Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

353 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
1answer
602 views

FreeBSD package repo - how to do manual signature verification?

I'm trying to verify a signature of a package on the FreeBSD package website wget http://pkg.freebsd.org/FreeBSD:11:amd64/latest/digests.txz tar xf digests.txz This gives three files: digests, ...
8
votes
1answer
2k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
5
votes
0answers
267 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
5
votes
1answer
54 views

Need More Information About KDE Job Notification

I installed Debian 7.2 on a new laptop a couple of days ago, and now I'm getting a strange job notification every once in a while. It just says the following: Source: https://some.important.web.site....
5
votes
1answer
346 views

Why Nmap fragmented scan on Linux is only working from virtual environment?

OLD QUESTION AND TITLE (Look further down for the updated question): Why Nmap fragmented scan is only working on Backtrack? I spent quite a few hours today trying to capture and study some ...
4
votes
0answers
49 views

Linux security policy plugins

The man page for sudoers(5) on Linux, says: NAME sudoers — default sudo security policy plugin What other "security plugins" are available for Linux systems?
4
votes
0answers
516 views

SSHFS mount option default_permissions does not support ACLs - please explain

In regard to the FUSE GitHub page, I have some questions: Does the quote below mean SSHFS does support ACLs if default_permissions is not used? Does it mean that if one needs ACL support and proper ...
4
votes
0answers
105 views

What is the modern way to develop a Linux auditing kernel module?

I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports. I am aware of the things like ...
4
votes
0answers
811 views

Risk Assessment of SSH PermitUserEnvironment with ForceCommand

A dedicated server appliance accepts logins over ssh for one login account only which is authenticated using public keys only, and executes a command configured with ForceCommand. The login ...
4
votes
0answers
275 views

Permission denied, but why?

I am trying to back up the contents of my network hard drive called WD mybook live. It Internally, it is running Debian Squeezy on PPC. There are several users on this network hard drive: tony, user2, ...
4
votes
1answer
198 views

Are devices with kernels below 3.6 vulnerable to CVE-2016-5696?

Today I was reading about the potential impact of CVE-2016-5696 in Android phones running Linux 3.6+ and though my phone has 3.4 I checked the value of net.ipv4.tcp_challenge_ack_limit and it is also ...
4
votes
1answer
505 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
4
votes
1answer
121 views

Protecting process's envvars from exposure

From I've read about current best practices for developing web applications (such as the Twelve Factor guide), the recommended approach for storing configuration data is within environment variables. ...
4
votes
0answers
1k views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
4
votes
3answers
479 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
4
votes
1answer
55 views

Yum security model OR Why can a hostile proxy deny updates without a warning?

A friend of mine just had the strangest kind of problem where his Fedora 20 would not update to (or even find) the current kernel 3.16.3 (and incidentally also not update the vulnerable bash version). ...
4
votes
0answers
627 views

Security of Fedora third party repo RPMFusion

Due to the nature of Fedora licensing, it does not come with many propeitary software like adobe, flash, and codecs. So many Fedora users resort to using RPMFusion. My question is how safe is ...
4
votes
1answer
204 views

Tomoyo Linux: Have a private folder, that can't be read by default

Is it possible to specify folders, eg: /home/$user/private that can not be listed, read or written to by any application in the default profile 0, but only with programs where I specify this as rule?...
4
votes
0answers
2k views

Security of xhost (local) and sudo xauthority forwarding

Context: launch a GUI application as a linux service. I considered making a headless daemon with a GUI front-end but there is too much code involved to do it now. This service must start on user login,...
3
votes
1answer
101 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
3
votes
0answers
181 views

How does the rsync symlink exploit work?

munge symlinks [...] The way rsync disables the use of symlinks is to prefix each one with the string "/rsyncd-munged/". This prevents the links from being used as long ...
3
votes
0answers
297 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
3
votes
0answers
395 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
3
votes
0answers
122 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
0answers
85 views

Is there any utility that can drop me into a Intel ME Minix shell?

I see a lot of talk about Intel -3 ring mode running Minix. Is there any easy C program I can compile, or utility I can run that will drop me into a -3 ring mode Minix shell?
3
votes
1answer
513 views

firewalld port still open after removing port and services

I have created a script to install and configured firewalld on Centos 7. Most of the rules have worked correctly, but the SSH port still shows as Open when running a nmap scan. I know this is not a ...
3
votes
0answers
774 views

Change GID of system groups (GID 100 - 105 to 200 - 205)

I have an Ubuntu server connected to a Microsoft Active Directory for Authentication with NIS/Unix extentions enabled. Every AD user therefore has an primary group ID (GID), which is 100 for IT staff ...
3
votes
0answers
508 views

What could 'unknown' user in the output of the `last` command mean?

