Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
-1
votes
0answers
8 views

No root, other user privileges?

I know for security reasons I should not use root, my question is if i create a new user what privileges it should get ?
-11
votes
0answers
88 views

Why do Linux people apparently hate security? [closed]

Having spent years now trying to get encryption on my headless Raspberry Pi (Raspberry Pi OS installed), that's the only conclusion I can draw. On Windows, all you need to do is install VeraCrypt and ...
0
votes
1answer
22 views

grub password protection necessary or overkill in an encrypted system?

I run debian with full encryption and wonder why I would also need a password protection for the bootloader...
0
votes
0answers
14 views

History file - logging user and src ip

Is there a way to log the src ip and the user that executed the command to the history file? So far I've not found a way to make HISTTIMEFORMAT log that information
-2
votes
1answer
35 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
2
votes
1answer
44 views

For a directory file descriptor dfd, can I prevent traversing up as in openat(dfd, “..”, …)?

I have a user $service with a directory /srv/$service/subdir. /srv/$service has a mode of 0700, i.e. it's only accessible by $service. That user can open a directory file descriptor to …/subdir or any ...
0
votes
0answers
12 views

Is there anything wrong with giving ssh users filesystem access?

I am preparing a standalone server which will host several users that are able to log in with ssh public key authentication. They should be able to use the SSH connection to browse a shared folder ...
1
vote
0answers
12 views

Why does Message+ randomly pop up on my processes on Kali?

I watch my network using "top" and I notice message+ keeps randomly popping up for about 1-2 seconds then disappears. What is this and why is this happening? I can't find anything on it.
0
votes
0answers
39 views

Anonymous email client

I want to config any internet activities of the email client being routed by TOR or other proxy, and like TBB, each tab has different IP than others. Or as easy I want, where to download anonymous ...
0
votes
0answers
8 views

Cannot get Ubuntu Live Boot with Grub2 and secure boot with own key material to work

Okay, whats the story here? I've compiled the open source UEFI implementation for virtualization with KVM, aka. OVMF. To make this project interesting I am compiling it with the secure boot feature ...
2
votes
0answers
41 views

Why does disabling Kernel Page Table Isolation decrease MemTotal?

Iso kernel (Linux 5.4.60), Iso hardware, Iso config apart from case A: CONFIG_PAGE_TABLE_ISOLATION=y and, case B: CONFIG_PAGE_TABLE_ISOLATION=n iomem reports an identical map (apart from Kernel code ...
0
votes
0answers
11 views

Psad isn't triggering the script

I can't get the the psad to trigger a script upon scan detection. this is in my psad config; ENABLE_EXT_SCRIPT_EXEC Y; EXTERNAL_SCRIPT /scripts/tomylog.sh --ip SRCIP -v; this script ...
23
votes
3answers
3k views

Is having docker installed a massive security hole?

Suppose I have an Ubuntu machine and did sudo apt install docker.io. Did I just put a huge security hole in my machine that will allow anyone with terminal access to escalate into root? I ask that ...
0
votes
2answers
17 views

How to verify a public(facebook's) key ? and then sign and trust them

Recently I enabled gpp emails option in facebook. Then they sent me a test mail to check whether I'm able to decrypt that or not. So first I downloaded there public key from Here and imported in my ...
0
votes
0answers
8 views

Setup AIDE monitor and hashes are already mismatched

I’m setting up AIDE monitoring on Raspbian. I first tried over ssh but it timed out due to my timeout settings. Then I setup the new AIDE db directly on the RPi command line. I had to overwrite the DB ...
0
votes
0answers
17 views

How to use Linux keyring to create a session-less key that is accessible from cron and services and lives forever until the next reboot?

I would like to create a keyring key that can be used from session-less processes (cron, daemons etc.). Keyctl documentation suggests: keyctl_get_persistent() gets the persistent keyring for the ...
0
votes
0answers
23 views

How to cache systemd-ask-password data for automatic systemd service restarts?

I have created a web service that requires a password to decipher its config data. The password could not be stored as raw data anywhere on the disk (very strict bureaucratic requirements from the ...
1
vote
0answers
74 views

When you have to use previous or older kernel due to compatibility or dependencies, how long is it safe to use them?

