Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
1
vote
1answer
67 views

Spectre V2 on Linux

I have a 64Bit PC Running Ubuntu. The processor (AMD E1-1200) did not receive microcode updates for Spectre protection. What is the best strategy to stay secure? How do you treat the problem?
2
votes
1answer
429 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
1
vote
4answers
72 views

Is it possible to check for DNS-leaks on unix server?

I run a Ubuntu server where I have a split tunnel for VPN. Which means I have a "normal" connection to the internet for most of my services but also a tunneled connection that only a few services use. ...
-1
votes
3answers
135 views

How to prevent “rm -rf ~” from being executed by mistake?

Is there any way to completely prevent this command from being executed, by mistake, in the terminal? I know that bash, for instance, has aliases. Is there a way to use them?
0
votes
1answer
37 views

Who have previously accessed a shared file?

I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, ...
0
votes
1answer
293 views

Update the glibc package Error

I was asked to fix the vulnerabilities for RHEL 7: GLIBC(RHSA-2018:3092). Based on the output given by Nessus. Remote package installed : glibc-2.17-222.el7 Should be : glibc-2.17-260....
2
votes
3answers
157 views

Security issues with “wget”

I was wondering if there are any vulnerabilities that I may face when using "wget" and its options. And specifically, I've used a benchmarking script to test the performance of my VPS. The command is ...
1
vote
2answers
100 views

Is it possible to hide an area of hard disk from root user?

Do linux kernel have a feature that can be used to hide an area of hard disk (e.g last 1GB of hard disk) from root user or at least make that area completely unwritable by any means?
0
votes
1answer
117 views

SSH IP access restriction using tcpwrappers is not working. (hosts.allow and hosts.deny not taken into account)

I am using sles-12 server and i am trying to restrict ssh access to my server to my pc alone. I have tried to use tcpwrappers and it's not working..!!. I am able to ssh to the server from any IP in my ...
0
votes
1answer
85 views

Is there a way to prevent root user from modifing kernel and boot loader?

Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel. Is there a way to prevent ...
0
votes
0answers
64 views

Permanently disable all networking in Tails OS?

I would like to use Tails OS to create a pseudo air-gapped system. The system has WiFi hardware still, but it is "unusable" in Tails due to lack of firmware. I would like to further ensure it remains ...
0
votes
0answers
311 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
1answer
221 views

Intel® SGX™ (Software Guard Extensions™) and Linux Mint 19 driver installation

As I have the 7th gen Intel CPU (i7-7700HQ) and in UEFI BIOS there is a possibility to Enable Intel® SGX™ (Software Guard Extensions™), I would like to do so. In order to do that, I am unsure, if I ...
1
vote
1answer
278 views

What happened to elfsign and elfverify?

In "Uninformed Research -- informative information for the uninformed." 2003 mentions a tool called elfsign and elfverify. This is a tool to checksum and sign an ELF binary. I can't find that tool in ...
3
votes
1answer
355 views

Security review: classifying ssh log-in attempts [closed]

I see my own ssh logins to an AWS EC2 Ubuntu Linux instance as Nov 18 07:32:21 ip-10-20-30-40 sshd[9487]: Accepted publickey for ubuntu from 15.26.37.48 port 46273 ssh2: RSA SHA256:e37A/...
0
votes
1answer
45 views

How to get a working clock on Debian 9? Clock is wrong by a couple minutes

How to get a working clock in Debian 9 with KDE? My clock is almost 10 minutes slow on multiple of my machines running Debian 9 with KDE and (re)setting the timezone via tzselect didn't work. (I ...
0
votes
1answer
27 views

Ubuntu 14.04 install “old lamp” stack for penetration testing

I am preparing WAF video for my team and I want to test a sample ubuntu server which will be my victim. I'd like to install "old version" of packages and deploy Wordpress on top of it and use some ...
0
votes
1answer
76 views

How to use sed to obfuscate an IPv6 address

I have the following sed command sed -i 'test.log' -e 's/\([0-9a-fA-F]\{1,4\}\:\)\{7,7\}[0-9a-fA-F]\{1,6\}/\1\w/g' The goal is to erase the last two blocks of the IPv6 address. However, this sed ...
2
votes
1answer
178 views

sedutils vs hpdarm for SED hard disks

According to my reading there are 2 known methods for using Self-Encrypting Drives (SED): hdparm https://www.pugetsystems.com/labs/articles/Introduction-to-Self-Encrypting-Drives-SED-557/ sedutils ...
0
votes
1answer
275 views

Can I lock down access to a TCP port in Linux

I'm trying to secure a single-node Elasticsearch machine. Basically, I want to put Elasticsearch behind a reverse proxy (nginx) and make sure that the only way any user or process can communicate with ...
1
vote
1answer
72 views

Why not allow all users to schedule jobs with crontabs? [closed]

By setting /etc/cron.allow and/or /etc/cron.deny it's possible to restrict what user is allowed to use crontabs to schedule a cron job to run as that user. At least at my office our SAs default to ...
6
votes
1answer
190 views

What is the purpose of extrausers?

Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /...
0
votes
1answer
69 views

How to add a new user and disable its root login? [closed]

A sysadmin may want to add a new user that will have no root access (nor sudo). I don't sell hosting services but I can bring this field as an example; an hosting company gives its customers the ...
7
votes
1answer
253 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
0
votes
1answer
828 views

airmon ng ls: cannot access '/sys/class/ieee80211/': No such file or directory

Im using ubuntu bionic (UBUNTU WSL) I can't use airmon-ng! It throws the following ls: cannot access '/sys/class/ieee80211/': No such file or directory I checked airmon-ng: ls: cannot access '/...
5
votes
2answers
505 views

How safe is SSH when used for tunneling?

Scenario: I want to connect from Client A to Client B using SSH/SFTP. I can not open ports on either client. To solve this issue, I got a cheap VPS to use as a relay server. On Client B I connect to ...
0
votes
2answers
100 views

Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?

The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
-1
votes
1answer
39 views

Is someone spying me through my webcam?

I executed the following command in terminal and got the output: Command: lsmod | grep uvcvideo Output: uvcvideo 86016 0 videobuf2_vmalloc 16384 1 uvcvideo ...
4
votes
1answer
14k views

max no of tcp connections on a linux system

I know that /etc/security/limits.conf provides the persistent soft and hard limits for several values. However, in the relevant list there is no indication about imposed limits on: a) concurrent ...
-1
votes
1answer
90 views

SSH and VNC security issue question

My Centos 7.5 server in the past few days got thousands of incoming SSH login attempts and today I couldn't log in to my VNC clients because it just said "Too many security failures". So would like to ...
2
votes
3answers
81 views

Is it safe to auto-login if the system is encrypted?

I'm running linux (specifically Debian 9) on my everyday-use laptop, where the disk with the system is encrypted, so whenever I boot it up, the password is required prior to entering the system. In ...
1
vote
1answer
316 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
1
vote
1answer
64 views

LUKS header modified? [closed]

When a LUKS password is sent to the LUKS header for decryption, can it be stolen by a hacker who modified the LUKS header? Suppose my boot partition is healthy.
2
votes
0answers
507 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
3
votes
1answer
159 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
1
vote
1answer
131 views

Is 'xhost local' (no colon) allowing malicious access?

I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly ...
0
votes
2answers
197 views

iptables allow everything, is it safe?

The os is Ubuntu Server 18 and I am running a web server on it. Is it safe to accept all traffic on all ports? iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT I tried ...
2
votes
1answer
38 views

The password of previously encrypted volume got changed by the Debian installer

I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community. Short version of the issue: ...
2
votes
0answers
68 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
4
votes
1answer
466 views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
5
votes
1answer
197 views

How to fill a device with zeros, without overwriting the bytes that are already zeros?

I have a USB flash drive usb 3, the reading speed is much more than the writing speed. Let's say that 99% of the flash memory is already full with zeros, and I would like to fill it with zeros until ...
3
votes
2answers
84 views

Avoid GRUB infection which would crack my encrypted linux

I have an unencrypted /boot partition with GRUB and an encrypted partition, where my Linux is located. An attacker, who wants to read my encrypted partition, could gain physical access to my computer ...
2
votes
1answer
40 views

How can I monitor, record and check about the ports on my LUbuntu having been scanned or connected to by other computers?

I have installed some servers on LUbuntu 18.04, such as postgresql server, mysql server, vino server, and I may have installed and run some servers without knowing it. I rarely intend them to be ...
1
vote
0answers
146 views

LUKS secure automated decryption

I have critical data, let's say machine learning code, GPG keys,... etc. I would like to create a workstation that will work somewhere else- in someone else's premises. I don't have concern that ...
3
votes
2answers
362 views

How to intercept temporary files created by a program? [duplicate]

TL;DR: I know a program creates and then deletes files in /tmp. How can I intercept them for examination ? Context: There's a particular .jar file, which I don't trust; for some reason its source ...
0
votes
2answers
77 views

Where to store proprietary code and executable scripts? [closed]

I have Python code that is run using a bash script. I want non-sudo users to be able to run it without making the Python code readable. What is the recommended pattern? Two ways I considered: Put ...
1
vote
1answer
412 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
2
votes
3answers
109 views

Are there any practical reasons for setting a maxlogins limit for users in limits.conf? What are the benefits?

Why should I set a maxlogins limit in /etc/security/limits.conf? In other words, are there any performance-related and security-related benefits to be gained? I have only three users on my machine, ...
0
votes
0answers
19 views

restricted shell for backup

I was thinking about creating some backup solution for my NAS. My idea is that I could set up a remote system with ssh access and backup tool (whichever I choose to use) would upload files there. All ...
19
votes
2answers
3k views

Should I delete users' passwords once I set up public key authentication for SSH?

It's best to use public keys for SSH. So my sshd_config has PasswordAuthentication no. Some users never log in, e.g. a sftp user with shell /usr/sbin/nologin. Or a system account. So I can create ...