Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

9
votes
3answers
12k views

How to fix vulnerabilities related to Spectre and Meltdown bugs in Ubuntu? [duplicate]

I just learned about Meltdown and Spectre bugs. I read that: There are patches against Meltdown for Linux (KPTI (formerly KAISER)), Windows, and OS X. Following the link in the quote I get to an ...
9
votes
2answers
246 views

Why is the ability to define functions in an environmental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
9
votes
1answer
367 views

Why does the location of environment variables vary that much?

Reading the book Hacking: The Art of Exploitation by Jon Erickson, I am trying to approximate the address of an environment variable SHELLCODE to exploit a program. Every time I run getenv("...
9
votes
1answer
40k views

How to check if port forwarding is enabled?

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled. The thing that is not clear to me is this: should I ...
9
votes
3answers
4k views

How can I set that only root + a given user can shut down my pc?

If I'm using Ubuntu 11.04, how can I configure it such that that only two users can shut down/suspend/hibernate my PC: the root user and one regular user?
9
votes
1answer
1k views

“ALL ALL=(ALL) NOPASSWD:ALL” was auto added in my /etc/sudoers file. Is this a Security Breach?

ALL ALL=(ALL) NOPASSWD:ALL line was auto added twice at the end of my /etc/sudoers file. My linux suddenly stopped asking for a password every time I ran a sudo command. This made me investigate the ...
9
votes
3answers
9k views

kernel: disabling /dev/kmem and /dev/mem

I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
9
votes
2answers
4k views

LXC containers as a sandbox environment

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils ...
9
votes
1answer
421 views

Encrypted Booting

I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition. [ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup ...
9
votes
1answer
6k views

GNOME-keyring KWallet integration?

I use some GNOME apps, and some KDE apps, so some of them use G-keyring and some KWallet... What I would like to have is a single place for managing passwords. Is there a way to integrate G-keyring ...
9
votes
2answers
3k views

Can KWallet manage my ssh passwords?

I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill ...
9
votes
1answer
461 views

Is there a technical reason why ssh-agent lacks a sudo-like inactivity/idle timeout feature?

There are some brief discussions about the existing ssh-agent -t feature at [1], and there was a post as far back as 2001 on debian-devel [2] wishing for an inactivity timeout feature. There's a ...
9
votes
1answer
755 views

Is locking the screen safe?

See USB driver bug exposed as "Linux plug&pwn", or this link Two choices [GNOME, Fedora 14]: Use the gnome-screensaver Use the "switch user" function [gnome menu -> log out -> switch user] So ...
8
votes
7answers
2k views

Is there a way to store Firefox passwords in a local encrypted database in Linux?

I want Firefox to "remember" my passwords so I don't have to type them in; unfortunately, the built-in password manager stores them in plain text, which is too high a security risk. I'd like to find a ...
8
votes
3answers
761 views

Trap: can't su as root, can't change group to wheel, ssh as root prohibited

Is this a trap? I made these steps in FreeBSD 10: 1) ssh as root prohibited 2) logged as user 3) su as root 4) as root chsh changed name of user "user" to "luser" 5) exit from ...
8
votes
2answers
65k views

What is sport and dport?

I want to stop internet on my system using iptables so what should I do? iptables -A INPUT -p tcp --sport 80 -j DROP or iptables -A INPUT -p tcp --dport 80 -j DROP ?
8
votes
3answers
1k views

Why is konsole reading /etc/passwd?

In relation to this question: While observing the behavior of fatrace, I notice something which concerns me. Here are the first few lines of output of the command "fatrace|grep konsole" konsole(...
8
votes
8answers
61k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
8
votes
6answers
1k views

Allow regular users to SSH using a private key they cannot read

Let's say I have a set of machines (called here the customers' machines) that only a small list of people (called the support staff) is allowed to SSH into, using only one account by machine (the ...
8
votes
3answers
2k views

How can I safely ensure a variable contains only a valid filename?

Given the script below, how can I ensure that the argument only contains a valid filename within /home/charlesingalls/ and not a path (../home/carolineingalls/) or wildcard, etc? I only want the ...
8
votes
2answers
661 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
8
votes
3answers
6k views

Have I been hacked?

I run a dedicated server, where I noticed a high CPU usage recently, and checked the processes. It appears someone (mick account) was mining on my server. How is this possible? The process is below. I ...
8
votes
1answer
2k views

Is /dev/random data a psuedo-random AES cypher, and where does the entropy come from?

My current understanding of an entropy pool is that it gathers truly random bits of data at a slow rate. I'd like to know how Unix & Linux collect entropy, and how that entropy is used by /dev/...
8
votes
4answers
4k views

How to best encrypt and decrypt a directory via the command line or script?

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line. Ideally, ...
8
votes
4answers
5k views

Flash plugin of debian vulnerable?

I run Debian wheezy with Iceweasel as browser and have installed the Flash plugin similar to this description. Today I read that not only Flash on Windows and Mac also Adobe Flash Player 11.2.202.350 ...
8
votes
5answers
2k views

Securing a Debian installation for general home usage

Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, telnet,...
8
votes
2answers
4k views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
8
votes
1answer
1k views

How does the kernel prevent a malicious program from reading all of physical RAM?

If I write a program that tries to read memory at every possible address, and I run it on a "full" Unix, it will not be able to access all of the physical RAM. But how does the operating system ...
8
votes
1answer
12k views

How to determine if computer has TPM (Trusted Platform Module) available

Wanting to play around with Trusted Platform Module stuff, I installed TrouSerS and tried to start tcsd, but I got this error: TCSD TDDL ERROR: Could not find a device to open! However, my kernel ...
8
votes
2answers
1k views

With which user should I run web servers, redis & mongodb?

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web ...
8
votes
1answer
10k views

yum install http - is this safe?

I am not very familiar with using yum to install packages. In a previous life I used apt. Currently, I am looking at some instructions to run # yum install http://example.com/package.rpm which ...
8
votes
2answers
6k views

Is accepting RELATED,ESTABLISHED for all sources in iptables considered “too open”?

I've often seen the rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT applied. Whilst I'm not an expert, that particular line concerns me. It's pretty obvious that the rule allows all ...
8
votes
4answers
6k views

Dirty COW exploit CVE-2016-5195

This morning we discover this exploit CVE-2016-5195 How do we patch CentOS kernel? is there any patch available? http://www.cyberciti.biz/faq/dirtycow-linux-cve-2016-5195-kernel-local-privilege-...
8
votes
2answers
10k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
8
votes
1answer
2k views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
8
votes
2answers
324 views

Lock some accounts during some time periods

Is it possible to lock some accounts in order to be accessible only during specific time periods? For instance the account joe should only be accessible during office hours.
8
votes
3answers
4k views

BCRYPT - Why doesn't the Linux Distributions use it by default?

Does OpenBSD use bcrypt by default? Why doesn't every modern Linux Distribution use BCRYPT? http://codahale.com/how-to-safely-store-a-password/ https://secure.wikimedia.org/wikipedia/en/wiki/Bcrypt ...
8
votes
1answer
514 views

Some basic questions about Linux kernel's security [closed]

I don't know much about Linux kernel, and I have some questions. What is the main purpose of separating kernel memory from user-space memory? To make sure that a user application cannot do anything ...
8
votes
2answers
191 views

Signing/Checksumming the kernel to prevent/detect manipulation

All my partitions are encrypted (/ and /home), but the /boot partition has to remain unencrypted and is open for manipulation. I was thinking about hashing the kernel on bootup and checking the result ...
8
votes
4answers
2k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
8
votes
2answers
3k views

Hide processes from other users based on groups (under Linux)?

Is it possible to configure process hiding for certain user groups under a linux system? For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc. ...
8
votes
1answer
2k views

What is securityfs?

While I am studying, I saw security file system which is mounted on /sys/kernel/security . It seems like to operate similar to sysfs or proc file system. Security file system keeps data on memory not ...
8
votes
1answer
771 views

Exploit in bash script parameter possible?

I want to pass an e-mail address from a web form to a bash script. I'm using the following regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}/ Is this sufficient? Or could one embed an exploit? ...
8
votes
1answer
257 views

Can swap be encrypted per user?

The problem arises for a multiuser computer with encrypted swap, as to how to allow each user to hibernate and resume from hibernation without compromising the security of the other users. I'm ...
8
votes
1answer
404 views

How to use /etc/fbtab in OpenBSD to secure X11?

OpenBSD's man page afterboot(8) suggests: "You might wish to tighten up security more by editing /etc/fbtab as when installing X." How might one do this? What lines when added to /etc/fbtab would ...
8
votes
1answer
559 views

FreeBSD package repo - how to do manual signature verification?

I'm trying to verify a signature of a package on the FreeBSD package website wget http://pkg.freebsd.org/FreeBSD:11:amd64/latest/digests.txz tar xf digests.txz This gives three files: digests, ...
7
votes
5answers
8k views

Protect folder from sudoers

Is there an ability to not allow sudoers view your folder (only you and root can access folder)?
7
votes
3answers
734 views

Is w command safe for users?

Some applications allow to pass password as an argument. For example: mysql --user=user_name --password=your_password db_name Is it safe? Besides the fact that typed password would be saved in bash ...
7
votes
4answers
31k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
7
votes
1answer
31k views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...