Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

0
votes
1answer
13 views

How to handle Nginx and PHP ownership of log files?

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log ...
0
votes
4answers
156 views

Should I run a NTP daemon on my personal computer for extra security?

Would running an NTP daemon on my personal computer provide extra security? I'm asking because a tool was telling me to get a NTP daemon for security reasons. However afaik that tool is mostly ...
1
vote
1answer
335 views

Btrfs snapshot as user is not permitted

My backup user should be able to create a btrfs snapshot of the system subvolume (mounted at /). But this doesent work. Setup: subvol=/rootfs is mounted on / and subvol=/ is mounted on /btrfs First: ...
0
votes
1answer
44 views

Is an Apache server running on a personal server a security vulnerability?

I have a personal server, that contains important private files. For a hobby project I need an external web application access an *.xml file over a url http://.. . To provide this access I want to ...
1
vote
2answers
5k views

DNSCrypt, Unbound and DNSSEC

I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) . I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers : ...
0
votes
0answers
16 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
30
votes
8answers
9k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd....
3
votes
1answer
72 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
2
votes
2answers
159 views

SSH encryption security

If I log in to my server through ssh and copy files to my local computer can I be eavesdropped? How do I make sure nobody can intercept the data or even know what I am copying? Are there levels of ...
1
vote
1answer
181 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...
0
votes
1answer
83 views

Hash sum of partitions that haven't been mounted changes every time after a live usb run

I have a Live USB with puppy linux on it. Here's menu entry in Grub2 for Puppy: menuentry "Puppy Linux 6.0.5 tahrpup" { insmod ext2 search --no-floppy --fs-uuid --set=root 0641378e-...
34
votes
5answers
22k views

How to test whether a Linux binary was compiled as position independent code?

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization (...
1
vote
1answer
21 views

extracting security profile specific files RHEL CentOS

during the install of RHEL 7.x or CentOS one can choose (or not choose) to apply one of these security profiles these are from 7.6: United States Government Configuration Baseline Standard System ...
23
votes
3answers
18k views

rkhunter gives me a warning for “/usr/bin/lwp-request” - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...
2
votes
3answers
2k views

How can I securely login remotely to my Linux box over the internet?

What's the simplest, most secure way to connect to my computer at home from work or from the library, &c? I'm running Mint 14. I'd like to connect from a Win or Linux setup. ALSO is there an ...
0
votes
2answers
1k views

Is it possible to make a standard user that can gain NO access to root?

I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I want to prevent them from gaining root access or using su or sudo command. I'd like to disable a variety of ...
0
votes
1answer
42 views

Is plain text in index.html secure?

So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file. I ...
174
votes
8answers
132k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
7
votes
4answers
13k views

Check that fail2ban is running?

I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is ...
8
votes
1answer
2k views

What is securityfs?

While I am studying, I saw security file system which is mounted on /sys/kernel/security . It seems like to operate similar to sysfs or proc file system. Security file system keeps data on memory not ...
3
votes
1answer
38 views

What is Date_Spec in sudoers policy?

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec. User_Spec ::= User_List ...
0
votes
0answers
27 views

OSSEC rootkit update [closed]

How to ensure rootkit_files.txt, rootkit_trojans.txt are always updated in your OSSEC master server?
0
votes
1answer
13 views

PackageKit logs a message about “only_trusted:0”

I ran pkcon update force. I noticed PackageKit is logging about only_trusted:0. That is, an operation where the only_trusted option is disabled. Even though I did not pass --allow-untrusted to ...
0
votes
0answers
15 views

Screenlock backdoors and how to close them

There is a warning in the Archlinux List of security applications. It says that of all possible screen-lockers, only four block tty access: sflock, physlock, Cinnamon Screensaver, MATE Screensaver and ...
2
votes
1answer
163 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
1
vote
1answer
862 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting (say,...
25
votes
4answers
57k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
4
votes
3answers
3k views

Privilege escalation detection?

Everytime when I read about some local privilege escalation exploit (e.g. this). I wonder if an OS can detect that there is someone logging in as root (or new root process starting)? Imagine a Gnu/...
1
vote
0answers
109 views

Hibernate command very important security problem

I use Debian 9 and use hibernate command very much. Recently I give attention to how it is working and understand after I turn on PC and hibernate was restoring images and wakes up, it does not ask ...
4
votes
1answer
14k views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
0
votes
2answers
88 views

How to hide the encrypted version of a file put in a cryptfs filesystem?

Say I create an encrypted folder and add a file to it: # mount -t ecryptfs /srv /srv # echo word > /srv/file The content of file is unavailable only after unmounting the filesystem. How can I ...
4
votes
1answer
2k views

What are the dangers of having writable chroot directory for FTP?

People around the net are all yelling how insecure it is to have writable root FTP directory, if you configure your FTP server with the chroot option (vsftpd won't even run). I miss the explanation ...
1
vote
1answer
495 views

preventing brute force attack on samba server [closed]

I have a LAN with many users(clients) in it. Each of them has a private samba share folder. How can I prevent somebody (within the same network) brute forces another account (so he can access ...
6
votes
2answers
3k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that mount....
3
votes
1answer
467 views

Restrict `expect` to stdin/stdout interaction only

I need to accept job files from users, which would essentially consist of console interaction with a process I will be running for them. Naturally, the first idea that came to mind is to use expect ...
155
votes
8answers
187k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
112
votes
2answers
9k views

Is Vim immune to copy-paste attack?

You should never paste from web to your terminal. Instead, you should paste to your text editor, check the command and then paste to the terminal. That's OK, but what if Vim is my text editor? Could ...
2
votes
1answer
24 views

How is find's {} substitution pattern vulnerable to injection attack? [duplicate]

I'm trying to understand more about this edit that was made to an answer of mine: https://unix.stackexchange.com/revisions/510388/5 How does running cd "{}" in the context of a find command ...
3
votes
2answers
21k views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
0
votes
0answers
26 views

show history of curl requests including executing user or program?

Little Snitch just told me that curl made a silent connection to tools.google.com. I'd like to know why. is there a way to get the history of commands on my system including who executed them?
1
vote
2answers
102 views

Understanding the audit log - file permissions and file content changed

I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well. I've got something in my audit but can't really tell what and how it ...
5
votes
4answers
121 views

Protecting access to NFS shares in Docker

I would like people to access NFS shares from within Docker. Problem is inside of Docker they can become root, and then they can have write access to anyone's files by becoming that user. Is there a ...
1
vote
0answers
32 views

Encouraging the CPU to perform out of order execution [migrated]

I am attempting to exploit the meltdown security flaw on Ubuntu 16.04, with an unpatched kernel 4.8.0-36 on an Intel Core-i5 4300M CPU. First, I am storing the secret data at an address in kernel ...
14
votes
4answers
3k views

If the heap is zero-initialized for security, then why is the stack merely uninitialized?

On my Debian GNU/Linux 9 system, when a binary is executed, the stack is uninitialized but the heap is zero-initialized. Why? I assume that zero-initialization promotes security but, if for the ...
2
votes
2answers
1k views

Why does kdeconnect listen on port 1716/tcp all the time? How to close the port / secure it?

Zenmap shows me that port 1716/tcp is open and sudo fuser -v 1716/tcp tells me kdeconnectd is responsible for it. Why does kdeconnectd have the 1716 port opened all the time? And what would be best ...
3
votes
1answer
72 views

Why is +::0:0::: not supposed to be found in /etc/passwd?

I was reading the BSI Security Guidelines (GERMAN), on NIS and it explicitly mentioned that one should prevent the entry +::0:0::: from occuring in the /etc/passwd file of the NIS server. From my ...
2
votes
1answer
22 views

rpm -V verify purpose

I am told I should do rpm -Va because: operating system must be configured so that the cryptographic hash of system files and commands matches vendor values... Without cryptographic integrity ...
1
vote
1answer
185 views

How to trap an event when a file with a specific content (given by e.g. checksum) was created on the local file system?

I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by me)....
0
votes
1answer
38 views

uninitialized pointers dangerous?

I read, that pointers (in C), that are not initialized, could point to an address that contain data or program code from other programs. In the book it says, that this can cause damage. Is this issue ...
0
votes
1answer
21 views

Should I remove ICMP Protocol from firewall rules base on security concern?

As you can see from the screenshot of GCP firewall rule page, should I remove ICMP Protocol from firewall rules base on security concern? Will it lower the chance of being attacked? I'm using CentOS ...