I'm sure a bunch of people are having this issue now. I upgraded Fedora kernel with a magic button in "Software" app and Virtual Box vboxdrv isn't available yet for 5.8 . (Before this last ...
0
votes
1answer
33 views

Correct way to verify PGP signature in BASH script (pinning exact long fingerprint)

I have: A file A detached PGP signature of that file in ASCII armor format and A 40-character (long-format) fingerprint identifying the one key that must have a valid signature What is the correct ...
0
votes
0answers
28 views

eToken not detected

I want to use an Aladdin eToken Pro 32k 4.2B on Fedora 32 but it is not detected. It shows as another model in lsusb: Bus 003 Device 009: ID 0529:0600 Aladdin Knowledge Systems eToken Pro 64k (4.2) ...
-3
votes
1answer
35 views

Problems with aircrack-ng, ALFA usb not working/causing internet to shut down?

I apologise if this is basic troubleshooting. I bought a AWUS036NEH, which is recognised and properly appearing in Device Manager in Windows 10. I am using Debian 10x 64 bit, on Windows 10 via VMWare ...
3
votes
1answer
271 views

Why does Linux need SELinux

What is SELinux and what are the advantages of using it? Why does Linux need another layer of protection?
3
votes
2answers
139 views

Overwrite deleted file

I have deleted a file on a FAT16-formatted flash drive with rm. I can see that the file is still recoverable using testdisk or fls. Is there a way to securely delete the (already deleted) file, ...
1
vote
1answer
38 views

Backup a LUKS encrypted device on the cloud

I am going to use LUKS for encryption, however I cannot find a thoughtful manual and best practices how to do so. Here I will list my questions, sorry for naivety. Apparently I don't need to encrypt ...
1
vote
1answer
34 views

Can security modules completely override Linux Kernel's access model?

I am aware of Apparmor and specifically how it can be used to limit a program's access rights where of the file-system permissions otherwise allow. What I'm less clear on is whether it's possible for ...
1
vote
1answer
54 views

Does Raspberry Pi OS support encryption on the RPI 1 WITHOUT extra hardware?

I have a RPI 1. The original. It is crucial for me, for basic bottom-line security, that all my machines are encrypted and cannot be booted/read once powered off without somebody entering the right ...
1
vote
0answers
33 views

Is there a Linux firewall that also limits applications access to specific ports?

Is there a firewall application in Linux that lets you control network traffic on a per-application/per-process basis AND lets you limit that access by port/destination (like Outpost/Kerio/Sygate/...
0
votes
1answer
21 views

Hash sum via pipe, abort if no match

How can I verify a checksum of a file by piping it? e.g. I want to do something like curl -sL https://example.org/maybe-safe-maybe-not.tar.gz | md5sum 8da7904f495f682c39fa505b6404f9d1 | tar xvzC /usr/...
0
votes
1answer
73 views

Completely securely deleting a single file [duplicate]

My impression is that, if one wishes to be able to delete a certain file completely, without wiping an entire drive, one should never store it on an SSD. Is that right? Even with whole-disk-...
0
votes
0answers
49 views

aws ec2 describe-security-groups + awk sed

I am sure this is not the most efficient method, but I need help formatting the results of this aws command: aws ec2 describe-security-groups --group-ids sg-xxxxxxxxxxxxx --region=us-east-1 --profile=...
0
votes
0answers
26 views

Tor Browser GENERIC VERIFICATION FAILED

I am using Linux Mint 19.3. The problem is when I installed Tor this error GENERIC VERIFICATION FAILED raises during downloading the packages. I tried too many solutions but they did not solve the ...
1
vote
2answers
31 views

Running a script when a particular command is run

I want to run "./dothis.sh" if someone executes "cat abc.txt" Is there some way to do this without using alias? I want to use this for strengthening security of some specific files ...
1
vote
2answers
36 views

PHP security updates in Debian after PHP version EOL

I got a quite stupid question I am afraid but I am kind of in need of written confirmation of my suspicion. Consider a Debian 9 with PHP from the official repositories. The PHP version shipped by ...
0
votes
1answer
59 views

How DM-Verity works?

