Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
0
votes
2answers
28 views

Folder Security

Is there any way that creater can create folder or file and he can give access to users but folder should not be accessible to admin/root user.Only authenticated user can access that.
2
votes
2answers
6k views

gpg: cancelled by user

Trying to create GPG keys which will be used for an apt repository hosted on my Centos7 box. I created a new user "apt", and then tried to create the keys, but at the very end, it states that I need ...
1
vote
0answers
24 views

How can I configure my TTYs and VTs i.e. my Alt-Fn keys F1 - F12 in a safe and flexible way?

Right now I have a archlinux systemd installation that gives me a console login on tty1 to tty6. I see that with this @getty service systemd has an elegant way to fire up an array of ttys. The result ...
0
votes
0answers
14 views

Disable any and all screen locks/sign ins etc on Ubuntu 19.04

I don't want any security on my ubuntu box. This is because it is a virtual box, when I open it up I just want it to be ready to roll, and not need to type "osboxes.org" or hit enter etc. This is ...
0
votes
0answers
808 views

Cannot label F2FS (SELinux)

I'm running Arch Linux [testing] x86_64 For some reasons, I can't relabel my root file system (F2FS) with SELinux (custom kernel compiled, using refpolicy) Kernel ver $ uname -a ...
0
votes
0answers
28 views

SSH host key changes after server gets patched

I noticed in place that I worked that when a linux machine (a VM actually and a service guard cluster) is patched, its SSH host key changed. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...
2
votes
1answer
29 views

auditctl - logging the CPU or identifier of pthread that invoked the system call

auditctl is a great utility for monitoring many things, such as executed system calls. I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In ...
88
votes
1answer
20k views

Chrome: DNS requests with random DNS names: malware?

Over the years (since 2005), I have seen logs of strange random DNS requests done, on the multiple DNS / BIND servers I have maintained. May 7 12:13:50 1.1.1.1 named[63742]: client 1.1.1.2#24123 (...
4
votes
3answers
1k views

Prevent users from killing processes that they own

I have started some processes (window based) from user's .bashrc file. I want to prevent users from killing those processes. Is there a way to transfer the process to superuser so that a normal user ...
1
vote
1answer
20 views

Non Root User request to root for a specific service restart

We have a typical problem in our environment. Typically we have users with non SUDOER and ROOT access who are monitoring services of our application. At times they need to restart a service which ...
0
votes
2answers
156 views

TCP SACK fix for Ubuntu 16.04 kernel version 4.15.0-1021-gcp

I have server in Google Cloud, running Ubuntu 16.04 with kernel version 4.15.0-1021-gcp. A fix for some vulnerability fix was recently released. I have question about that: do I need to update my ...
1
vote
1answer
1k views

GUFW or Firestarter in Fedora

Physician using Fedora 21 - I have very limited knowledge of Linux. I cannot make sense of iptables in Fedora. I used Debian before but moved away from Debian in great disgust after I realized their ...
0
votes
1answer
32 views

Hash hostnames in $HOME/.ssh/config?

I know it's a good security measure to set HashKnownHosts yes in /etc/ssh/ssh_config, which causes OpenSSH client to hash the hostnames in ~/.ssh/known_hosts. Now I want to hash the hostnames in ~/....
2
votes
1answer
67 views

google chrome “managed by your organization” on linux

today I opened google chrome and saw this on customize and Control menu : "managed by your organization" , is that a malware sign ? if yes how can I completely remove that malware? my os is a Linux ...
1
vote
0answers
32 views

How to run single application in permissive mode and remaing all in enforcement mode for SEAndroid?

I want to allow single application to run in permissive and keep enforcing mode for all other applications in SEAndroid. How to do this?
1
vote
2answers
112 views

How to fix Fallout and RIDL?

