Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
32
votes
4answers
55k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
0
votes
0answers
12 views

How to check the Integiry of the each PHP files in linux server using lighthttpd server?

I have a project requirement, Where I have to check the integrity of each PHP files before executing it using md5 or some method. The hash value is stored safely within the server. What I have done: ...
6
votes
1answer
233 views

Running script line by line automatically yet being asked before each line from second line onwards

I work on a script of about 20 lines which I find myself testing time and again by copy-pasting and executing line by line of. Instead of copying-pasting each line and hitting Enter to execute, I ...
0
votes
0answers
11 views

Restrict Postfix From domains

I have a webhosting server based on ISPConfig (Debian 9.9 LAMP) and I'm new to Postfix. When users send an email from PHP, the default address is webmaster@thedomain.com. This address can be overriden,...
1
vote
1answer
26 views

How to prevent a snap package from accessing my home directory?

I want to use mathpix-snipping-tool snap package, but it has an extremely lousy privacy policy, in which the company says that they can collect whatever info they want, and the package has a home ...
2
votes
3answers
85 views

How to scan my computer's UDP ports

What command can I use to port scan UDP? I hear that UDP scanning has some specific issues, that do not apply to TCP scanning. I tried running sudo nmap -p0-65535 -sU 192.168.1.97. But it has been ...
0
votes
0answers
12 views

How to find out the user ID of the command/request sender when we use any IPC (Inter Process Communication) in PHP?

Currently, We use socket for Inter process communication between two process , the application is written in PHP. Our scenario is, there is a server (server.php) and multiple PHP clients. We want ...
0
votes
2answers
59 views

How insecure is it passing a password to curl via cat

I have a script which executes curl many times. I'd like to enter my password only once (so I don't want curl to ask for it on every execution). I don't want the password to appear in process list or ...
1
vote
1answer
15 views

SysRq doesn't display any result on terminal

I use Mint 19.2, and I try to see CPU backtrace by the following process. $ sudo -s # sysctl -w kernel.sysrq=1 # echo l > /proc/sysrq-trigger But, nothing happened. I researched more ...
0
votes
2answers
104 views

How can I install gufw on fedora?

I want to install gufw on my Fedora, but I do not know how to do that. I tried to install with the dnf package manager command but it doesn't work and gets this output: No match for argument: gufw ...
0
votes
0answers
27 views

Is encrypting HOME folder enough in linux?

I've been using Windows and Bitlocker for years. I recently decided to give linux a try because of the beautiful Deepin OS distro. Encrypting my device is a must for me and most of the tutorials I ...
2
votes
2answers
414 views

What is the advantage of .desktop files without executable bit set?

The freedesktop organization defines the standard for .desktop files. Unfortunately it defines not the permissions of the file (see freedesktop mailinglist) and software is distributed with a) ...
1
vote
0answers
16 views

Logwatch not sending email

I'm trying to send logs to my email. I'm doing this via SSH. I edited the file: /usr/share/logwatch/default.conf/logwatch.conf and edited these lines: Output = mail Format = html Encode = none ...
49
votes
3answers
184k views

Convert Amazon .pem key to Putty .ppk key Linux

I have generated and downloaded a private .pem key from AWS. However, to use Putty in order to connect to the virtual machine, I must have that key in .ppk format. The process of conversion is ...
1
vote
1answer
913 views

ICMP timestamp requests

Is there a way to disable ICMP timestamp requests without using iptables on our RedHat 5 and 6 servers? We are not using iptables because we use a hardware-based firewall. Is there any setting (say,...
3
votes
1answer
465 views

Linux Mint: pastebin is in /usr/local/bin

I'm running Linux Mint 17. I found a pastebin python file in /usr/local/bin In light of what people use pastebin for, was this a security risk? Output from the stat command: File: ‘pastebin’ ...
2
votes
1answer
42 views

Grub2 and password

I have an user account to log into grub, this works. Every time I boot the computer I am asked for my username and password to boot my operating system. How can I set grub so it only requests the ...
2
votes
0answers
30 views

AWS - Stack creation - How to assign an inline policy to adhoc user?

