Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
30
votes
8answers
10k views

Why is it risky to give sudo vim access to ordinary users?

I'd like to create a new user and give him sudo access. To be specific, I want him to use sudo vim and edit httpd.conf. I wrote this in sudoers: user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd....
30
votes
5answers
18k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I prefer things to be as POSIX compliant as possible, but Linux only is acceptable. Avoiding Bashisms is my only ...
29
votes
3answers
7k views

How do I securely extract an untrusted tar file?

I would like to be able to extract a tar file, such that all extracted files are placed under a certain prefix directory. Any attempt by the tar files to write to outside directories should cause the ...
29
votes
2answers
7k views

How to avoid escape sequence attacks in terminals?

Reading the details of CVE-2009-4487 (which is about the danger of escape sequences in log files) I am a bit surprised. To quote CVE-2009-4487: nginx 0.7.64 writes data to a log file without ...
28
votes
11answers
11k views

Erasing a Linux laptop

I have a laptop with Debian on it, and I am going to sell this laptop. Would it suffice to erase the Debian installation before selling it to completely clean up my laptop from my personal data, and ...
27
votes
5answers
36k views

Block Particular Command in Linux for Specific user

How to block command, let say mkdir for specific user ? What I did just created read-only function and store in users profile ~/.bashrc /bin/mkdir() { echo "mkdir command not allow for you" ...
27
votes
4answers
60k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
26
votes
7answers
4k views

Why no permissions like Android or iOS?

When I install a program like GIMP or LibreOffice on Linux I'm never asked about permissions. By installing a program on Ubuntu, am I explicitly giving that program full permission to read/write ...
26
votes
2answers
2k views

Security implications of running perl -ne '…' *

Apparently, running: perl -n -e 'some perl code' * Or find . ... -exec perl -n -e '...' {} + (same with -p instead of -n) Or perl -e 'some code using <>' * often found in one-liners ...
26
votes
3answers
6k views

How to detect and mitigate the Intel escalation of privilege vulnerability on a Linux system (CVE-2017-5689)?

According to the Intel security-center post dated May 1, 2017, there is a critical vulnerability on Intel processors which could allow an attacker to gain privilege (escalation of privilege) using AMT,...
26
votes
3answers
11k views

Why does the 'bin' user need a login shell?

During an audit of /var/log/auth.log on one of my public webservers, I found this: Jan 10 03:38:11 Bucksnort sshd[3571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=...
26
votes
1answer
1k views

What would be the best way to work around this glibc problem?

I administer a Gentoo Hardened box that uses file capabilities to eliminate most of the need for setuid-root binaries (e.g. /bin/ping has CAP_NET_RAW, etc). Infact, the only binary I have left is ...
25
votes
2answers
38k views

How to check which SSH keys are currently 'active'?

How might one check which .rsa, .pem, and other files are 'loaded' or 'active' by ssh-add? I just had this scare: $ scp -i /home/dotancohen/.ssh/dotancohen.pem someUser@1.2.3.4:~/files.tgz . Warning: ...
25
votes
3answers
3k views

How to safely insert USB stick/device to Linux computer?

When inserting a USB stick or device to computer, there is always the risk that the device is malicious, will act as an HID and potentially do some damage on the computer. How can I prevent this ...
25
votes
3answers
27k views

Can someone sniff NFS over internet?

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS. I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my ...
25
votes
3answers
23k views

rkhunter gives me a warning for “/usr/bin/lwp-request” - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...
24
votes
12answers
10k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
24
votes
2answers
39k views

How can you log every command typed

How can you log every command someone has entered into the shell? I'm asking on both the basis of protecting yourself if you are logged into someone else's server and something breaks, or if someone ...
24
votes
1answer
1k views

Can another program on X capture my root password while I type it in a virtual terminal?

Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account ...
23
votes
5answers
5k views

Does installing and using Wine open up your Linux platform to Windows viruses?

Just wondering if installing Wine might open up a fairly solid Linux desktop to the world of Windows viruses. Any confirmed reports about that? Would you then install a Windows antivirus product ...
23
votes
4answers
46k views

How can I track who SSH'es into my linux machine?

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-...
23
votes
2answers
47k views

Why does sshd requires an absolute path?

Why does sshd require an absolute path when restarting, e.g /usr/sbin/sshd rather than sshd Are there any security implications? P.S the error message: # sshd sshd re-exec requires execution with ...
22
votes
4answers
2k views

Is there any way attacker could use mkdir to compromise a system?

I'm setting up a restricted user account for user ricardo, a troublesome user on my system. I want to grant him the right to make directories using sudo, which he sometimes needs to do. I'm ...
22
votes
8answers
78k views

Hiding Password in Shell Scripts

How can I hide a password in shell scripts? There are a number of scripts that are accessing database. If we open the script others also aware the username and password. So if anyone knows how to hide ...
22
votes
3answers
69k views

How to “close” open ports?

A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1 Surprise, surprise, I have lots of active services listen to localhost: $ nmap 127.0.0.1 ...
22
votes
2answers
27k views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ca_cert="/usr/share/...
22
votes
2answers
12k views

How does ps know to hide passwords?

Witness: $ ps f PID TTY STAT TIME COMMAND 31509 pts/3 Ss 0:01 -bash 27266 pts/3 S+ 0:00 \_ mysql -uroot -p 25210 pts/10 Ss+ 0:00 /bin/bash 24444 pts/4 Ss 0:00 -...
22
votes
1answer
3k views

Why can I list other users processes without root permission?

Using ps -aux or top, I can list other users running processes, but I'm neither running as root nor making use of sudo, why?
22
votes
3answers
5k views

Securely delete files on btrfs filesystem

Sometimes, there's the need to delete a file in a filesystem, and make sure that the file is truly gone. A file that contains sensitive passwords, for example, should be throughly wiped from the disk. ...
22
votes
4answers
4k views

How can I limit ssh *remote* port forwarding?

I need to limit which ports can be remotely 'ssh -R' forwarded by an user. I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding ...
21
votes
3answers
2k views

Can other users view the arguments passed to a command?

If I invoke a command with arguments like so: bob@bob-pc:~$ command -arg1 -arg2 ...can other users view the arguments passed to the command?
21
votes
2answers
124k views

SSH key-based authentication: known_hosts vs authorized_keys

I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong… Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
21
votes
1answer
8k views

What makes systemd-nspawn still “unsuitable for secure container setups”?

This is stated in the man page for systemd-nspawn Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security ...
20
votes
3answers
6k views

What are the pros/cons of the various methods to block brute force SSH attacks?

There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example: DenyHosts Sshguard fail2ban What are the pros/cons of ...
20
votes
2answers
15k views

“No such file or directory” when generating a gpg key

I'm trying to generate a gpg key $ gpg --full-gen-key but eventurally I get an error gpg: agent_genkey failed: No such file or directory Key generation failed: No such file or directory I'm on ...
20
votes
3answers
18k views

Why is PATH reset in a sudo command? [duplicate]

After much frustrating head-brick-wall contact, I've discovered this: $ echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/steve/bin $ sudo bash # echo $PATH /usr/local/...
20
votes
3answers
4k views

Is it secure to leave a root shell running in detached screen session?

I'm curious about the security of leaving a root shell running inside a detached screen session. I typically never do this. Aside from the potential of my non-root user account being compromised (...
20
votes
3answers
7k views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
19
votes
2answers
4k views

Should I delete users' passwords once I set up public key authentication for SSH?

It's best to use public keys for SSH. So my sshd_config has PasswordAuthentication no. Some users never log in, e.g. a sftp user with shell /usr/sbin/nologin. Or a system account. So I can create ...
19
votes
2answers
4k views

Two root accounts, what to do?

I'm on Ubuntu 15.04 and today I've been reading an article about Linux security from this link. Everything went good until the part of UID 0 Account Only root should have the UID 0. Another ...
19
votes
8answers
3k views

Is there a shell that checks to make sure the code is signed?

I was messing around with PowerShell this week and discovered that you are required to Sign your scripts so that they can be run. Is there any similar secure functionality in Linux that relates to ...
19
votes
3answers
2k views

Why change default ssh port?

I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
19
votes
2answers
49k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
19
votes
1answer
10k views

Why is “nodev” in /etc/fstab so important? How can character devices be used for hacking?

I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous. If I have a USB stick with a bash executable that has setuid ...
19
votes
3answers
2k views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
19
votes
3answers
22k views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at net....
19
votes
1answer
5k views

How do I secure Linux systems against the BlueBorne remote attack?

The Armis Lab has discovered a new vector attack affecting all devices with Bluetooth enabled including Linux and IoT systems. BlueBorne attack on Linux Armis has disclosed two vulnerabilities ...
19
votes
2answers
14k views

Use wpa_supplicant without plain text passwords

I'm running gentoo on my laptop, and I'm currently using wpa_supplicant to handle wifi. My configuration works and I can connect, but it is required to type in the plain text password into the ...
19
votes
3answers
12k views

How should one set up full-disk encryption on OpenBSD?

Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux? I'm looking for full-disk encryption, as if someone were to steal my notebook they could ...