I installed intel-microcode, but when I use ./spectre-meltdown-checker.sh I get this CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys ...
0
votes
0answers
24 views

Run script if phrase is typed in bash's password prompt

Is there a way to run a shell script if a specific incorrect password is entered in the bash login? (ie. my actual password is dog, but when I type in only cat it runs a script. I'm hoping to use this ...
2
votes
0answers
37 views

Why is StreamLocalBindUnlink disabled by default?

I want to enable GPG agent forwarding, and found that StreamLocalBindUnlink is disabled by default on sshd. Why is it disabled by default? Is there any security risk in enabling it? Since X11 ...
0
votes
1answer
23 views

Encrypting Wifi Password When Using Wicd

Inspired by this answer, I'm wondering if there is a (relatively) painless way to "hide" the wifi password(s) that is/are present in the /etc/wicd/wireless-settings.conf file. I travel a lot and ...
22
votes
2answers
27k views

Hiding passwords in wpa_supplicant.conf with WPA-EAP and MSCHAP-v2

My wpa_supplicant.conf looks like this: network={ ssid="Some name" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="my-user-id" password="(clear text password here)" ca_cert="/usr/share/...
2
votes
3answers
2k views

Why does kdeconnect listen on port 1716/tcp all the time? How to close the port / secure it?

Zenmap shows me that port 1716/tcp is open and sudo fuser -v 1716/tcp tells me kdeconnectd is responsible for it. Why does kdeconnectd have the 1716 port opened all the time? And what would be best ...
-3
votes
1answer
436 views
1
vote
4answers
76 views

Making my remote SSH more secure

I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite. Currently I just have 2 users that are remoting in, but checking my /var/...
8
votes
1answer
2k views

gdm greeter configuration: Exclude all *except* for one specific user

I have Googled this one and tried so many combinations, with no success. I need the GDM login greeter to display one and only one username. In effect, what I need is something like this in /etc/gdm/...
1
vote
1answer
326 views

What rule prevents entering a user namespace from inside a chroot?

# rpm -q --whatprovides /usr/bin/unshare util-linux-2.32-2.fc28.x86_64 # unshare -r # i.e. the above succeeds, where the following does not. What rule causes this? # rpm -q --whatprovides /usr/sbin/...
1
vote
1answer
55 views

What is the package release process at CentOS

What's the process if a security patch is available for a package on CentOS? I'm waiting for bind-9.9.4-74 Since 5 days, there are this commit 'import bind-9.9.4-74.el7_6.1' on https://git.centos....
0
votes
1answer
42 views

Installing Vmware ESX on Solaris server

I have been told to install VMWare ESX on the Solaris server, but I could not find resources about this issue on the web, how is that possible?
1
vote
1answer
84 views

How to disable dontaudit denials in SEAndroid

My application is working in permissive mode, but not in Enforcing mode for SEAndroid. Here i cleared (allowed) all denials,so now there is no denial logs coming in my logcat logs.So it might be ...
0
votes
1answer
37 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
0
votes
1answer
107 views

How can I prevent against the HiddenWasp trojan? [closed]

As people probably know by now, some hackers released a trojan "HiddenWasp" into the Linux world. Article from Intezer: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ So ...
1
vote
0answers
106 views

Disconnecting unwanted remote access

If someone is remotely connected to my single ARM board computer with Debian 32-bit OS, (example: thru hijacking the browser), which connects through a firewall on a separate Orange Pi board, and I ...
3
votes
2answers
949 views

Weird audit2why message caused by SELinux

When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:...
-2
votes
1answer
57 views

Security patch update [closed]

If applying the latest patch(example : CESA-2019:0679 - Libssh2 Security Update - CentOS 7 x86_64) will cover the previous patch changes or we need to do it separately?
17
votes
3answers
1k views

What is OpenBSD's pledge in short?

