Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

12
votes
1answer
2k views

How to enable random PIDs on Linux?

I'm currently comparing random PID implementation on OpenBSD, FreeBSD and Linux from security perspective. As long as OpenBSD and FreeBSD are concerned, my work is done. However, while the answer ...
12
votes
7answers
4k views

How do I encrypt git on my server?

Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring ...
12
votes
3answers
12k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
12
votes
1answer
2k views

Log every invocation of every SUID program?

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
12
votes
2answers
2k views

A consistent and safe approach to passwordless accounts with SSH

I must admit that I like servers without passwords in some cases. A typical server is vulnerable to anyone who has physical access to it. So in some cases it is practical to lock it physically and ...
12
votes
3answers
384 views

Prompt user on Linux security denial

Is it possible to make a Linux security module (eg. AppArmor, SELinux etc.) prompt the user, when an application wants to access classified files or folders (digital signatures, SSH keys, credit card ...
11
votes
5answers
9k views

Are there any GUI's for Linux that doesn't use X11?

Are there any GUI's for Linux that doesn't use X11? Since X has very poor security :O e.g.: Ubuntu, Fedora - what else are there? Goal: having a Desktop Environment without X. - what are the ...
11
votes
2answers
4k views

Is it dangerous to run echo without quotes?

I've seen couple of similar topics, but they are referring to not quoting variables, which I know could lead to unwanted results. I saw this code and was wondering would if it be possible to inject ...
11
votes
8answers
5k views

How to prevent a process from writing files

I want to run a command on Linux in a way that it cannot create or open any files to write. It should still be able to read files as normal (so an empty chroot is not an option), and still be able to ...
11
votes
4answers
30k views

File permission execute only

How can I set file to be executable only to other users but not readable/writable, the reason for this I'm executing something with my username but I don't want to give out the password. I tried : ...
11
votes
3answers
13k views

Write to a file without redirection?

I am writing a regular compiled application that needs to create a special file and write a magic cookie into it. I can’t write the file directly from the application, the system security model ...
11
votes
7answers
46k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
11
votes
3answers
20k views

Check outgoing network traffic

In Ubuntu, how can I check what information is being sent through the network connection, what programs are doing it, and what sites is my computer connecting to? I am not paranoid about security, ...
11
votes
5answers
7k views

Why is it recommended to create a group and user for some applications?

Most of the time, when installing a program from source it is recommended to create a new user and a new group and give /usr/local/<myapp> the recently created user and group ownership. Why is ...
11
votes
2answers
3k views

How do I hide/anonymise/defend a computer when on hostile networks?

I connect to a lot of open networks when I'm pootling around. I'm fairly careful to VPN home for anything important but that's not really my boggle. The laptop runs several services (nfs, dev http ...
11
votes
2answers
2k views

What encryption does vim -x use?

I read man vim, :h -x and :h encryption none of this actually says what algorithm it's encrypted with.
11
votes
2answers
3k views

Linux - display or upgrade security updates only using apt

is there a way to list or install security upgrades only using apt? if I list upgrades with: apt list --upgradable can I also see without knowing packages and libraries which upgrades are relevant ...
11
votes
3answers
4k views

What is most secure and simplest way to have a user-typed password on bash become part of stdin to a program?

I'm looking for the (1) most secure and (2) simplest way to have a user type a password on a bash shell prompt and to have that password become part of stdin to a program. This is what the stdin ...
11
votes
2answers
3k views

Automatic security updates on Debian squeeze server

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron ...
11
votes
5answers
4k views

how do I wipe a server that I don't have physical access to?

I have a Godaddy dedicated server that I would like to cancel. Before I do that I'd like to do a clean format on the server to make sure that the next person who gets the server isn't able to undelete ...
11
votes
2answers
10k views

Are environment variables visible to unprivileged users on Linux?

I'm trying to determine if, in Linux, environment variables for a process are observable by other (non-root) users. The immediate use case is putting secrets into environment variables. This is ...
11
votes
4answers
17k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
11
votes
2answers
5k views

How to recognize harmful AUR packages

How do I recognize if a package which is installed via yaourt on arch linux could be harmful to my pc? I read in the wiki that I should check every installation I make with yourt. But what exactly do ...
11
votes
2answers
11k views

How to check, which limit was exceeded? (Process terminated because of ulimit. )

Let's assume process runs in ulimited environment : ( ulimit ... -v ... -t ... -x 0 ... ./program ) Program is terminated. There might be many reasons : memory/time/file limit exceeded ; just ...
11
votes
5answers
3k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
11
votes
2answers
7k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
11
votes
1answer
2k views

How to mitigate Spectre and Meltdown kernel memory leaking CPU bug on OpenBSD?

Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign and Reading privileged memory with a side-channel In recent news people could read about a kernel memory leaking CPU ...
11
votes
0answers
6k views

OpenSSL Package Rebuild CentOS 6.4 [closed]

Rebuilding openssl with Elliptic Curves on CentOS 6.4 The strategy is: 1) Download the "official" CentOS source package (.src.rpm) 2) Modify the .spec file to enable elliptic curves. (change no-EC ...
10
votes
4answers
3k views

Sudoers for one day per week?

I have been volunteered by my boss to be the sysadmin for our production redhat server. He asked me to tighten the security to avoid mishaps like rm -f * that occured not long ago. Right now, we ...
10
votes
4answers
10k views

Debian: Which firewall?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there an easier way to install/configure a firewall?
10
votes
1answer
22k views

Is there a way to deactivate Buffer overflow protection on my machine?

I want to do some experiments with buffer overflows on my various virtual machines, including (but not limited to) Debian 6, Ubuntu 12.04, Fedora 16, but every time I try to execute the buffer ...
10
votes
3answers
4k views

Is it safe to close shell just by clicking “X” or using “ctrl+d”?

Is it safe to close shell just by clicking "X" or using "ctrl+d" while logged in as root with su or is it safer to close it by typing "exit"? Is there any difference (security-wise) at all or is it ...
10
votes
1answer
11k views

How to stop users from Switching to Root user

I have disabled the root user login from Sshd.conf file so now no one can login using root user even if they know the password SOMEHOW. Now I have 3 users in server ROOT,EMERG and ORACLE. I want to ...
10
votes
1answer
10k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
10
votes
1answer
13k views

How to get Oracle java 7 to work with setcap cap_net_bind_service+ep

I am trying to grant the java executable the right to open ports below 1024 on Linux. Here is the setup /home/test/java contains the Oracle Server JRE 7.0.25 CentOS 6.4 Here is what getcap returns ...
10
votes
2answers
16k views

How do you protect a plain text credentials file with the username and password?

I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass. [not recommended] put the ...
10
votes
2answers
2k views

I/O-overhead of dm-encrypted device?

What would be the Read-/Write-overhead when using dm-crypt (LUKS) as full disk-encryption (including root partition) on a Linux-Desktop (Ubuntu)? I plan to stack it like so: LUKS > LVM > ext4 The CPU ...
10
votes
1answer
320 views

Does ssh-agent store my passphrase?

Is it possible to determine the passphrases of private keys added to ssh-agent? I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
10
votes
2answers
899 views

How can I create a hard to kill process

I want to create a program that will be difficult to stop (even for the administrator) once it is started (with root privileges). Once started the process should continue to start itself at startup ...
10
votes
2answers
2k views

Blocking SSH Brute Force attacks on IPv6

I recently had to work with some servers that have an IPv6 connection and I was surprised to find out that fail2ban does not have IPv6 support, neither does denyhosts. Searching on google I found that ...
10
votes
2answers
1k views

ssh-agent: don't forward authentication for the whole keyring

I have two private ssh keys : one to access my personnal machines, one to access servers at my job. I add those two keys to my ssh-agent with ssh-add. Now, when I do ssh -A root@jobsrv I would ...
10
votes
1answer
5k views

Taking a picture with a laptop webcam after entering an incorrect password

I'd like to set up my laptop so that if a wrong password is entered when the screen is locked, a picture is taken using the laptop's webcam. I examined xlock (from xlockmore package), but there is no ...
10
votes
2answers
823 views

How do I prevent programs from sniffing keystrokes to su/gksu?

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways ...
9
votes
3answers
22k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
9
votes
2answers
1k views

What does “Do you expect to run the X Windows System?” do when installing OpenBSD?

When installing OpenBSD 5.1, I got the question: Do you expect to run the X Windows System? What change does the installer make to my system if I say "yes"? I know what X Windows is, but I don't ...
9
votes
2answers
1k views

What sets fs:[0x28] (stack canary)?

From this post it is shown that FS:[0x28] is a stack-canary. I'm generating that same code using GCC on this function, void foo () { char a[500] = {}; printf("%s", a); } Specifically, I'm ...
9
votes
2answers
969 views

How do I protect my system against the Off-path TCP exploit in Linux?

According to cve.mitre.org, the Linux kernel before 4.7 is vulnerable to “Off-path” TCP exploits Description net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine ...
9
votes
3answers
505 views

Physically break into box? (Memory & disk)

I have a VPS. I might be able to encrypt my partition but I havent tried. My VPS company I believe can reset my root password although the only SSH key I see is my own. With all my data I have it ...
9
votes
2answers
8k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
9
votes
9answers
22k views

How do I write a test for system login?

I've written a Python CGI script that invokes bash commands, and it needs to test for a successful login on the host. How do I write a test for that? For example, could I create a bash script that ...