Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Linux securities [on hold]

When I logged off, the message appeared regarding to kernel bugging. I don't know what is it. It might have been a bug in COMODO's anti-virus. Attached is a snapshot of it. Thank you very much. /home/...
0
votes
1answer
20 views

OpenJDK 8 support period in Debian Stretch 9

According to the Debian releases page Stretch 9 has support until ~2022. What does this mean for the OpenJDK 8 package? How long will security updates be available for OpenJDK 8?
0
votes
0answers
13 views

How to check the Integiry of the each PHP files in linux server using lighthttpd server?

I have a project requirement, Where I have to check the integrity of each PHP files before executing it using md5 or some method. The hash value is stored safely within the server. What I have done: ...
6
votes
1answer
243 views

Running script line by line automatically yet being asked before each line from second line onwards

I work on a script of about 20 lines which I find myself testing time and again by copy-pasting and executing line by line of. Instead of copying-pasting each line and hitting Enter to execute, I ...
0
votes
0answers
11 views

Restrict Postfix From domains

I have a webhosting server based on ISPConfig (Debian 9.9 LAMP) and I'm new to Postfix. When users send an email from PHP, the default address is webmaster@thedomain.com. This address can be overriden,...
1
vote
1answer
26 views

How to prevent a snap package from accessing my home directory?

I want to use mathpix-snipping-tool snap package, but it has an extremely lousy privacy policy, in which the company says that they can collect whatever info they want, and the package has a home ...
0
votes
0answers
12 views

How to find out the user ID of the command/request sender when we use any IPC (Inter Process Communication) in PHP?

Currently, We use socket for Inter process communication between two process , the application is written in PHP. Our scenario is, there is a server (server.php) and multiple PHP clients. We want ...
1
vote
1answer
16 views

SysRq doesn't display any result on terminal

I use Mint 19.2, and I try to see CPU backtrace by the following process. $ sudo -s # sysctl -w kernel.sysrq=1 # echo l > /proc/sysrq-trigger But, nothing happened. I researched more ...
0
votes
2answers
60 views

How insecure is it passing a password to curl via cat

I have a script which executes curl many times. I'd like to enter my password only once (so I don't want curl to ask for it on every execution). I don't want the password to appear in process list or ...
0
votes
0answers
27 views

Is encrypting HOME folder enough in linux?

I've been using Windows and Bitlocker for years. I recently decided to give linux a try because of the beautiful Deepin OS distro. Encrypting my device is a must for me and most of the tutorials I ...
1
vote
0answers
17 views

Logwatch not sending email

I'm trying to send logs to my email. I'm doing this via SSH. I edited the file: /usr/share/logwatch/default.conf/logwatch.conf and edited these lines: Output = mail Format = html Encode = none ...
2
votes
0answers
31 views

AWS - Stack creation - How to assign an inline policy to adhoc user?

Background: With cross account role someaccountrole, I have access to aws account xyz. Case 1 To create a stack in account xyz, we upload the Cloudformation file through console. Amidst stack ...
1
vote
1answer
16 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
2
votes
1answer
44 views

Grub2 and password

I have an user account to log into grub, this works. Every time I boot the computer I am asked for my username and password to boot my operating system. How can I set grub so it only requests the ...
0
votes
0answers
10 views

AppArmor custom network access for all apps [duplicate]

I would like to create an AppArmor profile that has the following: Inbound network access is only available to a specific app: SSH Outbound network access is only available to a specific app: squid ...
0
votes
2answers
41 views

Ubuntu 16.04 VPS security - check whether installation of the OS is unaltered (clean)

I'd ordered a VPS with Ubuntu 16.04/64-bit LTS server edition with some ports opened, which are essential to my application. recently the VPS was delivered to me, so I accessed the VPS using ssh and ...
0
votes
2answers
33 views

Locking down image files in folders

I have a form which uploads a picture to an upload folder on my Gnu/Linux host. When the user registers, it creates a folder for them, in uploads, and puts their picture into it. I have disabled ...
0
votes
0answers
40 views

pam_tally2 not working as expected?

I have been using pam_tally2 to lock a user after certain number of failed attempts through ssh. In /etc/pam.d/common-auth added auth required pam_tally2.so deny=3 unlock_time=600 In /etc/pam.d/...
0
votes
1answer
27 views

How can I deny all IPv6 ssh connection

I want to disable all ssh connection from both IPv4 and IPv6 except certain IPs. I can set /etc/hosts.deny to deny all IPv4 ssh connection: sshd: ALL How to apply to IPv6? I tried below, and fail: ...
0
votes
0answers
16 views

enabling check_signatures in GRUB

I'm trying to create a new image of GRUB which has an embedded public key file to validate all files loaded by GRUB. So I used the command grub-mkimage to manually create a new GRUB core image. grub-...
1
vote
0answers
9 views

Configure TLS cipher negotiation priority in Firefox/Thunderbird

Is it possible to configure TLS cipher negotiation priority in Firefox/Thunderbird by choosing the most secure which is available on both sides? Now the situation is that even if TLSv1.3 is available ...
2
votes
1answer
69 views

Delete the “locate” database in FreeBSD

After having established the locate command's database indexing file & directory names across my FreeBSD 12 system (as described in this related Question), I now regret doing so because of its ...
1
vote
0answers
24 views

Dump BIOS configuration

I have an old HP Z2100 plotter whose firmware and data is located on a now 12 years old laptop PATA disk and which I'd like to replace with a CF card before the disk inevitably dies. The computer in ...
-1
votes
1answer
78 views

What's the safest Linux OS? [closed]

If someone was trying to hack into my OS whereby they could put malicious code there, which Linux OS would best withstand this kind of attack? I know the router, firewall, switch, etc will play a ...
0
votes
1answer
65 views

