Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
2
votes
1answer
29 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
1
vote
1answer
19 views

Non Root User request to root for a specific service restart

We have a typical problem in our environment. Typically we have users with non SUDOER and ROOT access who are monitoring services of our application. At times they need to restart a service which ...
0
votes
1answer
31 views

Hash hostnames in $HOME/.ssh/config?

I know it's a good security measure to set HashKnownHosts yes in /etc/ssh/ssh_config, which causes OpenSSH client to hash the hostnames in ~/.ssh/known_hosts. Now I want to hash the hostnames in ~/....
0
votes
2answers
151 views

TCP SACK fix for Ubuntu 16.04 kernel version 4.15.0-1021-gcp

I have server in Google Cloud, running Ubuntu 16.04 with kernel version 4.15.0-1021-gcp. A fix for some vulnerability fix was recently released. I have question about that: do I need to update my ...
2
votes
1answer
61 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is a Linux ...
0
votes
0answers
24 views

Run script if phrase is typed in bash's password prompt

Is there a way to run a shell script if a specific incorrect password is entered in the bash login? (ie. my actual password is dog, but when I type in only cat it runs a script. I'm hoping to use this ...
1
vote
2answers
94 views

How to fix Fallout and RIDL?

I installed intel-microcode, but when I use ./spectre-meltdown-checker.sh I get this CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys ...
1
vote
0answers
30 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
2
votes
0answers
32 views

Why is StreamLocalBindUnlink disabled by default?

I want to enable GPG agent forwarding, and found that StreamLocalBindUnlink is disabled by default on sshd. Why is it disabled by default? Is there any security risk in enabling it? Since X11 ...
-3
votes
1answer
346 views
1
vote
4answers
73 views

Making my remote SSH more secure

I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite. Currently I just have 2 users that are remoting in, but checking my /var/...
0
votes
1answer
23 views

Encrypting Wifi Password When Using Wicd

Inspired by this answer, I'm wondering if there is a (relatively) painless way to "hide" the wifi password(s) that is/are present in the /etc/wicd/wireless-settings.conf file. I travel a lot and ...
1
vote
1answer
70 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
0
votes
1answer
37 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
0
votes
1answer
98 views

How can I prevent against the HiddenWasp trojan? [closed]

As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world. Article from Intezer: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ So ...
1
vote
0answers
106 views

Disconnecting unwanted remote access

If someone is remotely connected to my single ARM board computer with Debian 32-bit OS, (example: thru hijacking the browser), which connects through a firewall on a separate Orange Pi board, and I ...
-2
votes
1answer
46 views

Security patch update [closed]

If applying the latest patch(example : CESA-2019:0679 - Libssh2 Security Update - CentOS 7 x86_64) will cover the previous patch changes or we need to do it separately?
1
vote
1answer
53 views

What is the package release process at CentOS

What's the process if a security patch is available for a package on CentOS? I'm waiting for bind-9.9.4-74 Since 5 days, there are this commit 'import bind-9.9.4-74.el7_6.1' on https://git.centos....
0
votes
0answers
67 views

How to set bluetooth security to none?

I am trying to connect my phone with my raspberry(headless) which runs on this OS. My requirement is,I do not have to enter "yes" manually in the bluez CLI application (which is started by the ...
0
votes
1answer
70 views

How to determine which modules are responsible for spectre_v2?

SERVER:~ # cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Mitigation: Full generic retpoline, IBPB, STIBP, RSB filling - vulnerable module loaded SERVER:~ # The question: But how to detect, ...
1
vote
1answer
87 views

Why ip_forward is disable by default? any side effect?

I need to forward an interface and I wonder why is disable by default? There is any security issue when I enable it? Is there any side effect when I enable it?
0
votes
1answer
83 views

Elasticsearch fails to start with 'permissions read' error even though read permissions exist

I have a symlink at /etc/elasticsearch/analysis that points to a mounted drive at /elasticdata/fileshare/analysis on Ubuntu 16.04 LTS Azure VM. When I try and start elasticsearch I am getting the ...
5
votes
0answers
244 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
1
vote
0answers
110 views

How to update libvirt to passthrough md-clear?

There are new 4 CVE CVE-2018-12130 CVE-2018-12126 CVE-2018-12127 CVE-2019-11091 Debian stretch kernel is vulnerable https://security-tracker.debian.org/tracker/CVE-2018-12130 Even if you get a ...
8
votes
2answers
750 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
0
votes
1answer
105 views

Install Alpine security updates only

Is there a way to install only security updates for Alpine Linux and its apk packages, skipping updates that don't fix security holes?
1
vote
2answers
145 views

Does using non-root user without password makes system more vulnerable?

