule to type enforcement (.te) file

I am going through this guide which allows me to create a custom SELinux policy for an application and restrict unconfined access to the kernel system files. On Step 9, I need to add a rule to the ...
1 vote
1 answer
47 views

Permission denied when opening a file in gdb

I'm implementing some CTF challenges. The flags are in some text files, that get read from the programs. To protect the flags I have changed the owner of the files, but have set the setuid to the ...
45 votes
2 answers
62k views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ca_cert="/usr/share/...
1 vote
2 answers
432 views

why there is no output of lsattr and how to resolve it

The normal output of lsattr is below # lsattr /etc/fstab ---------------- /etc/fstab but I have a host ,when I run lsattr, there is no output display to me, just like below. my os version is centos ...
1 vote
1 answer
4k views

How to implement security profiles during installation of CentOS 8?

I am new to the Linux environment and I found CentOS to be a stable and secure operating system. I do not have much knowledge about the security profiles and how well do they protect the operating ...
0 votes
2 answers
90 views

Run shellcode as root in a buffer overflow attack?

I'm trying to exploit the following code: #include <stdio.h> #include <string.h> int main(int argc, char** argv){ char buffer[100]; strcpy(buffer, argv[1]); return 0; } with ...
0 votes
1 answer
55 views

Is a MITM attack possible in this scenario?

OS is Debian. Imagine I have my own apt repo set up inside a private network. This repo is set up to provide a single package to other servers on this network. I can easily create a signing key for my ...
3 votes
2 answers
2k views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1 vote
1 answer
3k views

Failed NVMe M.2 SSD, broken filesystem, unwriteable; can I wipe it anyway?

My Samsung 970 EVO M.2 500GB SSD (MZ-V7E500BW) suddenly failed yesterday during a power outage. I now have a warning during POST ("WARNING! Please back up your data and replace your hard disk ...
0 votes
0 answers
16 views

Identification of processes that are not terminated by logging out

I'm trying to better understand how to terminate all undesired processes and start a Linux session fresh. By "undesired", I mean any processes left over from applications that have crashed. ...
2 votes
0 answers
36 views

Prevent process from performing network scan

On a linux 20.04 LTS, I'm trying to stop a process from entering promiscuous mode and/or from scanning my network. To be more specific, I'll have to install LsAgent from LANSWEEPER in a company's ...
25 votes
4 answers
2k views

How to safely use gawk's -i option or @include directive?

Using gawk -i inplace some-awk-code some-file (or @include "inplace" within an awk script) to edit a file in-place (or any other extension) is a security vulnerability. Why? How do I work ...
0 votes
1 answer
53 views

Heavy UDP/sunrpc network usage to unknown IP addresses

In the last week or so, my network monitory has indicated that my desktop computer has started periodically sending ~0.7MB/s out over my ethernet connection (eno). I understand very little about ...
24 votes
3 answers
4k views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
0 votes
1 answer
72 views

Totally Legit Signing Key <[email protected]>

I run: gpg --list-keys I get: pub rsa1024 2014-01-26 [C] <REMOVED> uid [ unknown] Totally Legit Signing Key <[email protected]> Can this be dangerous? What is this? ...
141 votes
8 answers
495k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
1 vote
0 answers
148 views

Need to fully understand 'violates PodSecurity "baseline:latest": hostPath volumes'

We have been running Kubernetes 1.13 for quite a while in onprem clusters. We're now upgrading them to 1.24. There is one service that attempted to deploy on the new cluster that is failing with the ...
0 votes
1 answer
24 views

Detecting used API calls for an application

I need to run a proprietary C++ application under Linux and I need to understand if it contains any functions outside advertised features. Is there a way to list all the API calls that the application ...
0 votes
0 answers
33 views

Is it possible to encrypt traffic if I have only CA certificate?

I have simple secure (I guess) Mosquitto server described in my previous question. Client machine has no any keys or certificate installed except single ca.crt certificate file generated and taken ...
-5 votes
1 answer
65 views

What's the deal with gitlab (and github?) security? [closed]

I just wanted to raise an issue (ie. report a bug) in some software package hosted on gitlab. I have a github account, but not a gitlab one. Whenever I log in from a new device (github), I need to &...
0 votes
2 answers
58 views

How to check permissions of a non sudoers user with full root access?

doas is a sudo-like command recently packaged in Debian 12, Ubuntu Jammy (universe) and some other Linux distros. A non sudoers user (doasuser) can be added to /etc/doas.conf to be granted root access....
13 votes
9 answers
102k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
0 votes
1 answer
2k views

How to decapsule GRE (ERSPAN Type II) on Ubuntu 18.04 LTS?

I have an Ubunutu 18.04 LTS server that is receiving ERSPAN traffic sent from several sources. For those not familiar with ERSPAN it uses GRE tunneling to achieve this, wrapping the original L3 ...
1 vote
1 answer
103 views

How can I read the RID of a CDRW or DVDRW on Linux?

This question is inspired by this answer on SuperUser by Proger_Cbsk. The RID is the Recorder IDentification. It uniquely identifies the drive that wrote the CD/DVD. What software if anything can read ...
-3 votes
1 answer
164 views

Is there a way to enforce 2FA for all users on the SSH server on the Unix PAM Subsystem?

Is there a way to enforce two-factor authentication (2FA) for all users on the SSH server on the Unix PAM Subsystem?
0 votes
1 answer
252 views

Nessus is reporting false positives for Debian 12

We've recently added some new Debian 12 servers to our usual Centos/Rocky estate, and Nessus is scanning via ssh and is reporting critical vulns on our Debian vms. However, the systems are patched up ...

1
2 3 4 5
54