Disable *** stack smashing detected ***: <unknown> terminated

I'm running Ubuntu 18.04 and a simple program such as: #include <stdio.h> int main(int ac, char *av[ac+1], char **env) { char arr[8]; printf("0x%x\n", av); scanf("%s", arr); ...
2
votes
1answer
38 views

How to check who has been looking at your files in Linux computing cluster

I work at an office with other people on data analysis, from which only one of them has root permissions to our shared computing cluster. Some have a suspicion that the person with root permissions is ...
0
votes
0answers
66 views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
0
votes
0answers
15 views

With netcat how to safely open an external port to the Internet

I have found the perfect solution to write scripts which send files across machines over the Internet using netcat. On the machine receiving files I do nc -l -p 1234 -k and then on the machines ...
0
votes
0answers
34 views

How pssh do the ssh activities without password

the follwing pssh command do a parallel as date pssh -i -H "master01 master02 master03 worker01 worker02" -l root -x '-q -o StrictHostKeyChecking=no -o GSSAPIAuthentication=no -o ...
1
vote
2answers
50 views

What is important to be careful about (for your security) when adding repositories (Keyring, Sources-list, etc)?

Hello this may seem very basic and general questions. (BUT) Many times when I install software adding new repositories is the way to go. I use to follow instructions I find on the internet just like ...
1
vote
1answer
32 views

Security implications of SSH Port Forwarding/Tunneling

I need help understanding the security implications of having an outgoing ssh tunnel in my system (what is the risk and could it be a security hole?). I am using the following command to forward port ...
0
votes
1answer
43 views

How do I revert sudo sysctl -w kernel.unprivileged_userns_clone=1?

I did this in order to execute "brave browser" in my new debian installation. sudo sysctl -w kernel.unprivileged_userns_clone=1 I've read this maybe a potential risk for my machine security how do I ...
0
votes
1answer
62 views

New user can sudo to root in RHEL 6.10

I'm using a RHEL 6.10 and recently observed any new user can get sudo to root access by default. I checked all sudoer files but no such reference, only a few users are configured there and that doesn'...
0
votes
1answer
57 views

CentOS 7 not finding security update rpm packages

On my CentOS 7 server, when I run yum --security upgrade its not finding any security update rpm packages, but I know vim-minimal security update package available. How can I make yum security ...
0
votes
1answer
53 views

How to restrict use of SFTP feature “escape to local shell”?

In order to make a file server with restricted access, I set the following configuration: On the file server (Debian Wheezy) Create a user data-reader without home, without shell, in the group named ...
0
votes
0answers
108 views

SSH: How to disable strict host key checking, but still be warned about new devices

I'm working for a company that involves sshing into several different devices with the same IP address and hostname, but unique private keys for ssh. What I'm trying to figure out is a way to disable ...
0
votes
2answers
28 views

Folder Security

Is there any way that creater can create folder or file and he can give access to users but folder should not be accessible to admin/root user.Only authenticated user can access that.
1
vote
0answers
20 views

How can I configure my TTYs and VTs i.e. my Alt-Fn keys F1 - F12 in a safe and flexible way?

Right now I have a archlinux systemd installation that gives me a console login on tty1 to tty6. I see that with this @getty service systemd has an elegant way to fire up an array of ttys. The result ...
0
votes
0answers
12 views

Disable any and all screen locks/sign ins etc on Ubuntu 19.04

I don't want any security on my ubuntu box. This is because it is a virtual box, when I open it up I just want it to be ready to roll, and not need to type "osboxes.org" or hit enter etc. This is ...
0
votes
0answers
28 views

SSH host key changes after server gets patched

I noticed in place that I worked that when a linux machine (a VM actually and a service guard cluster) is patched, its SSH host key changed. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...
0
votes
2answers
111 views

How can I install gufw on fedora?

I want to install gufw on my Fedora, but I do not know how to do that. I tried to install with the dnf package manager command but it doesn't work and gets this output: No match for argument: gufw ...
2
votes
1answer
28 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
1
vote
1answer
18 views

Non Root User request to root for a specific service restart

We have a typical problem in our environment. Typically we have users with non SUDOER and ROOT access who are monitoring services of our application. At times they need to restart a service which ...
0
votes
1answer
28 views

Hash hostnames in $HOME/.ssh/config?

I know it's a good security measure to set HashKnownHosts yes in /etc/ssh/ssh_config, which causes OpenSSH client to hash the hostnames in ~/.ssh/known_hosts. Now I want to hash the hostnames in ~/....
0
votes
2answers
135 views

TCP SACK fix for Ubuntu 16.04 kernel version 4.15.0-1021-gcp

I have server in Google Cloud, running Ubuntu 16.04 with kernel version 4.15.0-1021-gcp. A fix for some vulnerability fix was recently released. I have question about that: do I need to update my ...
2
votes
1answer
58 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is a Linux ...
0
votes
0answers
24 views

Run script if phrase is typed in bash's password prompt

Is there a way to run a shell script if a specific incorrect password is entered in the bash login? (ie. my actual password is dog, but when I type in only cat it runs a script. I'm hoping to use this ...
1
vote
2answers
70 views

How to fix Fallout and RIDL?

I installed intel-microcode, but when I use ./spectre-meltdown-checker.sh I get this CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys ...
1
vote
0answers
25 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
2
votes
0answers
25 views

Why is StreamLocalBindUnlink disabled by default?

I want to enable GPG agent forwarding, and found that StreamLocalBindUnlink is disabled by default on sshd. Why is it disabled by default? Is there any security risk in enabling it? Since X11 ...