Background: With cross account role someaccountrole, I have access to aws account xyz. Case 1 To create a stack in account xyz, we upload the Cloudformation file through console. Amidst stack ...
1
vote
1answer
16 views

Is iteratively adding more AppArmor rules bad?

As far as I know, AppArmor cannot grant privileges to a program that otherwise doesn't have it (i.e. it can only further restrict). Given that, would it be okay to "allow all" for all programs at ...
0
votes
0answers
10 views

AppArmor custom network access for all apps [duplicate]

I would like to create an AppArmor profile that has the following: Inbound network access is only available to a specific app: SSH Outbound network access is only available to a specific app: squid ...
0
votes
2answers
41 views

Ubuntu 16.04 VPS security - check whether installation of the OS is unaltered (clean)

I'd ordered a VPS with Ubuntu 16.04/64-bit LTS server edition with some ports opened, which are essential to my application. recently the VPS was delivered to me, so I accessed the VPS using ssh and ...
0
votes
2answers
32 views

Locking down image files in folders

I have a form which uploads a picture to an upload folder on my Gnu/Linux host. When the user registers, it creates a folder for them, in uploads, and puts their picture into it. I have disabled ...
0
votes
0answers
39 views

pam_tally2 not working as expected?

I have been using pam_tally2 to lock a user after certain number of failed attempts through ssh. In /etc/pam.d/common-auth added auth required pam_tally2.so deny=3 unlock_time=600 In /etc/pam.d/...
0
votes
1answer
883 views

Is setting CentOS user home-dir as NGINX server block root secure for vsftpd?

This is what I did: CentOS 6.2 server installed nginx installed vsftpd in vsftpd.conf I set chroot_local_user=YES created a new user "bleh" created directory /home/bleh/public_html/ in virtual.conf I ...
2
votes
1answer
38 views

How to check who has been looking at your files in Linux computing cluster

I work at an office with other people on data analysis, from which only one of them has root permissions to our shared computing cluster. Some have a suspicion that the person with root permissions is ...
0
votes
1answer
26 views

How can I deny all IPv6 ssh connection

I want to disable all ssh connection from both IPv4 and IPv6 except certain IPs. I can set /etc/hosts.deny to deny all IPv4 ssh connection: sshd: ALL How to apply to IPv6? I tried below, and fail: ...
0
votes
1answer
870 views

OpenSSL Padding Oracle vulnerability with latest openssl 1.1.0c

I have a test server running Centos 6.8 and can't overcome this message when running a SSL Labs test: https://www.ssllabs.com/ssltest/analyze.html?d=biduno.com&latest This server is vulnerable ...
2
votes
1answer
67 views

Delete the “locate” database in FreeBSD

After having established the locate command's database indexing file & directory names across my FreeBSD 12 system (as described in this related Question), I now regret doing so because of its ...
1
vote
0answers
9 views

Configure TLS cipher negotiation priority in Firefox/Thunderbird

Is it possible to configure TLS cipher negotiation priority in Firefox/Thunderbird by choosing the most secure which is available on both sides? Now the situation is that even if TLSv1.3 is available ...
0
votes
0answers
16 views

enabling check_signatures in GRUB

I'm trying to create a new image of GRUB which has an embedded public key file to validate all files loaded by GRUB. So I used the command grub-mkimage to manually create a new GRUB core image. grub-...
3
votes
2answers
76 views

Reading and writing data temporarily without using the filesystem

I'm using ansible in a vagrant environment managing a debian box. Due multiple ansible provisioners with vault encrypted data (e. g. database root password) I have to enter the vault password once by ...
1
vote
0answers
24 views

Dump BIOS configuration

I have an old HP Z2100 plotter whose firmware and data is located on a now 12 years old laptop PATA disk and which I'd like to replace with a CF card before the disk inevitably dies. The computer in ...
7
votes
4answers
409 views

How can I safely give a shell to somebody?

