Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
4
votes
4answers
388 views

Internet SSH Server Security Considerations

What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?
10
votes
2answers
17k views

How do you protect a plain text credentials file with the username and password?

I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass. [not recommended] put the ...
5
votes
1answer
349 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
3
votes
4answers
1k views

sudo without password - security? [duplicate]

Possible Duplicate: What specific vulnerabilities am I creating by disabling the sudo password? I'm involved yet again in the old argument on whether sudo without password is secure enough or not....
3
votes
2answers
926 views

Security with Kernel IP Forwarding Enabled

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
5
votes
1answer
3k views

I don't want other users see my processes in ps aux. I have root. It's Debian. How to use grsec?

I installed 'linux-patch-grsecurity2' and it has some sort of interface. ~$ sudo gradm2 gradm 2.1.14 grsecurity administration program Usage: gradm [option] ... Examples: gradm -P ...
4
votes
1answer
206 views

Running proprietary software on Linux safely [closed]

As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from having access to my personal files. After looking a lot at sandboxing, I've decided that ...
3
votes
1answer
182 views

mounting volume protected against user access

I need to mount a directory in a way that prevents user accessing it. However I need to have access to all attributes (including permission) from root. Is following method safe or is there a way ...
10
votes
1answer
332 views

Does ssh-agent store my passphrase?

Is it possible to determine the passphrases of private keys added to ssh-agent? I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
2
votes
1answer
600 views

Debian unstable chroot security issues

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot. When doing this, ...
2
votes
1answer
2k views

root password changed automatically

I have my system on dual boot (win7 and RHEL 6). I have 2 user account on RHEL 6. A normal user and a root user. I put passwords of both accounts same. It was working fine from 5 6 days. Yesterday I ...
1
vote
1answer
218 views

What are the cons of posting dmidecode output publicly?

I remember somewhere mentioned that posting dmidecode output publicly is risky (security/privacy).
52
votes
1answer
47k views

Why are the first 1024 ports restricted to the root user only?

This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
5
votes
1answer
221 views

How do I know which files will be included in a linux kernel before I build it?

I am working on a project that includes building an old kernel version of linux. This is fine, but I still need to patch the kernel of all previously found security vulnerabilities based on CVEs. I ...
11
votes
2answers
3k views

How do I hide/anonymise/defend a computer when on hostile networks?

I connect to a lot of open networks when I'm pootling around. I'm fairly careful to VPN home for anything important but that's not really my boggle. The laptop runs several services (nfs, dev http ...
1
vote
1answer
2k views

How to secure CentOS and FreeBSD by disabling USB ports and VGA output on-site?

Is it possible to disable USB ports and CDRom and VGA output in the Dell R310 from CentOS or FreeBSD (without BIOS)? A demo server is running in a customer test laboratory, where they can simply get ...
3
votes
4answers
2k views

How to guarantee the integrity of an OS?

In information security, integrity means that data cannot be modified undetectably. This answer raised my interest, of course, I want to guarantee the integrity of my OS, outlined here. Suppose a ...
8
votes
1answer
2k views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
9
votes
3answers
4k views

How can I set that only root + a given user can shut down my pc?

If I'm using Ubuntu 11.04, how can I configure it such that that only two users can shut down/suspend/hibernate my PC: the root user and one regular user?
2
votes
1answer
2k views

How to create a “jailed” environment for an application under Linux?

Using Ubuntu 11.04 as a Desktop OS, I want to reach "bigger security" with a "jailing" processes: VirtualBox, Google Chrome, Firefox, VLC, PDF/djvu reader, MP3 player, wine, pidgin, transmission, ...
8
votes
1answer
2k views

Is /dev/random data a psuedo-random AES cypher, and where does the entropy come from?

My current understanding of an entropy pool is that it gathers truly random bits of data at a slow rate. I'd like to know how Unix & Linux collect entropy, and how that entropy is used by /dev/...
8
votes
2answers
4k views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
1
vote
2answers
618 views

DNSSEC in the root zone? How to use it?

I'm using Fedora for desktop use and I: yum -y install caching-nameserver service named restart chkconfig --level 5 named on on it, and set the nameserver to 127.0.0.1. If I: dig google.com | grep ...
3
votes
1answer
2k views

Start X as a user other than root

I know some distro's (Moblin? ) have X starting as a user other than root already... What is required to do this? What steps need to be taken? I don't think it matters but I think X is started by KDM ...
-1
votes
1answer
5k views

What are the most secure cryptsetup parameters to create an Encrypted filesystem? [closed]

According to http://16s.us/Linux/dm-crypt.txt, it's better to use only dm-crypt, because LUKS leaves a trace. That's OK. But, what are the most secure cryptsetup parameters to use? E.g.: "aes-cbc-...
2
votes
1answer
500 views

What flags are used to compile debian stable packages?

