Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
4
votes
2answers
142 views

secure read-only self hosted git repository for scripts

I need to build a git server where certain users have a read-write access to the repository and management server running certain scripts using this repository has the read only access to the same ...
0
votes
0answers
50 views

Allow sudo su - only to one user

Allow sudo su - on visudo only to one or some users of a group that access by ldap For example, I have visually defined the following: % dev ALL = (ALL) ALL What I need is that only some users or ...
0
votes
0answers
54 views

System wide default-deny (process whitelisting) via AppArmor

I wanted a quick check to see if my understanding of AppArmor is correct. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run ...
0
votes
1answer
97 views

Firewall-like software for udev usb devices?

O.MG Cable is here and the way technology is going, more of those devices will be available to the common user. This kind of USB attack isn't new and there is plenty of devices out there ready to do ...
0
votes
1answer
315 views

Open file limits not increased for redis user despite change in /etc/security/limits.conf

I got ERR max number of clients reached from my redis server so I decidied to increase the allowed max client connections in its configuration. This also requires according to the documentation, ...
3
votes
1answer
228 views

how to find ssh key in audit log file?

i've created ssh key for connecting two host (client 192.168.4.107 and server 192.168.4.106). on client-machine i've run this command and ssh connection works: ssh-keygen ssh-copy-id -i /root/.ssh/...
-3
votes
1answer
35 views

Scientific Linux 7x - Too much system hardening!

Some Linux users like my company build Linux servers to use on factory production lines. We write software to load BIOS and FLASH memory and test our products. We constantly need to reboot these ...
-2
votes
1answer
205 views

How to reset entire system permissions back to default in Linux?

I found I've a kind of messed up most part of my system permissions. Some places that only owner should have access is now exposed to world. How can I reset the folder permissions to default like i ...
1
vote
1answer
50 views

Firewall software similar to Outpost for linux

I'm corrently using Windows for my machines with Outpost firewall(Agnitum), but want to switch for linux(not sure what disto yet) and would love to know from you what are my options with linux's ...
0
votes
1answer
31 views

MESSAGE=anthony … USER=root <— Does this mean that the root user is the actual user but “anthony” will be displayed as being the user anyway?

I found this in /run/log/journal/... MESSAGE=anthony : TTY=pts/10 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/find / -name *systemctI* I'm wondering what this means? I'm suspicious of this process "...
2
votes
0answers
22 views

yum list-security no longer reports package as needing security update

We have an audit system that, daily, tracks packages in need of a security update using: yum list-security --security -q 2 For better or worse, some machines are not patched timely or missed, or are ...
-1
votes
1answer
80 views

Protecting an email-proxy (Gmail) account being used by a Mail Transfer Agent (MTA)

On Debian LAMP with different PHP based CMSs I use the MTA sSMTP to send email via an email proxy (Gmail); the emails I send are only contact-form inputs transferred from any such CMS to my own email ...
0
votes
1answer
31 views

sudo - How insecure is it to modify caching time? [closed]

We can modify sudo caching time with the option: timestamp_timeout How insecure is that? I wanted to increase it to several hours (the time of my sessions)
0
votes
0answers
35 views

Securing an open FTP on FreeBSD for visitor wifi speed testing?

I'd like to add a really simple local FTP server to my FreeBSD system, to allow guests to do wifi speed testing. Because of the use, I don't need more than very basic functionality - anon R/W to a ...
1
vote
0answers
73 views

DPAPI / MacOS-style Keyring for Linux or BSD?

Windows and Mac both have a handy way to secure data using the users' login credentials. The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted ...
1
vote
1answer
49 views

How should I create a user that I can use to safely run web apps etc.?

I'm doing this over ssh. I want to create a user that: can't be accessed via ssh can be impersonated with su doesn't have a password (is this a good practice?) can run web apps (specifically ...
0
votes
0answers
320 views

The JNLP application is not fully signed

I am trying to run a .jnlp file using javaws. It produces this error: Caused by: net.sourceforge.jnlp.LaunchException: Fatal: Application Error: The JNLP application is not fully signed by a single ...
3
votes
1answer
87 views

sudo escalation password fails - /etc/shadow hash ok, group ok, /etc/sudoers ok

After system update/upgrade, I cannot escalate with sudo using correct password: user $ sudo -s [sudo] password for user: ******************** Sorry, try again. [sudo] password for user: *************...
1
vote
0answers
25 views

Freeze Linux when log is full

Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
4
votes
1answer
52 views

How do I simulate /proc/sys/kernel/grsecurity/deny_new_usb without grsecurity?