I don't understand ow DM-Verity works. Reading from here or here I have several doubts about it: Considering a whole block partition protected by dm-verity: it should verify the data to the hash ...
0
votes
2answers
93 views

In Debian 10 how to verify that an apt-get package doesn't contains any viruses or any malicious code [closed]

The below Dockerfile is written based on Debian 10 (buster) image FROM node:12-buster RUN apt-get update -y RUN apt-get install wkhtmltopdf -y #...rest content As you see above I need to install a ...
0
votes
0answers
7 views

Security permissions on implementing mcollective with activemq

I'm having issues understanding the default permissions assigned in an mcollective/activemq implementation. For context, I'm working an infrastructure pentest, on a private cloud of aproximately 5000 ...
0
votes
0answers
34 views

How to use seahorse to store and fetch bitwarden or lastpass master password?

I am using the bitwarden password manager add on for firefox. If I set "remember password" for the master password, bitwarden warns me that the password will be stored in plain text on my pc ...
0
votes
1answer
11 views

Encrypt home folder after installation

I installed manjaro more than 2 years ago. I did not choose to encrypt my home folder during installation. Now, I think I want this. Can I do this now?
0
votes
1answer
32 views

PASS_MIN_LEN missing from login.defs

I've noticed that the PASS_MIN_LEN is missing from the password aging controls section inside /etc/login.defs (Ubuntu 20.04 LTS). At the end of the file there is a note that it's obsolete, alongside ...
1
vote
0answers
21 views

setuid not working as expected in Pop!_OS

So I was trying to experiment with setuid. As per my understanding it allows users to run the binary with context of the owner. So I wrote a program in C which does write operation in /root directory ...
0
votes
0answers
18 views

How do users receive update warnings in Thunderbird?

Thunderbird 78 rises the following warning on Gentoo Linux and likely on other distributions too. I can not remember that I changed anything on my system until the message came up. I suppose that ...
1
vote
0answers
15 views

How can I enable/disable a jail using fail2ban?

We can add a line like this below a specific jail in the jail.local file, and control the jail: enabled = true/false But I think there should be a command to do this, as we've got bunch of "set&...
0
votes
1answer
21 views

Can not log permission denied errors using auditctl [closed]

I try to create an auditctl rule for the following situation: There is a file created by root, owned by root, and with chmod 700. So no other user except root can read or write to it. When I then try ...
0
votes
1answer
34 views

Delete only private signing key from within gpg (without reimporting subkeys or 'rm ~/.gnupg/private-keys-v1.d/KEYGRIP.key')

From what I understand it is considered to be good practice to generate a private-public keypair, generate a subkey for encrypting, export all three keys and store/backup them (e.g. using 'paperkey') ...
0
votes
1answer
35 views

Which firewall rule is considered if i 'drop' first then later adding 'accept' rule. drop or accept?

I am restricting the traffic to specific port number using the below firewall rule. /sbin/iptables -A INPUT -p tcp --destination-port <port_num> -j DROP After sometime i want to allow ...
0
votes
0answers
23 views

How safe is motion (webstream package)

Before answering my question, please bear in mind that when I ask about safety, by unsafe I mean something like a WEP/open network, whereas by safe I mean something like a WPA2-PSK network. Cheers! As ...
3
votes
0answers
70 views

Secure Boot - how does Linux revoke/blacklist vulnerable boot loaders/boot managers/kernel/modules signed with shim's built-in key?

Background Shim can have a certificate built into it during compilation (see "Shim keys" paragraph here). The corresponding private key can then be used to sign the boot loader/manager and ...
0
votes
2answers
28 views

How can I scan/test/explore if my Firefox (profile) has been infected?

I use Debian and because of that the version in the reps is outdated, so I have Firefox Quantum that is fully unpacked in a folder where my non-root user has all permissions to read, write and execute....
0
votes
0answers
73 views

How dangerous is it to allow a “sandboxed” program to write anywhere in virtual memory?

This is a question about the interaction between a process and the linux kernel. This is in the context of a formal proof, so the setting may seem a bit weird. Suppose I have a program, loaded from an ...
12
votes
2answers
922 views

How does ping work on Fedora without setuid and capabilities?

As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities). From my understanding the trend these last years has been to remove setuid binaries ...

1
2 3 4 5
46