Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

198
votes
3answers
16k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
180
votes
8answers
134k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
157
votes
8answers
190k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
141
votes
9answers
18k views

The myths about malware in Unix / Linux

Is it possible for my Linux box to become infected with a malware? I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true? If so, ...
122
votes
2answers
20k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
119
votes
8answers
27k views

Which is the safest way to get root privileges: sudo, su or login?

I would like to have the root account in safety even if my unprivileged user is compromised. On Ubuntu you can only use sudo for "security reasons" by default. However I am not sure it is any safer ...
112
votes
2answers
9k views

Is Vim immune to copy-paste attack?

You should never paste from web to your terminal. Instead, you should paste to your text editor, check the command and then paste to the terminal. That's OK, but what if Vim is my text editor? Could ...
92
votes
3answers
20k views

How do I recover from the Heartbleed bug in OpenSSL?

CVE-2014-0160 a.k.a. Heartbleed is a vulnerability in OpenSSL. It looks scary. How do I determine whether I am affected? If I'm affected, what do I need to do? Apparently upgrading isn't enough.
87
votes
3answers
28k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
86
votes
3answers
376k views

SSH login with clear text password as a parameter? [duplicate]

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I won't have access to ...
84
votes
1answer
15k views

Chrome: DNS requests with random DNS names: malware?

Over the years (since 2005), I have seen logs of strange random DNS requests done, on the multiple DNS / BIND servers I have maintained. May 7 12:13:50 1.1.1.1 named[63742]: client 1.1.1.2#24123 (...
81
votes
5answers
36k views

Why is root login via SSH so bad that everyone advises to disable it?

Everybody on the Internet advises to disable root login via SSH as it is a bad practice and a security hole in the system, but nobody explains why it is so. What is so dangerous in enabling root ...
80
votes
8answers
204k views

How to create SHA512 password hashes on command line

In Linux I can create a SHA1 password hash using sha1pass mypassword. Is there a similar command line tool which lets me create sha512 hashes? Same question for Bcrypt and PBKDF2.
75
votes
2answers
23k views

“WannaCry” on Linux systems: How do you protect yourself?

According to a rapid7 article there are some vulnerable Samba versions allowing a remote code execution on Linux systems: While the WannaCry ransomworm impacted Windows systems and was easily ...
75
votes
5answers
85k views

What is the point of sshd “UseDNS” option?

I know what it does, but I don't know why. What attack(s) does it prevent? Is it relevant for all kind of authentication methods? (hostbased, password, publickey, keyboard-interactive ...)
74
votes
2answers
9k views

I accidentally typed my password into the login field, is it still secure?

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c. Should I take ...
73
votes
3answers
12k views

Server admin sent me a private key to use. Why?

I'm supposed to be accessing a server in order to link a company's staging and live servers into our deployment loop. An admin over on their side set up the two instances and then created a user on ...
73
votes
8answers
65k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
67
votes
3answers
5k views

How does curl protect a password from appearing in ps output?

I noticed some time ago that usernames and passwords given to curl as command line arguments don't appear in ps output (although of course they may appear in your bash history). They likewise don't ...
66
votes
18answers
15k views

Root access that can't change root password?

We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a ...
66
votes
7answers
271k views

How can I monitor all outgoing requests/connections from my machine?

My machine is a server so I want to ignore connections being made to my server (e.g. when someone visits my website). I want to see only connections/requests being made by my server to other places. ...
63
votes
6answers
9k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
63
votes
4answers
11k views

Is there any way to keep a command from being added to your history?

Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
58
votes
2answers
18k views

Is it safe to give out my SSH public key for work?

I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the .ssh/...
57
votes
4answers
109k views

Moving /var, /home to separate partition

I am attempting to move some folders (such as /var and /home) to a separate partition after reading this guide: 3.2.1 Choose an intelligent partition scheme I was able to move one folder ...
51
votes
1answer
45k views

Why are the first 1024 ports restricted to the root user only?