How do I flexibly enable and disable plugging in new USB devices (running driver code responsible for those devices) at runtime without Grsecurity patch? Are there other approaches or alternative ...
2
votes
0answers
79 views

Headless Server? [closed]

I am running Nessus on a closed network. My OS is Redhat 7.4. I have Bare Metal machines in my data center and Virtual Machines on AWS. When Nessus scans my Bare Metal machines, it correctly ...
0
votes
1answer
88 views

Should I go for Debian Stable or Testing? [closed]

I've been using Debian Stable for 1 year. I like Debian for their Privacy Policy, no telemetry and security. Now I need to reinstall my distro and I want to go for security distro. I don't know ...
0
votes
3answers
33 views

How to set the passphrase that different keys are discriminable

Can I change my phassword/-phrase('s settings) in a way that it's important which key of multpile ones (e. g. the left shift key instead of the right one) is chosen? Could I go a step further and ask ...
2
votes
0answers
92 views

How to check If my PC was exploited after apt exploit? [closed]

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 Is there a way to check if my PC got exploited/hacked/virused ?
0
votes
1answer
101 views

Is a php file with SGID bit and read-only & execute a security problem? [duplicate]

I find php files with SGID bit and read-only & execute. The group is root. Is this a problem? Because a user will need to run the php interpreter with their our account, could it led to privilege ...
2
votes
1answer
226 views

Encrypting a password using gpg without constantly asking for password

I have a service that checks my email regularly, and I use gpg to encrypt my email password. The problem is that every time I lock my computer or after a certain amount of time gpg shows a graphical ...
-3
votes
1answer
79 views

Are there any x86 security Linux distributions based on Ubuntu? [closed]

Are there any x86 security distributions like Kali Linux or better them based on Ubuntu?
1
vote
1answer
140 views

How to provide OAuth2 “Client ID” and “Client Secret” to an open-source bash script?

I was writing a bash script for Gmail that would authorize itself using OAuth2, and make API calls using the received tokens. It worked. But now I'm stuck on thinking how to securely store the Client ...
0
votes
1answer
91 views

rsync copy file without user and password less access

Explain below mention command we are not passing username as well password still we can do rsync. rsync -avz rsync.apache.org::apache-dist /path/to/mirror
1
vote
0answers
117 views

How to additional public keys to .secondary_trusted_keys?

I am trying to add additional keys to .secondary_trusted_keys. Documentation says, to do so the additional keys has to be signed by a key which is already a resident in either .builtin_trusted_keys or ...
2
votes
2answers
98 views

Why is /etc/sudoers not world-readable?

I'm struggling to think what security risks there could be to knowing who is allowed to use sudo.
3
votes
0answers
233 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
-1
votes
1answer
28 views

Install program in Wine and analyze traffic

I need to install a Windows program in Wine and I would like to analyze how reliable it is, that is, if it does not generate any connection that can transfer my information without realizing it. This ...
0
votes
1answer
71 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
0
votes
3answers
277 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
1
vote
1answer
22 views

How to know if Jenkins is patched on CentOS 7

I've been using rpm -q --changelog package_name to check if a certain cve vulnerability has been patched on my system. However, when I'm doing the same for jenkins, all I got was Sat Apr 19 ...
1
vote
2answers
110 views

What is the reason FreeBSD jails don't get the entropy pool

I've noticed that the FreeBSD script that generates entropy, bails out if it finds it itself is running from within a jail. # uname -srm ## notice: install of mfsBSD (https://mfsbsd.vx.sk) FreeBSD ...
3
votes
0answers
319 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
0
votes
1answer
90 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...
0
votes
1answer
297 views

rkhunter found 7 possible rootkits

Today I installed Ubuntu 18.10 and ran rkhunter on it. At first it said that there are 4 possible rootkits, but after second check it detected 7. During checking there was everything green and ok, ...
3
votes
0answers
113 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
-2
votes
1answer
93 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
0
votes
1answer
170 views

Are packages on snapcraft inherently safe?

Are packages installed by snap from https://snapcraft.io inherently safe? I heard they are sandboxed. Does that mean they can't change my file system, read my files, etc.?
0
votes
1answer
258 views

pf not stopping bruteforce attempts

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I have read many articles on how to get pf to stop brute force attacks and am not having any luck. ...
0
votes
0answers
42 views

Order of scripts run before bash starts

I'm studying the scripts that run before a bash shell started by the user starts. As far as I understand, the order is: /home/username/.bashrc (modifiable by user) /etc/bashrc (modifiable by root) /...
3
votes
1answer
2k views

Is there a way to get security updates for wheezy after EOL

I know the best solution would be to upgrade the server after Debian wheezy has reached End Of LIfe in May 2018, but is there a way to continue running an old wheezy instance and get some minimal ...
2
votes
1answer
39 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
0
votes
1answer
122 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
1
vote
1answer
79 views

Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs

I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
0
votes
1answer
79 views

Running Tor service in the jail environment

I want to torify my FreeBSD old machine purposed to mainly darknet activities. Questions: Should I worry about these errors during creating jail? Warning: Some services already seem to be listening ...