Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
3
votes
2answers
753 views

Weird audit2why message caused by SELinux

When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:...
-2
votes
1answer
23 views

Security patch update [closed]

If applying the latest patch(example : CESA-2019:0679 - Libssh2 Security Update - CentOS 7 x86_64) will cover the previous patch changes or we need to do it separately?
17
votes
3answers
1k views

What is OpenBSD's pledge in short?

Can someone please describe, for a non-programmer, but IT person, what is pledge? Ex.: there is a program, ex.: "xterm". How can pledge make it more secure? It pledge inside the programs code, or ...
5
votes
0answers
212 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
9
votes
3answers
22k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
201
votes
3answers
17k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
0
votes
0answers
62 views

How to set bluetooth security to none?

I am trying to connect my phone with my raspberry(headless) which runs on this OS. My requirement is,I do not have to enter "yes" manually in the bluez CLI application (which is started by the ...
0
votes
1answer
59 views

How to determine which modules are responsible for spectre_v2?

SERVER:~ # cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Mitigation: Full generic retpoline, IBPB, STIBP, RSB filling - vulnerable module loaded SERVER:~ # The question: But how to detect, ...
1
vote
1answer
79 views

Why ip_forward is disable by default? any side effect?

I need to forward an interface and I wonder why is disable by default? There is any security issue when I enable it? Is there any side effect when I enable it?
0
votes
1answer
66 views

Elasticsearch fails to start with 'permissions read' error even though read permissions exist

I have a symlink at /etc/elasticsearch/analysis that points to a mounted drive at /elasticdata/fileshare/analysis on Ubuntu 16.04 LTS Azure VM. When I try and start elasticsearch I am getting the ...
1
vote
0answers
95 views

How to update libvirt to passthrough md-clear?

There are new 4 CVE CVE-2018-12130 CVE-2018-12126 CVE-2018-12127 CVE-2019-11091 Debian stretch kernel is vulnerable https://security-tracker.debian.org/tracker/CVE-2018-12130 Even if you get a ...
3
votes
2answers
1k views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - [...
1
vote
4answers
72 views

Is it possible to check for DNS-leaks on unix server?

I run a Ubuntu server where I have a split tunnel for VPN. Which means I have a "normal" connection to the internet for most of my services but also a tunneled connection that only a few services use. ...
0
votes
1answer
85 views

How to handle Nginx and PHP ownership of log files?

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log ...
8
votes
2answers
679 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
0
votes
1answer
74 views

How can I unload a filesystem module in a RHEL 7 server in order to harden it?

I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs. I typed the following command: modprobe -n -v cramfs and I got the following answer: ...
1
vote
2answers
140 views

Does using non-root user without password makes system more vulnerable?

Let's say somebody sitting under user (non-admin, not root), but he didn't set up any password for it, only superuser/root has password. Is it bad practice (in context of remote access to a desktop ...
0
votes
0answers
74 views

Install Alpine security updates only

Is there a way to install only security updates for Alpine Linux and its apk packages, skipping updates that don't fix security holes?
1
vote
0answers
59 views

Solution for Auditing File Movement and Usage [closed]

I am a graduate research student at a children's hospital and they have fairly strict rules on how patient data is handled. The general principle is that the data cannot leave hospital hardware onto ...
1
vote
1answer
38 views

Synchronise passwords across devices with pass

I am looking for a simple, open-source password manager for linux with a CLI. It has to have a way of retrieving a password via the command line, so I can use it in several scripts (that sync my email ...
43
votes
7answers
73k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
0
votes
1answer
33 views

Ubuntu Security Patches for Apache2

How do i get the newest version on Ubuntu 18.04 (Longterm Version only!) for the apache2 package? (Please let me know if they apply the security patches from the newer versions backwards and i just ...
0
votes
0answers
56 views

How can I properly use my fingerprint scanner?

I just bought a Thinkpad T430 and installed Linux Mint 19 on it. It's the first time ever I use Linux, so I'm kinda lost. I searched a bit and I found a way to make the built in fingerprint scanner ...
0
votes
1answer
159 views

Are packages on snapcraft inherently safe?

Are packages installed by snap from https://snapcraft.io inherently safe? I heard they are sandboxed. Does that mean they can't change my file system, read my files, etc.?
3
votes
1answer
92 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
81
votes
5answers
36k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
0
votes
0answers
18 views

How do I protect ports from visibility, using portsentry?