Can someone please describe, for a non-programmer, but IT person, what is pledge? Ex.: there is a program, ex.: "xterm". How can pledge make it more secure? It pledge inside the programs code, or ...
5
votes
0answers
256 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
9
votes
3answers
23k views

Disable stack protection on Ubuntu for buffer overflow without C compiler flags

I'd like to try some shell codes and I want to disable linux protections. I know I could compile using flags but I know another way exists to disable these protections in general I just can't ...
0
votes
0answers
69 views

How to set bluetooth security to none?

I am trying to connect my phone with my raspberry(headless) which runs on this OS. My requirement is,I do not have to enter "yes" manually in the bluez CLI application (which is started by the ...
0
votes
1answer
71 views

How to determine which modules are responsible for spectre_v2?

SERVER:~ # cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Mitigation: Full generic retpoline, IBPB, STIBP, RSB filling - vulnerable module loaded SERVER:~ # The question: But how to detect, ...
1
vote
1answer
92 views

Why ip_forward is disable by default? any side effect?

I need to forward an interface and I wonder why is disable by default? There is any security issue when I enable it? Is there any side effect when I enable it?
0
votes
1answer
97 views

Elasticsearch fails to start with 'permissions read' error even though read permissions exist

I have a symlink at /etc/elasticsearch/analysis that points to a mounted drive at /elasticdata/fileshare/analysis on Ubuntu 16.04 LTS Azure VM. When I try and start elasticsearch I am getting the ...
1
vote
0answers
119 views

How to update libvirt to passthrough md-clear?

There are new 4 CVE CVE-2018-12130 CVE-2018-12126 CVE-2018-12127 CVE-2019-11091 Debian stretch kernel is vulnerable https://security-tracker.debian.org/tracker/CVE-2018-12130 Even if you get a ...
1
vote
4answers
79 views

Is it possible to check for DNS-leaks on unix server?

I run a Ubuntu server where I have a split tunnel for VPN. Which means I have a "normal" connection to the internet for most of my services but also a tunneled connection that only a few services use. ...
0
votes
1answer
191 views

How to handle Nginx and PHP ownership of log files?

I currently am running a Nginx reverse proxy in front of an Apache PHP server on Ubuntu. I have a file, log.txt, in the same directory that I serve PHP files out of for my site. PHP writes to this log ...
8
votes
2answers
782 views

Why does the setuid bit work inconsistently?

I wrote the code: // a.c #include <stdlib.h> int main () { system("/bin/sh"); return 0; } compiled with command: gcc a.c -o a.out added setuid bit on it: sudo chown root.root a.out sudo ...
0
votes
1answer
88 views

How can I unload a filesystem module in a RHEL 7 server in order to harden it?

I'm trying to harden my RHEL Linux server 7 according to the CIS guidelines, so I want to unload the cramfs. I typed the following command: modprobe -n -v cramfs and I got the following answer: ...
1
vote
2answers
146 views

Does using non-root user without password makes system more vulnerable?

Let's say somebody sitting under user (non-admin, not root), but he didn't set up any password for it, only superuser/root has password. Is it bad practice (in context of remote access to a desktop ...
1
vote
1answer
58 views

Synchronise passwords across devices with pass

I am looking for a simple, open-source password manager for linux with a CLI. It has to have a way of retrieving a password via the command line, so I can use it in several scripts (that sync my email ...
0
votes
1answer
57 views

Ubuntu Security Patches for Apache2

How do i get the newest version on Ubuntu 18.04 (Longterm Version only!) for the apache2 package? (Please let me know if they apply the security patches from the newer versions backwards and i just ...
0
votes
0answers
181 views

How can I properly use my fingerprint scanner?

I just bought a Thinkpad T430 and installed Linux Mint 19 on it. It's the first time ever I use Linux, so I'm kinda lost. I searched a bit and I found a way to make the built in fingerprint scanner ...
0
votes
1answer
287 views

Are packages on snapcraft inherently safe?

Are packages installed by snap from https://snapcraft.io inherently safe? I heard they are sandboxed. Does that mean they can't change my file system, read my files, etc.?