Let's say somebody sitting under user (non-admin, not root), but he didn't set up any password for it, only superuser/root has password. Is it bad practice (in context of remote access to a desktop ...
0
votes
1answer
85 views

How can I unload a filesystem module in a RHEL 7 server in order to harden it?

I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs. I typed the following command: modprobe -n -v cramfs and I got the following answer: ...
0
votes
0answers
148 views

How can I properly use my fingerprint scanner?

I just bought a Thinkpad T430 and installed Linux Mint 19 on it. It's the first time ever I use Linux, so I'm kinda lost. I searched a bit and I found a way to make the built in fingerprint scanner ...
0
votes
0answers
19 views

How do I protect ports from visibility, using portsentry?

I've been given an assignment by my teacher, saying: "Edit the portsentry.conf. Protect a few ports from visibility outside local net". I've gone through the documentation in the config file, and ...
0
votes
0answers
32 views

Encrypted /boot without UEFI

I have only one, LUKS-encrypted, partition. Is it possible to boot system from /boot on this partition? I don't want to use UEFI to do this. EDIT I'm using GRUB. I have uncommented ...
-1
votes
1answer
63 views

hidden files and directories warnings

I received these rkhunter results; what are these files, and are they dangerous? [23:17:48] Checking for hidden files and directories [ Warning ] [23:17:48] Warning: Hidden file found: /etc/....
2
votes
2answers
558 views

How to ban all connections to .se and .ru in the hosts.deny file

I am trying to figure out, whether or not it's possible to make sure, that if a user uses a browser and types in a domain name that ends on either "se" or "ru", they will be denied access to that site....
0
votes
1answer
46 views

Ubuntu Security Patches for Apache2

How do i get the newest version on Ubuntu 18.04 (Longterm Version only!) for the apache2 package? (Please let me know if they apply the security patches from the newer versions backwards and i just ...
0
votes
1answer
185 views

Am I at risk? How to interpret debscan vulnerability output?

Today I came across a paragraph on how to Identify vulnerabilities debsecan was mentioned. I downloaded and executed debsecan and as a result I received a very long and shocking report. EDIT I ...
0
votes
1answer
38 views

Installing Vmware ESX on Solaris server

I have been told to install VMWare ESX on the Solaris server, but I could not find resources about this issue on the web, how is that possible?
1
vote
1answer
52 views

Synchronise passwords across devices with pass

I am looking for a simple, open-source password manager for linux with a CLI. It has to have a way of retrieving a password via the command line, so I can use it in several scripts (that sync my email ...
0
votes
1answer
18 views

Setting soft limit above hard does not fail in terms of exit code?

root@Andromeda:/# ulimit -n -S 2048 root@Andromeda:/# ulimit -n -H 2048 root@Andromeda:/# ulimit -n -S 4096 2048 root@Andromeda:/# echo $? 0 Failure to set soft limit above the hard one makes sense. ...
0
votes
1answer
153 views

How to handle Nginx and PHP ownership of log files?

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log ...
0
votes
0answers
208 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
2
votes
1answer
52 views

extracting security profile specific files RHEL CentOS

during the install of RHEL 7.x or CentOS one can choose (or not choose) to apply one of these security profiles these are from 7.6: United States Government Configuration Baseline Standard System ...
0
votes
1answer
53 views

Is plain text in index.html secure?

So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file. I ...
3
votes
1answer
65 views

What is Date_Spec in sudoers policy?

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec. User_Spec ::= User_List ...
3
votes
1answer
98 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
0
votes
0answers
44 views

Screenlock backdoors and how to close them

There is a warning in the Archlinux List of security applications. It says that of all possible screen-lockers, only four block tty access: sflock, physlock, Cinnamon Screensaver, MATE Screensaver and ...
0
votes
1answer
103 views

PackageKit logs a message about “only_trusted:0”

I ran pkcon update force. I noticed PackageKit is logging about only_trusted:0. That is, an operation where the only_trusted option is disabled. Even though I did not pass --allow-untrusted to ...
2
votes
1answer
29 views

How is find's {} substitution pattern vulnerable to injection attack? [duplicate]

I'm trying to understand more about this edit that was made to an answer of mine: https://unix.stackexchange.com/revisions/510388/5 How does running cd "{}" in the context of a find command ...
0
votes
0answers
96 views

show history of curl requests including executing user or program?

Little Snitch just told me that curl made a silent connection to tools.google.com. I'd like to know why. is there a way to get the history of commands on my system including who executed them?
1
vote
2answers
191 views

Understanding the audit log - file permissions and file content changed

I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well. I've got something in my audit but can't really tell what and how it ...
2
votes
1answer
33 views

rpm -V verify purpose

I am told I should do rpm -Va because: operating system must be configured so that the cryptographic hash of system files and commands matches vendor values... Without cryptographic integrity ...