Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
2
votes
1answer
224 views

Encrypting a password using gpg without constantly asking for password

I have a service that checks my email regularly, and I use gpg to encrypt my email password. The problem is that every time I lock my computer or after a certain amount of time gpg shows a graphical ...
13
votes
8answers
3k views

How can we limit the impact of ssh probes?

My webserver is constantly attacked by various IP addresses. They try five passwords and then change the IP address. I have done various lockdowns like using ssh-keys and not permitting passwords, ...
0
votes
1answer
31 views

sudo - How insecure is it to modify caching time? [closed]

We can modify sudo caching time with the option: timestamp_timeout How insecure is that? I wanted to increase it to several hours (the time of my sessions)
0
votes
0answers
310 views

The JNLP application is not fully signed

I am trying to run a .jnlp file using javaws. It produces this error: Caused by: net.sourceforge.jnlp.LaunchException: Fatal: Application Error: The JNLP application is not fully signed by a single ...
1
vote
1answer
49 views

How should I create a user that I can use to safely run web apps etc.?

I'm doing this over ssh. I want to create a user that: can't be accessed via ssh can be impersonated with su doesn't have a password (is this a good practice?) can run web apps (specifically ...
1
vote
0answers
72 views

DPAPI / MacOS-style Keyring for Linux or BSD?

Windows and Mac both have a handy way to secure data using the users' login credentials. The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted ...
0
votes
0answers
35 views

Securing an open FTP on FreeBSD for visitor wifi speed testing?

I'd like to add a really simple local FTP server to my FreeBSD system, to allow guests to do wifi speed testing. Because of the use, I don't need more than very basic functionality - anon R/W to a ...
9
votes
1answer
1k views

“ALL ALL=(ALL) NOPASSWD:ALL” was auto added in my /etc/sudoers file. Is this a Security Breach?

ALL ALL=(ALL) NOPASSWD:ALL line was auto added twice at the end of my /etc/sudoers file. My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the ...
2
votes
2answers
1k views

Is there a way to resolve ALL PIA VPN IPs with a script?

I am looking for a way to get a complete list of all the current IP addresses for PrivateInternetAccess' servers. I need the complete list so that I can manually enter them into a killswitch for ...
3
votes
1answer
87 views

sudo escalation password fails - /etc/shadow hash ok, group ok, /etc/sudoers ok

After system update/upgrade, I cannot escalate with sudo using correct password: user $ sudo -s [sudo] password for user: ******************** Sorry, try again. [sudo] password for user: *************...
4
votes
1answer
13k views

max no of tcp connections on a linux system

I know that /etc/security/limits.conf provides the persistent soft and hard limits for several values. However, in the relevant list there is no indication about imposed limits on: a) concurrent ...
1
vote
0answers
25 views

Freeze Linux when log is full

Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
2
votes
0answers
108 views

kernel vulnerabilities

I recently got a single-board computer for which the official support has been discontinued. I'm using a minimal, debootstrapped Debian on that system with a kernel that is taken from one of the ...
2
votes
0answers
77 views

Headless Server? [closed]

I am running Nessus on a closed network. My OS is Redhat 7.4. I have Bare Metal machines in my data center and Virtual Machines on AWS. When Nessus scans my Bare Metal machines, it correctly ...
0
votes
1answer
86 views

Should I go for Debian Stable or Testing? [closed]

I've been using Debian Stable for 1 year. I like Debian for their Privacy Policy, no telemetry and security. Now I need to reinstall my distro and I want to go for security distro. I don't know ...
13
votes
4answers
742 views

Books/Guides for Securing a Server [closed]

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). I'm pretty broke so I can'...
3
votes
1answer
219 views

Glibc Patch for getaddrinfo() vulnerability

I have been seeing a lot about the newly discovered vulnerability in the glibc library which can be exploited (albeit with difficulty) by attackers. Here is a (fire and brimstone) article on the ...
9
votes
2answers
1k views

What sets fs:[0x28] (stack canary)?

From this post it is shown that FS:[0x28] is a stack-canary. I'm generating that same code using GCC on this function, void foo () { char a[500] = {}; printf("%s", a); } Specifically, I'm ...
12
votes
2answers
2k views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
17
votes
1answer
9k views

Why is “nodev” in /etc/fstab so important? How can character devices be used for hacking?