Occasionally I will see an odd entry like this one in my last ouput: (unknown :0 :0 Tues Jul 4 06:51 - 06:51 (00:00) Afaik, this should not happen ever, and I cannot find ...
3
votes
1answer
667 views

SSD Encryption / dm-crypt

I have bought a Samsung 850 EVO 250GB yesterday and I am preparing to install Arch on it. But I have some questions before starting. My SSD supports encryption (ENCRYPTION SUPPORT: AES 256-bit ...
3
votes
3answers
184 views

How is it possible to know whether my computer has been infected by a Macro Virus?

Today, I have received a new doc. document and wanted to open it using LibreOffice (Version 5.1.6.2). The following Warning Message was displayed: "This document contains macros. Macros may contain ...
3
votes
0answers
940 views

How to login with both password and fingerprint?

How to configure PAM to require both password and fingerprint to log in? I can do a password / fingerprint login but not both by changing /etc/pam.d/common-auth For password only auth [success=...
3
votes
1answer
698 views

How come I can login to another person's session over vnc just by changing the port number?

I have a user account on a server administered by someone else. I don't have root access. The server is CentOS 7. I couldn't connect over vnc on the usual port I use, so I ssh'd into the server and ...
3
votes
1answer
130 views

Automated kernel recompilation on security patches?

I'm on Ubuntu 14.04 and really enjoy the fact that I get automatic kernel security updates. When a kernel security problem is patched, a new package will be shipped with the new version. My machine is ...
3
votes
1answer
469 views

How to import OTR key into Pidgin?

How can I import an existing OTR key (i.e. from another Pidgin instance) into Pidgin (here version 2.10.9) with installed pidgin-otr plugin? I tried just copying ~/.purple/otr.private_key and ~/....
3
votes
0answers
810 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
3
votes
0answers
706 views

Add disks to encrypted LVM partition

If I increase my current encrypted (dm-crypt)LVM partition by adding another disk to it, is the new disk also encrypted or do I need to setup dm-crypt on it as well?
3
votes
1answer
76 views

Can I make cross-computer sharing compatible with tinfoil-hat security (password managers, email, etc.)

Preface: I realize the following is asking for tinfoil-hat type security, but I'm really curious for answers to my questions -- not suggestions to enable two-factor logons on gmail, etc. and call it a ...
3
votes
0answers
282 views

Signing a module for prebuilt kernel

I am developing linux driver for my own PCI device. I am stuck on starting my module: [14941.205599] mymod321: module verification failed: signature and/or required key missing - tainting kernel I ...
3
votes
0answers
731 views

setting up nested X sessions with Xephyr properly (and securely)

I am trying to set up Xephyr properly and securely, so that I can run another (nested) instance of LXDE under a different user inside my primary LXDE session. I would like to use this nested session ...
3
votes
2answers
1k views

SC_ERR_NOT_SUPPORTED(225) with Suricata on CentOS 6.5

I have just installed installed Suricata 2.0.3 RELEASE on CentOS 6.5. I try running it with sudo suricata -c /etc/suricata/suricata.yaml -i eth0 and get the following warning <Warning> - [...
3
votes
1answer
601 views

Change password hashing to PBKDF2 on Debian-based OS

I'm looking for a way to change the hashing scheme on my Debian-based OS from sha512 to pbkdf2. Searching the internet hasn't helped much. The closest I've got is this question: Enable Blowfish-based ...
3
votes
0answers
256 views

How to use a separated user with GUI on OpenBSD?

A webbrowser is a GREAT attack vector since people use it to access the "dangerous" internet. Very bad things can come in through to the desktop. So in general for a desktop, we can do the following:...
3
votes
2answers
100 views

Securely viewing an encrypted file

I have a file that is gpg encrypted. I would like to view the content of the file, but leave no trace of the output. Lets say for example that the encrypted file has some passwords, and I don't want ...
3
votes
0answers
162 views

Why do I get a different RSA fingerprint when multihopping using ProxyCommand

I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems): Host gw1 HostName 255.255....
2
votes
0answers
46 views

AWS - Stack creation - How to assign an inline policy to adhoc user?

Background: With cross account role someaccountrole, I have access to aws account xyz. Case 1 To create a stack in account xyz, we upload the Cloudformation file through console. Amidst stack ...
2
votes
0answers
37 views

Why is StreamLocalBindUnlink disabled by default?

I want to enable GPG agent forwarding, and found that StreamLocalBindUnlink is disabled by default on sshd. Why is it disabled by default? Is there any security risk in enabling it? Since X11 ...
2
votes
1answer
30 views

yum list-security no longer reports package as needing security update

We have an audit system that, daily, tracks packages in need of a security update using: yum list-security --security -q 2 For better or worse, some machines are not patched timely or missed, or are ...
2
votes
1answer
290 views

Encrypting a password using gpg without constantly asking for password

I have a service that checks my email regularly, and I use gpg to encrypt my email password. The problem is that every time I lock my computer or after a certain amount of time gpg shows a graphical ...
2
votes
0answers
677 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
0answers
79 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...