Skip to main content

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
275 votes
4 answers
52k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
Stéphane Chazelas's user avatar
265 votes
11 answers
226k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
Michael Mrozek's user avatar
245 votes
8 answers
342k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
xenoterracide's user avatar
141 votes
9 answers
19k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
Stefan's user avatar
  • 25.3k
141 votes
8 answers
495k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
trusktr's user avatar
  • 4,165
134 votes
8 answers
38k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
stribika's user avatar
  • 5,454
125 votes
3 answers
649k views

SSH login with clear text password as a parameter? [duplicate]

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I won't have access to ...
mmla's user avatar
  • 1,377
124 votes
2 answers
21k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
Deer Hunter's user avatar
  • 1,866
121 votes
13 answers
373k views

How to create SHA512 password hashes on command line

In Linux I can create a SHA1 password hash using sha1pass mypassword. Is there a similar command line tool which lets me create sha512 hashes? Same question for Bcrypt and PBKDF2.
student's user avatar
  • 18.4k
114 votes
2 answers
10k views

Is Vim immune to copy-paste attack?

You should never paste from web to your terminal. Instead, you should paste to your text editor, check the command and then paste to the terminal. That's OK, but what if Vim is my text editor? Could ...
Adam Trhon's user avatar
  • 1,623
113 votes
3 answers
46k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
phunehehe's user avatar
  • 20.3k
113 votes
5 answers
55k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
rush's user avatar
  • 27.4k
105 votes
1 answer
44k views

Chrome: DNS requests with random DNS names: malware?

Over the years (since 2005), I have seen logs of strange random DNS requests done, on the multiple DNS / BIND servers I have maintained. May 7 12:13:50 1.1.1.1 named[63742]: client 1.1.1.2#24123 (...
Rui F Ribeiro's user avatar
103 votes
5 answers
128k views

What is the point of sshd “UseDNS” option?

I know what it does, but I don't know why. What attack(s) does it prevent? Is it relevant for all kind of authentication methods? (hostbased, password, publickey, keyboard-interactive ...)
user368507's user avatar
  • 2,173
103 votes
8 answers
114k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
Mark Amery's user avatar
  • 3,000
98 votes
2 answers
228k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
capdragon's user avatar
  • 1,187
94 votes
4 answers
27k views

Is there any way to keep a command from being added to your history?

Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
xenoterracide's user avatar
94 votes
3 answers
20k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
Gilles 'SO- stop being evil''s user avatar
80 votes
3 answers
12k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
hermancain's user avatar
  • 1,289
76 votes
3 answers
13k views

Server admin sent me a private key to use. Why?

I'm supposed to be accessing a server in order to link a company's staging and live servers into our deployment loop. An admin over on their side set up the two instances and then created a user on ...
Toby's user avatar
  • 783
74 votes
3 answers
9k views

How does curl protect a password from appearing in ps output?

I noticed some time ago that usernames and passwords given to curl as command line arguments don't appear in ps output (although of course they may appear in your bash history). They likewise don't ...
Wildcard's user avatar
  • 36.6k
72 votes
2 answers
24k views

"WannaCry" on Linux systems: How do you protect yourself?

According to a rapid7 article there are some vulnerable Samba versions allowing a remote code execution on Linux systems: While the WannaCry ransomworm impacted Windows systems and was easily ...
GAD3R's user avatar
  • 66.9k
70 votes
6 answers
19k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
Rohan's user avatar
  • 3,581
70 votes
2 answers
90k views

How to identify a process which has no pid?

I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid : netstat -antlp | grep 45136 tcp 0 0 0.0....
John Doe's user avatar
  • 1,011
70 votes
6 answers
46k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "[email protected]" set ...
user avatar
69 votes
9 answers
143k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
Steve V.'s user avatar
  • 945
69 votes
6 answers
159k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
toffee.beanns's user avatar
69 votes
1 answer
66k views

Why are the first 1024 ports restricted to the root user only?

This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
Andrew Lambert's user avatar
66 votes
18 answers
21k views

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a ...
244an's user avatar
  • 761
66 votes
6 answers
14k views

Is scp unsafe? Should it be replaced with sftp?