I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous. If I have a USB stick with a bash executable that has setuid ...
0
votes
3answers
33 views

How to set the passphrase that different keys are discriminable

Can I change my phassword/-phrase('s settings) in a way that it's important which key of multpile ones (e. g. the left shift key instead of the right one) is chosen? Could I go a step further and ask ...
2
votes
0answers
92 views

How to check If my PC was exploited after apt exploit? [closed]

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 Is there a way to check if my PC got exploited/hacked/virused ?
0
votes
1answer
90 views

rsync copy file without user and password less access

Explain below mention command we are not passing username as well password still we can do rsync. rsync -avz rsync.apache.org::apache-dist /path/to/mirror
1
vote
1answer
139 views

How to provide OAuth2 “Client ID” and “Client Secret” to an open-source bash script?

I was writing a bash script for Gmail that would authorize itself using OAuth2, and make API calls using the received tokens. It worked. But now I'm stuck on thinking how to securely store the Client ...
0
votes
1answer
99 views

Is a php file with SGID bit and read-only & execute a security problem? [duplicate]

I find php files with SGID bit and read-only & execute. The group is root. Is this a problem? Because a user will need to run the php interpreter with their our account, could it led to privilege ...
-3
votes
1answer
79 views

Are there any x86 security Linux distributions based on Ubuntu? [closed]

Are there any x86 security distributions like Kali Linux or better them based on Ubuntu?
-1
votes
2answers
217 views

Priviledge separation for Firefox (aka: how to secure webbrowsing)

I do this on Scientific Linux 6.3 (to implement it, it requires a minimal Linux knowledge): Shared directory for downloads Remember you can only copy from or to this directory, never "move" files ...
1
vote
1answer
2k views

how to use rsa RSA SecurID with Linux?

I have just found an old RSA SecurID token, model SD600, at the back of a drawer. I only have the token - no documentation or pin numbers (long forgotten) or anything else. Is it possible to make use ...
2
votes
3answers
3k views

How to use YubiKeys with SSH keys in 2-step verification?

I can setup SSH keypair without Fido U2F as described SSH-agent working over many servers without retyping? Some flag? in the thread. Two step verification would be very good: password for the ...
1
vote
0answers
113 views

How to additional public keys to .secondary_trusted_keys?

I am trying to add additional keys to .secondary_trusted_keys. Documentation says, to do so the additional keys has to be signed by a key which is already a resident in either .builtin_trusted_keys or ...
0
votes
1answer
85 views

Is there a way to prevent root user from modifing kernel and boot loader?

Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel. Is there a way to prevent ...
122
votes
2answers
20k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
8
votes
8answers
62k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
2
votes
2answers
97 views

Why is /etc/sudoers not world-readable?

I'm struggling to think what security risks there could be to knowing who is allowed to use sudo.
1
vote
1answer
441 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
4
votes
2answers
542 views

Linux root access recovery by booting on the console

Very recently I recovered a root password for a Debian server by booting into single user mode. This resulted in me having access to a shell with root privileges (prompt said "root@none") Now this has ...
0
votes
1answer
64 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
0
votes
0answers
42 views

Order of scripts run before bash starts

I'm studying the scripts that run before a bash shell started by the user starts. As far as I understand, the order is: /home/username/.bashrc (modifiable by user) /etc/bashrc (modifiable by root) /...
3
votes
0answers
229 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
17
votes
1answer
462 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
-1
votes
1answer
28 views

Install program in Wine and analyze traffic

I need to install a Windows program in Wine and I would like to analyze how reliable it is, that is, if it does not generate any connection that can transfer my information without realizing it. This ...
0
votes
1answer
70 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
0
votes
3answers
275 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
1
vote
1answer
21 views

How to know if Jenkins is patched on CentOS 7

I've been using rpm -q --changelog package_name to check if a certain cve vulnerability has been patched on my system. However, when I'm doing the same for jenkins, all I got was Sat Apr 19 ...
1
vote
2answers
108 views

What is the reason FreeBSD jails don't get the entropy pool

I've noticed that the FreeBSD script that generates entropy, bails out if it finds it itself is running from within a jail. # uname -srm ## notice: install of mfsBSD (https://mfsbsd.vx.sk) FreeBSD ...
2
votes
1answer
2k views

logging wrong passwords in /var/log/auth.log

/var/log/auth.log logs (among other things) failed login attempts to my debian linux. I was wandering if it is possible to ask it to log the password that was used in the failed attempt. This is ...
4
votes
3answers
3k views

Do I need a special firewall on a personal computer

I was wondering about Linux security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable and before used Ubuntu ...
0
votes
1answer
179 views

How can I make Linux as secure as possible? [closed]

With the rise of Windows 10 I am getting more concerned about my privacy and the risks of using an unsecured system. My question is three fold Which distro of Linux is most secure? How do keep the ...
3
votes
0answers
314 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
0
votes
1answer
90 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...