Ubuntu wiki states that its packages are compiled with secure flags and secure kernel options. I cannot find this information about debian. See https://wiki.ubuntu.com/CompilerFlags
-1
votes
3answers
120 views

Does PGPDesktop supports OpenBSD or e.g. Fedora?

Does PGPDesktop support OpenBSD or e.g. Fedora, or can I only encrypt my whole hard drive when I use Windows?
1
vote
2answers
2k views

nmap output: what does “uptime” mean?

If I nmap a host, then it outputs an "Uptime" too. What does it mean, is it trustable? Does it gives correct times?
2
votes
1answer
986 views

A local, centralized, secure way to store FTP login data, including passwords

I want to be able to store the login details all of my remote FTP accounts in one place, securely. Then I'd like clients like autofs/curlftpfs, Filezilla, etc to use this one store of passwords. I'm ...
6
votes
1answer
516 views

SSH tunnel with VNC?

In theory: I have a low-power consuption machine: eee pc, ok. I need to run a virtualized windows xp on it. (Because of a windows-only program..) I need to reach it from a smartphone (Android). The ...
-1
votes
1answer
227 views

Linux user security

When a user is created in Linux, their username can be seen publicly in the passwd file. Is there a hash set for that?
1
vote
3answers
238 views

Tool to remove all non-package files on a system

If you want to keep for example a build or server system clean, it is very useful to be able to check that all files are present and accounted for by the package metadata. At work we have a very nice ...
3
votes
2answers
969 views

How to block outgoing connections from process/user on FreeBSD?

My server executes third party software which processes user submitted files. I want to block outgoing connections from my process. How can I do it in FreeBSD?
12
votes
4answers
2k views

How exactly do people “crack” Unix/Linux Systems?

No im not looking to become a cracker or something like that, but Im trying to figure out the process (more from a programming perspective). So im assuming (guessing) a cracker's main goal is to gain ...
4
votes
5answers
166 views

Hiding work in account with multiple users

I'm currently working on an assignment in a cluster programming class. The class has been given an account on the cluster, so we can ssh in and do our work. The problem is that the one account is ...
6
votes
1answer
4k views

Disable random memory address generation in my programs

I'm reading "The art of exploitation" and would like to try some experiments, including reading from and writing to various memory address. I've created some simple programs and trying to overwrite ...
9
votes
1answer
424 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
2
votes
1answer
463 views

How do I make a certain command sudo-only on Debian?

What user and group should I chown it to? All admins are in 'admins' group. How do I chmod it?
2
votes
2answers
3k views

How to change dm_crypt aes/256 LVM password after install?

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this ...
3
votes
1answer
204 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
2
votes
2answers
911 views

Cannot understand chkrootkit's result

I couldn't understand the output of chkrootkit command: $ chkrootkit -q -r / /usr/lib/.libssl.so.10.hmac /usr/lib/.libfipscheck.so.1.hmac /usr/lib/firefox-3.6/.autoreg /usr/lib/.libfipscheck.so.1.1.0....
7
votes
4answers
778 views

SSH to untrusted machine

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
6
votes
1answer
10k views

What is hvc0? (appearing in “who” list)

I have an Ubuntu Server, and when I type who, to see who's connected, I can see that there's a user connected, and instead of being logged to a pts/x, he's connected to hvc0. Is there something to ...
5
votes
1answer
1k views

Linux - why is kernel.shmall so low by default?

I run DB2 on Linux where I have to allocate the vast majority of memory on the machine to shared memory segments. This page is typical of the info that I've found about shmall/shmmax: http://www....
5
votes
2answers
9k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
6
votes
1answer
3k views

Lock screen w/ slock after a certain time?

I am running OpenBox in Arch Linux, how can I set it up so that I can have slock lock my screen after a certain amount of time (with no activity)? Thanks!
2
votes
2answers
3k views

GPG check regarding packages on various distributions

It's ok that the various linux distributions use gpg to verify e.g. new packages downloaded with http. But what happens if the server that holds the packages gets hacked? OK, they need a new gpg key, ...
0
votes
0answers
152 views

git and remote security with Encfs [duplicate]

Possible Duplicate: How do i encrypt git on my server? I wanted to create a user on my server to use as a private repository. I'd like the files to be encrypted. Encfs will timeout after minutes ...
3
votes
1answer
3k views

Privoxy redirect rule for Wikipedia

I have a few Privoxy rules, that can redirect HTTP Wikipedia [en,de] traffic to HTTPS: (a little part from the "user.action" file) { +redirect{s@http://en.wikipedia.org/wiki/@https://secure.wikimedia....
7
votes
2answers
381 views

Hibernate and security considerations

How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?