Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

5
votes
0answers
700 views

Risk Assessment of SSH PermitUserEnvironment with ForceCommand

A dedicated server appliance accepts logins over ssh for one login account only which is authenticated using public keys only, and executes a command configured with ForceCommand. The login ...
4
votes
0answers
44 views

Linux security policy plugins

The man page for sudoers(5) on Linux, says: NAME sudoers — default sudo security policy plugin What other "security plugins" are available for Linux systems?
4
votes
0answers
95 views

What is the modern way to develop a Linux auditing kernel module?

I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports. I am aware of the things like ...
4
votes
0answers
239 views

Permission denied, but why?

I am trying to back up the contents of my network hard drive called WD mybook live. It Internally, it is running Debian Squeezy on PPC. There are several users on this network hard drive: tony, user2, ...
4
votes
0answers
1k views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
4
votes
0answers
588 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
4
votes
0answers
2k views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user login,...
3
votes
0answers
136 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
3
votes
0answers
178 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
3
votes
0answers
72 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
0answers
73 views

Is there any utility that can drop me into a Intel ME Minix shell?

I see a lot of talk about Intel -3 ring mode running Minix. Is there any easy C program I can compile, or utility I can run that will drop me into a -3 ring mode Minix shell?
3
votes
0answers
617 views

Change GID of system groups (GID 100 - 105 to 200 - 205)

I have an Ubuntu server connected to a Microsoft Active Directory for Authentication with NIS/Unix extentions enabled. Every AD user therefore has an primary group ID (GID), which is 100 for IT staff ...
3
votes
0answers
449 views

What could 'unknown' user in the output of the `last` command mean?

Occasionally I will see an odd entry like this one in my last ouput: (unknown :0 :0 Tues Jul 4 06:51 - 06:51 (00:00) Afaik, this should not happen ever, and I cannot find ...
3
votes
0answers
119 views

How to hidepid on Arch Linux manually?

I have reinstalled Arch Linux to find that the package which used to be available called hidepid no longer exists, so I have to do this manually, but as I am still relatively new to Arch, I am not ...
3
votes
0answers
197 views

Security features disabled by DCO - how to unfreeze and restore?

I use a Samung 256 GB SDD Model MZ - 7TD2560/0L7 built Octobre 2013. WINMAGIC bootloader with WINDOWS 7 is installed on it. hdparm -I doesn't report any security features for that drive. hdparm --...
3
votes
0answers
63 views

Password requirement for all files with a specified extension

I'd like to be able to modify my OS so that that when I go to open any file that has the extension .zzzz (an arbitrary extension that I created a few files with, example: randomText.zzzz), I would be ...
3
votes
0answers
813 views

How to login with both password and fingerprint?

How to configure PAM to require both password and fingerprint to log in? I can do a password / fingerprint login but not both by changing /etc/pam.d/common-auth For password only auth [success=...
3
votes
0answers
68 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
3
votes
0answers
780 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
3
votes
0answers
672 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
3
votes
0answers
267 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I am stuck on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting kernel I ...
3
votes
0answers
651 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
3
votes
0answers
247 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the following:...
3
votes
0answers
154 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName 255.255....
2
votes
0answers
65 views

How does the rsync symlink exploit work?

munge symlinks [...] The way rsync disables the use of symlinks is to prefix each one with the string "/rsyncd-munged/". This prevents the links from being used as long ...
2
votes
0answers
15 views

yum list-security no longer reports package as needing security update

We have an audit system that, daily, tracks packages in need of a security update using: yum list-security --security -q 2 For better or worse, some machines are not patched timely or missed, or are ...
2
votes
0answers
303 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
0answers
52 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
2
votes
0answers
189 views

pam_tally2 add an extra failed login

I am trying to use pam_tally2 in /etc/pam.d galaxy I change sshd to the following content #%PAM-1.0 auth required pam_securetty.so auth required pam_tally2.so deny=3 unlock_time=...
2
votes
0answers
414 views

SSHFS mount option default_permissions does not support ACL's - please explain

In regard to the FUSE GitHub page, I have some questions: Does the quote below mean SSHFS does support ACL's if default_permissions is not used? Does it mean that if one needs ACL support and proper ...
2
votes
0answers
108 views

kernel vulnerabilities

I recently got a single-board computer for which the official support has been discontinued. I'm using a minimal, debootstrapped Debian on that system with a kernel that is taken from one of the ...
2
votes
0answers
166 views

PAM: Sequences in Linux Login Password Being Flagged Unexpectedly

I am attempting to implement a password policy on Debian 8. I have the following in /etc/pam.d.common-passowrd: password requisite pam_cracklib.so difok=2 minlen=8 ...
2
votes
0answers
642 views

How to handle aggressive HTTP requests from the same IP?