I've been given an assignment by my teacher, saying: "Edit the portsentry.conf. Protect a few ports from visibility outside local net". I've gone through the documentation in the config file, and ...
0
votes
0answers
24 views

Encrypted /boot without UEFI

I have only one, LUKS-encrypted, partition. Is it possible to boot system from /boot on this partition? I don't want to use UEFI to do this. EDIT I'm using GRUB. I have uncommented ...
5
votes
1answer
11k views

using sudoers to allow non-privileged user to restart apache

We have production centos servers that run apache as root to allow low port numbers (80 and 443). We'd like a secure way for non-root users to restart apache. Are there any security implications ...
-1
votes
1answer
47 views

hidden files and directories warnings

I received these rkhunter results; what are these files, and are they dangerous? [23:17:48] Checking for hidden files and directories [ Warning ] [23:17:48] Warning: Hidden file found: /etc/....
2
votes
1answer
162 views

sedutils vs hpdarm for SED hard disks

According to my reading there are 2 known methods for using Self-Encrypting Drives (SED): hdparm https://www.pugetsystems.com/labs/articles/Introduction-to-Self-Encrypting-Drives-SED-557/ sedutils ...
2
votes
2answers
544 views

How to ban all connections to .se and .ru in the hosts.deny file

I am trying to figure out, whether or not it's possible to make sure, that if a user uses a browser and types in a domain name that ends on either "se" or "ru", they will be denied access to that site....
2
votes
1answer
2k views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
1
vote
1answer
2k views

Temporarily deny all incoming trafic with firewalld

I'm searching for an equivalent to ufw default deny for firewalld; the idea is that after I log in through SSH to my fresh server, I want to block all incoming new connections so that I have time to ...
0
votes
1answer
122 views

Am I at risk? How to interpret debscan vulnerability output?

Today I came across a paragraph on how to Identify vulnerabilities debsecan was mentioned. I downloaded and executed debsecan and as a result I received a very long and shocking report. EDIT I ...
17
votes
4answers
11k views

How to retrieve IP addresses of possible ssh attackers?

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records. However, there are two possible record types - for valid / invalid user. It complicates my ...
0
votes
1answer
16 views

Setting soft limit above hard does not fail in terms of exit code?

root@Andromeda:/# ulimit -n -S 2048 root@Andromeda:/# ulimit -n -H 2048 root@Andromeda:/# ulimit -n -S 4096 2048 root@Andromeda:/# echo $? 0 Failure to set soft limit above the hard one makes sense. ...
2
votes
1answer
39 views

extracting security profile specific files RHEL CentOS

during the install of RHEL 7.x or CentOS one can choose (or not choose) to apply one of these security profiles these are from 7.6: United States Government Configuration Baseline Standard System ...
11
votes
2answers
7k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
0
votes
4answers
169 views

Should I run a NTP daemon on my personal computer for extra security?

Would running an NTP daemon on my personal computer provide extra security? I'm asking because a tool was telling me to get a NTP daemon for security reasons. However afaik that tool is mostly ...
2
votes
1answer
367 views

Btrfs snapshot as user is not permitted

My backup user should be able to create a btrfs snapshot of the system subvolume (mounted at /). But this doesent work. Setup: subvol=/rootfs is mounted on / and subvol=/ is mounted on /btrfs First: ...
0
votes
1answer
45 views

Is an Apache server running on a personal server a security vulnerability?

I have a personal server, that contains important private files. For a hobby project I need an external web application access an *.xml file over a url http://.. . To provide this access I want to ...
1
vote
2answers
5k views

DNSCrypt, Unbound and DNSSEC

I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) . I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers : ...
0
votes
0answers
96 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
30
votes
8answers
9k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd....
2
votes
2answers
160 views

SSH encryption security

If I log in to my server through ssh and copy files to my local computer can I be eavesdropped? How do I make sure nobody can intercept the data or even know what I am copying? Are there levels of ...
1
vote
1answer
186 views

Monitoring tool without web interface

I need to monitor a Linux server. I'm searching for a monitoring tool able to store system information (CPU, RAM disks usage, Apache and Postfix status, etc.) throughout the day and send an email ...
0
votes
1answer
89 views

Hash sum of partitions that haven't been mounted changes every time after a live usb run

I have a Live USB with puppy linux on it. Here's menu entry in Grub2 for Puppy: menuentry "Puppy Linux 6.0.5 tahrpup" { insmod ext2 search --no-floppy --fs-uuid --set=root 0641378e-...
35
votes
5answers
24k views

How to test whether a Linux binary was compiled as position independent code?

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization (...
24
votes
3answers
21k views

rkhunter gives me a warning for “/usr/bin/lwp-request” - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...