This is more idle curiosity than anything else. A friend of mine asked me 'which port range is it that only root can use under Linux?' I told him 0-1024 were restricted. Then he asked my why it was so ...
49
votes
2answers
181k views

Convert Amazon .pem key to Putty .ppk key Linux

I have generated and downloaded a private .pem key from AWS. However, to use Putty in order to connect to the virtual machine, I must have that key in .ppk format. The process of conversion is ...
47
votes
4answers
27k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
45
votes
10answers
27k views

How to trigger a system self destruct with a certain password is entered

How do I configure my system to destroy all personal data when a certain password is entered? The motivation behind this being NSA stuff. I imagine there being three primary usage cases. At login, ...
44
votes
3answers
24k views

How can I determine if someone's SSH key contains an empty passphrase?

Some of my Linux & FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers. We're concerned that some of these people use an unencrypted ...
43
votes
7answers
71k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
43
votes
5answers
39k views

Why there is no https transport for debian apt tool?

With all paranoia that has come with NSA revelations and everything, I'm wondering why debian package installation mechanism does not support HTTPS for its transport, let alone using it by default. I ...
43
votes
2answers
74k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
42
votes
2answers
51k views

How to identify a process which has no pid?

I have a process which listen to 2 ports : 45136/tcp and 37208/udp (actually I assume it is the same process). But netstat doesn't return any pid : netstat -antlp | grep 45136 tcp 0 0 0.0....
42
votes
3answers
161k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
40
votes
2answers
129k views

What user should apache and PHP be running as? What permissions should /var/www files have?

I just spun up an Ubuntu 11.10 box and then ran apt-get install apache2 php5 to install apache2 and PHP 5 on the box. Now it is functioning as a "web server" and it loads the "It Works!" page. Now I'm ...
37
votes
7answers
9k views

Is there a way to pass sensitive data in bash using a prompt, for any command?

Suppose that I were using sha1pass to generate a hash of some sensitive password on the command line. I can use sha1pass mysecret to generate a hash of mysecret but this has the disadvantage that ...
37
votes
1answer
6k views

How to create a darknet/Tor web site in Linux?

I have heard a lot about creating darknet sites lately. I also use the Tor browser frequently. The tor service is running in my Debian server at home, and it was installed with: sudo apt-get ...
37
votes
1answer
45k views

Is it okay to disable requiretty?

I'm trying to set up a deploy script using Capistrano At a step cap deploy:setup script is connecting to my server and trying to run commands that create directories. Then I see an error: msudo: ...
35
votes
5answers
23k views

How to test whether a Linux binary was compiled as position independent code?

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization (...
34
votes
7answers
38k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
34
votes
4answers
4k views

Why can't I execute shutdown when the permission is rwxr-xr-x?

I'm in /sbin and I see that shutdown has permissions rwxr-xr-x. Doesn't this mean that anyone can execute it?
33
votes
5answers
1k views

Execution of possibly harmful program on Linux

I'm writing a program that will test programs written by students. I'm afraid that I can't trust them and I need to make sure that it won't end up badly for the computer running it. I was thinking ...
32
votes
3answers
5k views

Why shouldn't someone use passwords in the command line?

Why do people fear writing passwords in the command line? The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
31
votes
7answers
11k views

My server is constantly being attacked [closed]

I am fairly new to the system administration world. I've been working on an application recently and when I check my application server logs, I constantly get various IP addresses trying to ssh into ...
31
votes
4answers
4k views

What happens when a non-root user sends signals to root user's process?

I'm wondering about the security of UNIX signals. SIGKILL will kill the process. So, what happens when a non root user's process sends a signal to a root user's process? Does the process still ...
31
votes
3answers
53k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
31
votes
3answers
4k views

Weird service with the name “Carbon” running everyday and occupy 100% CPU

For last few weeks, there has been weird activity in my Ubuntu test server. Please check the below screenshot from htop. Everyday this weird service (which seems like a cryptocurrency mining service) ...
30
votes
8answers
3k views

Can malware run by a user without admin or sudo privileges harm my system? [closed]

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing ...
30
votes
8answers
9k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd....