Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
-3
votes
1answer
55 views

Can shell-scripting help secure a client-side email address?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
83
votes
10answers
216k views

How to create SHA512 password hashes on command line

In Linux I can create a SHA1 password hash using sha1pass mypassword. Is there a similar command line tool which lets me create sha512 hashes? Same question for Bcrypt and PBKDF2.
0
votes
1answer
51 views

Unauthorized access to cron

I was hacked this morning! Does anyone have an idea of what the entry of the crontab below might mean? 1st They created a dir structure .rsync/ ├── a │ ├── a │ ├── anacron │ ├── cron │ ├── ...
0
votes
0answers
7 views

How to setup an SELinux policy to allow only a specific context permission to 'execheap'

I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap. The SELinux troubleshooter suggests: You must ...
-4
votes
0answers
40 views

S.O.S - help with cyberbullying [closed]

A) Situation B) Questions SITUATION A couple of years ago got a problem with a gang. Since then I'm under cyber-bullying. They threatened me with death on several occasions. And ...
5
votes
4answers
4k views

How to run unattended-upgrades not daily but every few hours

By default unattended-upgrades runs with cron.daily, that is at most on a daily basis. This can be a lot of time for attackers. I'd like to run it every 4 hours, how can I do this?
1
vote
0answers
45 views

Why would reading a passphrase from STDIN be disallowed but not from a PTY or argument?

I have a program that receives a secret passphrase. The options I have are to type it in manually on the terminal or to provide it as a command line argument. This makes it hard to automate in a ...
0
votes
1answer
20 views

Visualisation for etc_security_lastlog

I am looking for an easy way to visualise data from etc_security_lastlog for reviewing inactive user IDs. "Inactive" users would be determined based on their time_last_login being old enough. How do I ...
206
votes
3answers
18k views

Security implications of forgetting to quote a variable in bash/POSIX shells

If you've been following unix.stackexchange.com for a while, you should hopefully know by now that leaving a variable unquoted in list context (as in echo $var) in Bourne/POSIX shells (zsh being the ...
-1
votes
1answer
41 views

Passing an executable command using USER environmental variable

Is it possible to pass some executable shell code by setting env USER=..some code... ./script.sh, given that the script itself either uses echo $USER or tmpdir=/var/tmp/log-$USER
3
votes
2answers
1k views

su-to-root fails when root user locked?

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account? Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic ...
7
votes
1answer
19k views

max no of tcp connections on a linux system

I know that /etc/security/limits.conf provides the persistent soft and hard limits for several values. However, in the relevant list there is no indication about imposed limits on: a) concurrent ...
1
vote
0answers
26 views

Why does rootless podman does not support overlfayfs mounts in non-ubuntu distributions?

In the rootless podman doc, it is stated that: Can not use overlayfs driver, but does support fuse-overlayfs Ubuntu supports non root overlay, but no other Linux distros do. So ...
1
vote
1answer
2k views

Temporarily deny all incoming trafic with firewalld

I'm searching for an equivalent to ufw default deny for firewalld; the idea is that after I log in through SSH to my fresh server, I want to block all incoming new connections so that I have time to ...
2
votes
1answer
2k views

Any better alternative to chroot on an OpenVZ VPS?

Are there any better alternative to chroot environment? I'm thinking about running nginx on a jailed environment. BTW, I'm on OpenVZ VPS, so modifying the Kernel is a no-no. (I think that prevents ...
6
votes
1answer
254 views

Running script line by line automatically yet being asked before each line from second line onwards

I work on a script of about 20 lines which I find myself testing time and again by copy-pasting and executing line by line. Instead of copying-pasting each line and hitting Enter to execute, I would ...
0
votes
0answers
312 views

Is minissdpd known to have been auditted for security, at a similar level to avahi-daemon?

Ubuntu have or had an effort, sometimes described as No Open Ports for the default install. Exemptions are made for the DHCP client (otherwise you break networking for everyone), and for Avahi. Of ...
6
votes
1answer
23k views

How do I list all sockets which are open to remote machines?

A vanilla ss -l lists (on my current machine) lots of open sockets, with various Netid types and many of which are only listening on localhost. How do I get a list of all and only those sockets ...
0
votes
2answers
32 views

Encrypt a disk without having to log in to enter the password

I am using eCryptfs to encrypt the home directory and would like to access files without having the user log in. The program pam_mount will automount encrypted file systems, but it seems like that ...
2
votes
3answers
3k views

Cannot rename resolv.conf file as root

I am trying to activate NordVPN CyberSec by completing the following instructions in Debian 9. I should be able to do the changes as root and with sudo like described for Ubuntu in the thread Should ...
2
votes
2answers
93 views

Is Linux as safe as I thought it would be?

I started learning and investing time in Linux because I liked the idea that it isn't as prone to viruses, hackers etc. Or at least that's what I read somewhere. In my testing I found myself ...
4
votes
0answers
503 views

SSHFS mount option default_permissions does not support ACLs - please explain

In regard to the FUSE GitHub page, I have some questions: Does the quote below mean SSHFS does support ACLs if default_permissions is not used? Does it mean that if one needs ACL support and proper ...
0
votes
1answer
34 views

Update Centos without upgrading kernel or OS

I tried to find answers to this issue but I am having a hard time to find the right keywords. So here is my issue. Dongled mini PC with some itchy software when it comes to patching the system. Is it ...
-1
votes
2answers
35 views

Limit User To Run Specific Commands

I have a user test1 that i want to limit it to only run specific commands. I found this solution and I tested it (logged in with test1 and ran some random commands. none of them worked but date) and ...
45
votes
7answers
76k views

How do I recursively shred an entire directory tree?

I have a directory tree that I would like to shred with the Linux 'shred' utility. Unfortunately, shred has no -R option for recursive shredding. How can I shred an entire directory tree ...
0
votes
1answer
39 views

OpenJDK 8 support period in Debian Stretch 9

According to the Debian releases page Stretch 9 has support until ~2022. What does this mean for the OpenJDK 8 package? How long will security updates be available for OpenJDK 8?
32
votes
4answers
56k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
0
votes
0answers
13 views

How to check the Integiry of the each PHP files in linux server using lighthttpd server?

I have a project requirement, Where I have to check the integrity of each PHP files before executing it using md5 or some method. The hash value is stored safely within the server. What I have done: ...
0
votes
0answers
16 views

Restrict Postfix From domains

I have a webhosting server based on ISPConfig (Debian 9.9 LAMP) and I'm new to Postfix. When users send an email from PHP, the default address is webmaster@thedomain.com. This address can be overriden,...
1
vote
1answer
38 views

How to prevent a snap package from accessing my home directory?

I want to use mathpix-snipping-tool snap package, but it has an extremely lousy privacy policy, in which the company says that they can collect whatever info they want, and the package has a home ...
2
votes
3answers
102 views

How to scan my computer's UDP ports

What command can I use to port scan UDP? I hear that UDP scanning has some specific issues, that do not apply to TCP scanning. I tried running sudo nmap -p0-65535 -sU 192.168.1.97. But it has been ...
0
votes
0answers
13 views

How to find out the user ID of the command/request sender when we use any IPC (Inter Process Communication) in PHP?

Currently, We use socket for Inter process communication between two process , the application is written in PHP. Our scenario is, there is a server (server.php) and multiple PHP clients. We want ...
0
votes
2answers
74 views

How insecure is it passing a password to curl via cat

I have a script which executes curl many times. I'd like to enter my password only once (so I don't want curl to ask for it on every execution). I don't want the password to appear in process list or ...
1
vote
1answer
31 views

SysRq doesn't display any result on terminal

I use Mint 19.2, and I try to see CPU backtrace by the following process. $ sudo -s # sysctl -w kernel.sysrq=1 # echo l > /proc/sysrq-trigger But, nothing happened. I researched more ...
0
votes
2answers
178 views

How can I install gufw on fedora?

I want to install gufw on my Fedora, but I do not know how to do that. I tried to install with the dnf package manager command but it doesn't work and gets this output: No match for argument: gufw ...
0
votes
0answers
29 views

Is encrypting HOME folder enough in linux?

I've been using Windows and Bitlocker for years. I recently decided to give linux a try because of the beautiful Deepin OS distro. Encrypting my device is a must for me and most of the tutorials I ...
2
votes
2answers
439 views

What is the advantage of .desktop files without executable bit set?

The freedesktop organization defines the standard for .desktop files. Unfortunately it defines not the permissions of the file (see freedesktop mailinglist) and software is distributed with a) ...
1
vote
0answers
25 views

Logwatch not sending email

I'm trying to send logs to my email. I'm doing this via SSH. I edited the file: /usr/share/logwatch/default.conf/logwatch.conf and edited these lines: Output = mail Format = html Encode = none ...
49
votes
3answers
184k views

Convert Amazon .pem key to Putty .ppk key Linux

I have generated and downloaded a private .pem key from AWS. However, to use Putty in order to connect to the virtual machine, I must have that key in .ppk format. The process of conversion is ...
1
vote
1answer
919 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting (say,...
3
votes
1answer
469 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
2
votes
1answer
45 views

Grub2 and password

I have an user account to log into grub, this works. Every time I boot the computer I am asked for my username and password to boot my operating system. How can I set grub so it only requests the ...
2
votes
0answers
34 views

AWS - Stack creation - How to assign an inline policy to adhoc user?

Background: With cross account role someaccountrole, I have access to aws account xyz. Case 1 To create a stack in account xyz, we upload the Cloudformation file through console. Amidst stack ...
1
vote
1answer
19 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
0
votes
0answers
12 views

AppArmor custom network access for all apps [duplicate]

I would like to create an AppArmor profile that has the following: Inbound network access is only available to a specific app: SSH Outbound network access is only available to a specific app: squid ...
0
votes
2answers
41 views

Ubuntu 16.04 VPS security - check whether installation of the OS is unaltered (clean)

I'd ordered a VPS with Ubuntu 16.04/64-bit LTS server edition with some ports opened, which are essential to my application. recently the VPS was delivered to me, so I accessed the VPS using ssh and ...
0
votes
2answers
34 views

Locking down image files in folders

I have a form which uploads a picture to an upload folder on my Gnu/Linux host. When the user registers, it creates a folder for them, in uploads, and puts their picture into it. I have disabled ...
0
votes
0answers
53 views

pam_tally2 not working as expected?

I have been using pam_tally2 to lock a user after certain number of failed attempts through ssh. In /etc/pam.d/common-auth added auth required pam_tally2.so deny=3 unlock_time=600 In /etc/pam.d/...
0
votes
1answer
888 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf I ...
2
votes
1answer
38 views

How to check who has been looking at your files in Linux computing cluster

I work at an office with other people on data analysis, from which only one of them has root permissions to our shared computing cluster. Some have a suspicion that the person with root permissions is ...