I have over 20 years experience in Un*x, and I have been using scp for immemorial times. scpis over SSH, therefore I consider it as secure as the latter. Now, in my company, where I recently took up a ...
Fabien Haddadi's user avatar
65 votes
2 answers
30k views

Is it safe to give out my SSH public key for work?

I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the .ssh/...
Naftuli Kay's user avatar
  • 39.8k
63 votes
5 answers
63k views

Why is there no https transport for debian apt tool?

With all the paranoia that came with NSA revelations, I'm wondering why the Debian package installation mechanism does not support HTTPS for its transport, let alone use one by default. I know Debian ...
zaadeh's user avatar
  • 1,183
61 votes
2 answers
101k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem [email protected]:~/files.tgz . Warning: ...
dotancohen's user avatar
  • 15.9k
60 votes
5 answers
65k views

How to test whether a Linux binary was compiled as position independent code?

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization (...
D.W.'s user avatar
  • 4,080
60 votes
2 answers
10k views

Suspicious crontab entry running 'xribfa4' every 15 minutes

I wanted to add something to my root crontab file on my Raspberry Pi, and found an entry that seems suspicious to me, searching for parts of it on Google turned up nothing. Crontab entry: */15 * * * ...
D__'s user avatar
  • 713
59 votes
2 answers
67k views

rkhunter gives me a warning for "/usr/bin/lwp-request" - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...
mYnDstrEAm's user avatar
  • 4,270
58 votes
8 answers
42k views

Is there a way to pass sensitive data in bash using a prompt, for any command?

Suppose that I were using sha1pass to generate a hash of some sensitive password on the command line. I can use sha1pass mysecret to generate a hash of mysecret but this has the disadvantage that ...
cemulate's user avatar
  • 841
58 votes
9 answers
99k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
Carles Sala's user avatar
  • 1,005
52 votes
4 answers
258k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
user avatar
51 votes
3 answers
200k views

Convert Amazon .pem key to Putty .ppk key Linux

I have generated and downloaded a private .pem key from AWS. However, to use Putty in order to connect to the virtual machine, I must have that key in .ppk format. The process of conversion is ...
Flame_Phoenix's user avatar
46 votes
10 answers
34k views

How to trigger a system self destruct with a certain password is entered

How do I configure my system to destroy all personal data when a certain password is entered? The motivation behind this being NSA stuff. I imagine there being three primary usage cases. At login, ...
Josh's user avatar
  • 579
45 votes
7 answers
63k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
User's user avatar
  • 2,317
45 votes
2 answers
62k views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ca_cert="/usr/share/...
Clément's user avatar
  • 602
45 votes
2 answers
102k views

Why does sshd requires an absolute path?

Why does sshd require an absolute path when restarting, e.g /usr/sbin/sshd rather than sshd Are there any security implications? P.S the error message: # sshd sshd re-exec requires execution with ...
daisy's user avatar
  • 54.6k
45 votes
2 answers
139k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!&...
cwd's user avatar
  • 45.4k
44 votes
15 answers
18k views

How can I speed up secure erasing of a disk?

I need to securely erase harddisks from time to time and have used a variety of tools to do this: cat /dev/zero > /dev/disk cat /dev/urandom > /dev/disk shred badblocks -w DBAN All of these ...
markgraf's user avatar
  • 2,860
44 votes
3 answers
26k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
Stefan Lasiewski's user avatar
41 votes
5 answers
25k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I prefer things to be as POSIX compliant as possible, but Linux only is acceptable. Avoiding Bashisms is my only ...
J. M. Becker's user avatar
  • 4,909
40 votes
5 answers
75k views

"No such file or directory" when generating a gpg key

I'm trying to generate a gpg key $ gpg --full-gen-key but eventurally I get an error gpg: agent_genkey failed: No such file or directory Key generation failed: No such file or directory I'm on ...
Meji's user avatar
  • 511
39 votes
8 answers
158k views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
arun's user avatar
  • 495

1
2 3 4 5
54