Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

17
votes
4answers
11k views

How to retrieve IP addresses of possible ssh attackers?

I've just cat /var/log/auth.log log and see, that there are many | grep "Failed password for" records. However, there are two possible record types - for valid / invalid user. It complicates my ...
17
votes
1answer
457 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
17
votes
3answers
1k views

What is OpenBSD's pledge in short?

Can someone please describe, for a non-programmer, but IT person, what is pledge? Ex.: there is a program, ex.: "xterm". How can pledge make it more secure? It pledge inside the programs code, or ...
17
votes
3answers
20k views

Running unsigned javaws code

For a KVM remote console I need to be able to run a jnlp file. When I run it I get: net.sourceforge.jnlp.LaunchException: Fatal: Initialization Error: Could not initialize application. at net....
17
votes
2answers
4k views

Does SELinux provide enough extra security to be worth the hassle of learning/setting it up?

I recently installed Fedora 14 on my home pc and have been working on setting up different server related features such as apache, mysql, ftp, vpn, ssh, etc. I ran extremely quickly in to a barrier ...
16
votes
10answers
2k views

Concern about logging in as root overrated?

For personal linux on my personal notebooks, I've usually set my environment to autologin as root even under X or lower runlevels. I've found my workflow is very pleasant and fast, without any ...
16
votes
8answers
15k views

What's the best way to format a HDD in Linux in order to leave no trace?

I'm running Debian and need a way to format the entire hdd in order to not leave any trace on it because I want to donate it to a friend. So what will be the best way in order to format it? If I ...
16
votes
4answers
242 views

What is Linux for SET FILE/ERASE_ON_DELETE?

In VMS one may tell the file system to write junk over the existing contents of a file when it is deleted. Here is the DCL command to identify the file for this kind of treatment: $ SET FILE/...
16
votes
4answers
634 views

What specific vulnerabilities am I creating by disabling the sudo password?

Here are some instructions on how to disable your sudo password. These carry the following warning If you disable the sudo password for your account, you will seriously compromise the security of ...
16
votes
4answers
9k views

How to detect and remove a Linux trojan?

I recently (re)stumbled upon this: Linux Trojan Goes Unnoticed For Almost A Year (Unreal IRCd) Yes, I know that adding some random PPA/software from an untrusted source is asking for trouble (or ...
16
votes
3answers
16k views

How come no core dump is create when an application has SUID set?

I setup my environment to create a core dump of everything that crashes, however when I run an program with SUID set on a different user than the executing user it doesn't create a core dump. Any idea'...
16
votes
2answers
2k views

Is it safe to use echo to pass sensitive data into chpasswd?

I am trying to mass set a few user account passwords using chpasswd. The passwords should be generated randomly and printed to stdout (I need to write them down or put them in a password store), and ...
16
votes
2answers
13k views

“No such file or directory” when generating a gpg key

I'm trying to generate a gpg key $ gpg --full-gen-key but eventurally I get an error gpg: agent_genkey failed: No such file or directory Key generation failed: No such file or directory I'm on ...
16
votes
3answers
7k views

What are benefits and downsides of unprivileged containers?

The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and ...
16
votes
8answers
9k views

When does the Puppy linux security model make sense?

I have just spent a few hours playing with Puppy linux, which has some very nice features, but there are some things about its approach to security (at least the default settings) that worry me: It ...
16
votes
5answers
2k views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...
16
votes
3answers
7k views

Can SSH passwords be sniffed out over Wi-Fi?

When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).
15
votes
5answers
20k views

How to Determine the IP Address of who logged into Root?

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.
15
votes
1answer
420 views

Why does ArchLinux keep some users/groups after package uninstallation?

I've noticed that after uninstalling the postgresql package in ArchLinux the postgres user and group are not removed automatically. The same is true for some other packages. Investigating this further,...
15
votes
2answers
7k views

Vulnerability demonstration on Ubuntu 9.04

For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the exploit/linux/local list in the Metasploit Framework, finding (among others) ...
15
votes
2answers
12k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
15
votes
2answers
866 views

Why aren't the Fedora GPG keys signed?

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https. For example the checksum ...
14
votes
4answers
4k views

Would globally aliasing the fork bomb prevent its execution?

If you were to globally set alias ':(){ :|:& };:'='echo fork bomb averted' would that be an effective security strategy to avoid the Bash fork bomb execution or would there still be a way to ...
14
votes
4answers
3k views

If the heap is zero-initialized for security, then why is the stack merely uninitialized?

On my Debian GNU/Linux 9 system, when a binary is executed, the stack is uninitialized but the heap is zero-initialized. Why? I assume that zero-initialization promotes security but, if for the ...
14
votes
6answers
2k views

Echo with obfuscation

I need to print some variables to the screen but I need to preferebly obfuscate the first few characters and I was wondering if there was an echo command in bash that can obfuscate the first ...
14
votes
4answers
4k views

Why do we need a firewall if no programs are running on your ports?