I have a question about giving a shell account to somebody. How safe is it? He could read /etc. How can I give a secured shell account that will only restrict the user to some bins and his own home? ...
14
votes
6answers
14k views

Why does Debian come without a firewall enabled by default?

I'm using Debian 9.1 with KDE and I'm wondering why it comes without a firewall installed and enabled by default? gufw is not even in DVD1's packages. Are people expected to connect to the Internet ...
4
votes
1answer
2k views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
0
votes
1answer
98 views

Install Alpine security updates only

Is there a way to install only security updates for Alpine Linux and its apk packages, skipping updates that don't fix security holes?
-1
votes
1answer
77 views

What's the safest Linux OS? [closed]

If someone was trying to hack into my OS whereby they could put malicious code there, which Linux OS would best withstand this kind of attack? I know the router, firewall, switch, etc will play a ...
0
votes
1answer
59 views

Disable *** stack smashing detected ***: <unknown> terminated

I'm running Ubuntu 18.04 and a simple program such as: #include <stdio.h> int main(int ac, char *av[ac+1], char **env) { char arr[8]; printf("0x%x\n", av); scanf("%s", arr); ...
0
votes
0answers
63 views

Firefox Apparmor Profile

I'm running Ubuntu Mate 19.04. I want to enable apparmor for Firefox. I found an existing profile in /etc/apparmor.d/usr.bin.firefox, which I enabled by deleting /etc/apparmor.d/disable/usr.bin....
0
votes
0answers
34 views

How pssh do the ssh activities without password

the follwing pssh command do a parallel as date pssh -i -H "master01 master02 master03 worker01 worker02" -l root -x '-q -o StrictHostKeyChecking=no -o GSSAPIAuthentication=no -o ...
1
vote
1answer
1k views

Security - Runing Daemon, program as root or user vs sudo su

I have some questions about Linux security: Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user (...
0
votes
0answers
15 views

With netcat how to safely open an external port to the Internet

I have found the perfect solution to write scripts which send files across machines over the Internet using netcat. On the machine receiving files I do nc -l -p 1234 -k and then on the machines ...
1
vote
2answers
49 views

What is important to be careful about (for your security) when adding repositories (Keyring, Sources-list, etc)?

Hello this may seem very basic and general questions. (BUT) Many times when I install software adding new repositories is the way to go. I use to follow instructions I find on the internet just like ...
2
votes
1answer
997 views

OpenVas + Kali Rolling: The connection was reset

I am trying to get OpenVAS to work in the latest Kali release (rolling). It seems to be installed right, but when I try to access the web interface (127.0.0.1:9392), I get Connection was reset. ...
9
votes
2answers
7k views

Is accepting RELATED,ESTABLISHED for all sources in iptables considered “too open”?

I've often seen the rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT applied. Whilst I'm not an expert, that particular line concerns me. It's pretty obvious that the rule allows all ...
1
vote
1answer
32 views

Security implications of SSH Port Forwarding/Tunneling

I need help understanding the security implications of having an outgoing ssh tunnel in my system (what is the risk and could it be a security hole?). I am using the following command to forward port ...
0
votes
1answer
41 views

How do I revert sudo sysctl -w kernel.unprivileged_userns_clone=1?

I did this in order to execute "brave browser" in my new debian installation. sudo sysctl -w kernel.unprivileged_userns_clone=1 I've read this maybe a potential risk for my machine security how do I ...
0
votes
1answer
62 views

New user can sudo to root in RHEL 6.10

I'm using a RHEL 6.10 and recently observed any new user can get sudo to root access by default. I checked all sudoer files but no such reference, only a few users are configured there and that doesn'...
0
votes
1answer
56 views

CentOS 7 not finding security update rpm packages

On my CentOS 7 server, when I run yum --security upgrade its not finding any security update rpm packages, but I know vim-minimal security update package available. How can I make yum security ...
0
votes
1answer
52 views

How to restrict use of SFTP feature “escape to local shell”?

In order to make a file server with restricted access, I set the following configuration: On the file server (Debian Wheezy) Create a user data-reader without home, without shell, in the group named ...