My server has recently been suffering temporary floods of probing HTTP requests looking for PHPMyAdmin. They come from various IPs and come in series. That is, for a few seconds I'm getting a bunch of ...
2
votes
0answers
121 views

What is machine-id?

Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
2
votes
0answers
451 views

hdparm doesn't show “security” section

I tried to find out the security settings of my Samung 256 GB SDD used on a Lenovo Thinkpad T430. However, sending "hdparm -I" provides the usual information but omits the "security" section ...
2
votes
0answers
78 views

RHEL7 PAM Password Length based on UID

I'm trying to configure password policy based on different UIDs. So for example: - UID 1000-1999 would have Password minimum lenght of 15 - UID 2000-2999 would have Password minimum lenght of 20 ... ...
2
votes
0answers
424 views

Using AllowGroups And Restrict by ip address

i'm trying to manage access for ssh with AllowGroups, and it's working fine. Now i would like to restrict access to some groups only if they connect from a specific host, with AllowUsers it works like ...
2
votes
0answers
41 views

Expired undeleteable certificates in gnome's “Passwords and keys”

Reposting from https://askubuntu.com/questions/847300/expired-undeleteable-certificates-in-gnomes-passwords-and-keys I just found that little app called "Passwords and keys" in gnome and see a lot of ...
2
votes
0answers
137 views

Git Server with several repos

I'm setting up a Git server, and there will be three different groups working on different projects iOS, WebDevel, Android. I need to do it in a secure/safe way. Meanwhile, I don't want iOS ...
2
votes
0answers
430 views

Encrypt directory on Linux

I need to create an encrypted directory (to be then filled with files and subdirectories) in a Linux ext4 filesystem, accessible to just one user. It should be: visible (just the root) from the non-...
2
votes
0answers
222 views

How to set Exim with TLS on a server with several domains?

I have a Debian Linux server with Exim. I want this server to use TLS when sending emails to supporting SMTP hosts, if a email is created by software on my server (for example with mail or sendmail ...
2
votes
0answers
168 views

What is the command erepc? Is this malware?

I noticed that my system was running slower than normal so I ran a top command. Hogging a ton of my CPU was a process called erepc that I can find no information on. PID USER PR NI VIRT ...
2
votes
0answers
199 views

SSH/web servers in Linux containers improve security?

Scenario: A 'gateway' machine functioning as a router and firewall, connecting a small LAN to the internet. The machine also runs a webserver (hosting a simple website) and an SSH server, providing (...
2
votes
0answers
55 views

Remote queue-like auditing service (“append-only pastebin”)

I am looking for an existing service / tool which would support the following in a UNIX-like shell environment: append-only writes, with writes guaranteed to be persistent for some well-specified ...
2
votes
0answers
97 views

Giving a user access to the webcam

I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam. I am using Debian, where the standard way to do this is to put ...
2
votes
0answers
47 views

How to trap spam sent from certain top-level domains?

I'm getting a lot of spam from eu TLD Maybe I could have put a rule set giving a score of say 2.5 or 3 for any mail originating from the .eu TLD; then this score + other factors could have made it ...
2
votes
0answers
458 views

Security of sudo not asking for a password after the first time

After using sudo and entering a password to do so, sudo remembers that we have entered a password and we do not have to enter a password the next time we use it. I am concerned about the possibility ...
2
votes
0answers
72 views

Unable to use wifi card after putting it into monitor mode

I'm trying to monitor 802.11 Reauthentication requests and responses made from the DS to the STA. The problem is when using airmon-ng to put the card into monitor mode, the interface is no longer ...
2
votes
0answers
118 views

Tails OS:Network Filtering Syntax to Allow I2PBrowser to listen at localhost:6666, Then Allow TorBrowser User to Connect to it

I've had a bit of experience in Linux, but I'm still learning and brand new. I've been able to proxy Tor right into I2P on a normal Debian Wheezy installation successfully. My process involves ...
2
votes
0answers
682 views

Persistent SSH port forward without public keys

Problem I haven't found a solution to run an SSH port forward in a reliable and persistent fashion, when the server you are connecting to does not support public-key authentication. Question What ...