When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if ...
14
votes
4answers
34k views

What are the world writable directories by default?

In a standard Linux filesystem, which of these common directories are world-writable by default? /tmp /etc /var /proc /bin /boot /.... .... Why are they world-writable? Does that pose a ...
14
votes
6answers
2k views

Which linux distro's package repositories are secure and which are not?

Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure ...
14
votes
2answers
662 views

How can I be sure that a directory or file is actually deleted?

I know that most files, when deleted, aren't actually removed from the disk, and can be recovered later. How can I ensure that a directory I had deleted will actually be removed from the disk? Are ...
14
votes
2answers
5k views

Should you run automatic updates

I'm running production Centos web servers. I want to know what is best practice for running updates. Should I automate this with yum-cron or yum-updatesd? Or is there a danger of updates breaking ...
14
votes
2answers
859 views

What are the security issues and race conditions in using `find -exec`?

From the find man page: -exec command ; There are unavoidable security problems surrounding use of the -exec action; you should use the -execdir option instead. -execdir command {} + ...
13
votes
6answers
13k views

Why does Debian come without a firewall enabled by default?

I'm using Debian 9.1 with KDE and I'm wondering why it comes without a firewall installed and enabled by default? gufw is not even in DVD1's packages. Are people expected to connect to the Internet ...
13
votes
8answers
3k views

How can we limit the impact of ssh probes?

My webserver is constantly attacked by various IP addresses. They try five passwords and then change the IP address. I have done various lockdowns like using ssh-keys and not permitting passwords, ...
13
votes
6answers
1k views

Verfication of command binaries before execution

Are there any methods to check what you are actually executing from a bash script? Say your bash script is calling several commands (for example: tar, mail, scp, mysqldump) and you are willing to ...
13
votes
2answers
3k views

How can I automate gpg decryption which uses a passphrase while keeping it secret?

I am tasked with automating a gpg decryption using cron (or any Ubuntu Server compatible job scheduling tool). Since it has to be automated I used --passphrase but it ends up in the shell history so ...
13
votes
3answers
3k views

/usr/bin/env as a shebang - and its security implication [duplicate]

I have seen advice in several places to use the following shebang line #!/usr/bin/env bash instead of #!/usr/bin/bash My knee-jerk reaction is, "what if somebody substitutes this executable for ...
13
votes
1answer
7k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
13
votes
4answers
737 views

Books/Guides for Securing a Server [closed]

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). I'm pretty broke so I can'...
13
votes
2answers
3k views

How to safely pass variables to root-enabled scripts?

This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
13
votes
5answers
2k views

Best way to do full disk encryption?

I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice ...
13
votes
1answer
406 views

Can entropy consumption at program start be prevented?

I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program ...
13
votes
5answers
997 views

How to tell if console login is genuine?

On Windows one can enforce pressing Ctrl+Alt+Del to fire an interrupt that brings up the login window. When logging onto a console of a Linux computer: How can I tell if this login is a real one or a ...
13
votes
3answers
17k views

How to make a folder private?

I'm using Ubuntu with several users and I want to make folders viewable just for a specific user. Any idea how to do it?
13
votes
2answers
33k views

how to know the type of symmetric encryption used by ssh?

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?. I have looked in /etc/...
13
votes
1answer
7k views

D-Bus authentication and authorization

I'm trying to set up remote access to D-Bus, and I don't understand how authentication and authorization are (not) working. I have a D-Bus server listening on an abstract socket. $ echo $...
13
votes
3answers
4k views

Is it wrong to link /dev/random to /dev/urandom on Linux?

I'm currently testing gpg --genkey on a Linux VM. Unfortunately, this software seems to rely on /dev/random to gather entropy and politely asks the user to manually type screens after screens of ...
12
votes
3answers
7k views

Is it a good practice to run a daemon under a non-root user account?

I've developed an application that uses NTP to change the network time, to sync two of my computers. It runs as root, since only the latter is allowed to change the time and date on Linux(I guess). ...
12
votes
4answers
2k views

How exactly do people “crack” Unix/Linux Systems?

No im not looking to become a cracker or something like that, but Im trying to figure out the process (more from a programming perspective). So im assuming (guessing) a cracker's main goal is to gain ...
12
votes
1answer
4k views

root owned program with setuid bit on

Ping is a a program owned by root with the user id bit set. $ ls -l `which ping` -rwsr-xr-x 1 root root 35752 Nov 4 2011 /bin/ping As I understand it, if a user runs the ping process, then the ...
12
votes
5answers
2k views

Good practice to use same SSH keypair on multiple machines?

I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...