Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

5
votes
0answers
184 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
4
votes
0answers
45 views

Linux security policy plugins

The man page for sudoers(5) on Linux, says: NAME sudoers — default sudo security policy plugin What other "security plugins" are available for Linux systems?
4
votes
0answers
98 views

What is the modern way to develop a Linux auditing kernel module?

I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports. I am aware of the things like ...
4
votes
0answers
739 views

Risk Assessment of SSH PermitUserEnvironment with ForceCommand

A dedicated server appliance accepts logins over ssh for one login account only which is authenticated using public keys only, and executes a command configured with ForceCommand. The login ...
4
votes
0answers
253 views

Permission denied, but why?

I am trying to back up the contents of my network hard drive called WD mybook live. It Internally, it is running Debian Squeezy on PPC. There are several users on this network hard drive: tony, user2, ...
4
votes
0answers
1k views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
4
votes
0answers
609 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
4
votes
0answers
2k views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user login,...
3
votes
0answers
210 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
3
votes
0answers
281 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
3
votes
0answers
111 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
0answers
456 views

SSHFS mount option default_permissions does not support ACL's - please explain

In regard to the FUSE GitHub page, I have some questions: Does the quote below mean SSHFS does support ACL's if default_permissions is not used? Does it mean that if one needs ACL support and proper ...
3
votes
0answers
77 views

Is there any utility that can drop me into a Intel ME Minix shell?

I see a lot of talk about Intel -3 ring mode running Minix. Is there any easy C program I can compile, or utility I can run that will drop me into a -3 ring mode Minix shell?
3
votes
0answers
672 views

Change GID of system groups (GID 100 - 105 to 200 - 205)

I have an Ubuntu server connected to a Microsoft Active Directory for Authentication with NIS/Unix extentions enabled. Every AD user therefore has an primary group ID (GID), which is 100 for IT staff ...
3
votes
0answers
471 views

What could 'unknown' user in the output of the `last` command mean?

Occasionally I will see an odd entry like this one in my last ouput: (unknown :0 :0 Tues Jul 4 06:51 - 06:51 (00:00) Afaik, this should not happen ever, and I cannot find ...
3
votes
0answers
874 views

How to login with both password and fingerprint?

How to configure PAM to require both password and fingerprint to log in? I can do a password / fingerprint login but not both by changing /etc/pam.d/common-auth For password only auth [success=...
3
votes
0answers
791 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
3
votes
0answers
679 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
3
votes
0answers
273 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I am stuck on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting kernel I ...
3
votes
0answers
681 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
3
votes
0answers
250 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the following:...
3
votes
0answers
158 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName 255.255....
2
votes
0answers
12 views

Why is StreamLocalBindUnlink disabled by default?

I want to enable GPG agent forwarding, and found that StreamLocalBindUnlink is disabled by default on sshd. Why is it disabled by default? Is there any security risk in enabling it? Since X11 ...
2
votes
0answers
102 views

How does the rsync symlink exploit work?

munge symlinks [...] The way rsync disables the use of symlinks is to prefix each one with the string "/rsyncd-munged/". This prevents the links from being used as long ...
2
votes
0answers
20 views

yum list-security no longer reports package as needing security update

We have an audit system that, daily, tracks packages in need of a security update using: yum list-security --security -q 2 For better or worse, some machines are not patched timely or missed, or are ...
2
votes
0answers
452 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
0answers
64 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
2
votes
0answers
207 views

pam_tally2 add an extra failed login

I am trying to use pam_tally2 in /etc/pam.d galaxy I change sshd to the following content #%PAM-1.0 auth required pam_securetty.so auth required pam_tally2.so deny=3 unlock_time=...
2
votes
0answers
108 views

kernel vulnerabilities

I recently got a single-board computer for which the official support has been discontinued. I'm using a minimal, debootstrapped Debian on that system with a kernel that is taken from one of the ...
2
votes
0answers
174 views

PAM: Sequences in Linux Login Password Being Flagged Unexpectedly

I am attempting to implement a password policy on Debian 8. I have the following in /etc/pam.d.common-passowrd: password requisite pam_cracklib.so difok=2 minlen=8 ...
2
votes
0answers
648 views

How to handle aggressive HTTP requests from the same IP?

My server has recently been suffering temporary floods of probing HTTP requests looking for PHPMyAdmin. They come from various IPs and come in series. That is, for a few seconds I'm getting a bunch of ...
2
votes
0answers
123 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
2
votes
0answers
123 views

How to hidepid on Arch Linux manually?

I have reinstalled Arch Linux to find that the package which used to be available called hidepid no longer exists, so I have to do this manually, but as I am still relatively new to Arch, I am not ...
2
votes
0answers
203 views

Security features disabled by DCO - how to unfreeze and restore?

I use a Samung 256 GB SDD Model MZ - 7TD2560/0L7 built Octobre 2013. WINMAGIC bootloader with WINDOWS 7 is installed on it. hdparm -I doesn't report any security features for that drive. hdparm --...
2
votes
0answers
485 views

hdparm doesn't show “security” section

I tried to find out the security settings of my Samung 256 GB SDD used on a Lenovo Thinkpad T430. However, sending "hdparm -I" provides the usual information but omits the "security" section ...
2
votes
0answers
63 views

Password requirement for all files with a specified extension

I'd like to be able to modify my OS so that that when I go to open any file that has the extension .zzzz (an arbitrary extension that I created a few files with, example: randomText.zzzz), I would be ...
2
votes
0answers
81 views

RHEL7 PAM Password Length based on UID

I'm trying to configure password policy based on different UIDs. So for example: - UID 1000-1999 would have Password minimum lenght of 15 - UID 2000-2999 would have Password minimum lenght of 20 ... ...
2
votes
0answers
445 views

Using AllowGroups And Restrict by ip address

i'm trying to manage access for ssh with AllowGroups, and it's working fine. Now i would like to restrict access to some groups only if they connect from a specific host, with AllowUsers it works like ...
2
votes
0answers
69 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
2
votes
0answers
41 views

Expired undeleteable certificates in gnome's “Passwords and keys”

Reposting from https://askubuntu.com/questions/847300/expired-undeleteable-certificates-in-gnomes-passwords-and-keys I just found that little app called "Passwords and keys" in gnome and see a lot of ...
2
votes
0answers
138 views

Git Server with several repos

I'm setting up a Git server, and there will be three different groups working on different projects iOS, WebDevel, Android. I need to do it in a secure/safe way. Meanwhile, I don't want iOS ...
2
votes
0answers
434 views

Encrypt directory on Linux

I need to create an encrypted directory (to be then filled with files and subdirectories) in a Linux ext4 filesystem, accessible to just one user. It should be: visible (just the root) from the non-...
2
votes
0answers
226 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
0answers
169 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
2
votes
0answers
200 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (...
2
votes
0answers
57 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
2
votes
0answers
100 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
0answers
48 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
2
votes
0answers
478 views

Security of sudo not asking for a password after the first time

After using sudo and entering a password to do so, sudo remembers that we have entered a password and we do not have to enter a password the next time we use it. I am concerned about the possibility ...
2
votes
0answers
73 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...