Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
37
votes
5answers
26k views

How to test whether a Linux binary was compiled as position independent code?

I recently learned that (at least on Fedora and Red Hat Enterprise Linux), executable programs that are compiled as Position Independent Executables (PIE) receive stronger address space randomization (...
25
votes
3answers
23k views

rkhunter gives me a warning for “/usr/bin/lwp-request” - what should I do? [Debian 9]

So I just installed and ran rkhunter which shows me green OKs / Not founds for everything except for: /usr/bin/lwp-request, like so: /usr/bin/lwp-request [ Warning ...
2
votes
3answers
2k views

How can I securely login remotely to my Linux box over the internet?

What's the simplest, most secure way to connect to my computer at home from work or from the library, &c? I'm running Mint 14. I'd like to connect from a Win or Linux setup. ALSO is there an ...
0
votes
2answers
1k views

Is it possible to make a standard user that can gain NO access to root?

I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I want to prevent them from gaining root access or using su or sudo command. I'd like to disable a variety of ...
0
votes
1answer
53 views

Is plain text in index.html secure?

So I would like to know if anybody can access my LAMP if I just write some plaintext in the index.html file, so that when somebody accesses my_ip:port they will be greeted to the text in that file. I ...
184
votes
8answers
140k views

Allow setuid on shell scripts

The setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor: > cat setuid-test.c #include <stdio.h> #include <unistd.h> int ...
8
votes
4answers
15k views

Check that fail2ban is running?

I just installed and configured fail2ban. I want to make sure it is working. I don't want to block myself from the server so I can't just login (poorly) a bunch of times. How do I see that fail2ban is ...
8
votes
1answer
3k views

What is securityfs?

While I am studying, I saw security file system which is mounted on /sys/kernel/security . It seems like to operate similar to sysfs or proc file system. Security file system keeps data on memory not ...
3
votes
1answer
66 views

What is Date_Spec in sudoers policy?

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec. User_Spec ::= User_List ...
0
votes
1answer
105 views

PackageKit logs a message about “only_trusted:0”

I ran pkcon update force. I noticed PackageKit is logging about only_trusted:0. That is, an operation where the only_trusted option is disabled. Even though I did not pass --allow-untrusted to ...
0
votes
0answers
44 views

Screenlock backdoors and how to close them

There is a warning in the Archlinux List of security applications. It says that of all possible screen-lockers, only four block tty access: sflock, physlock, Cinnamon Screensaver, MATE Screensaver and ...
2
votes
1answer
545 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
27
votes
4answers
59k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
5
votes
3answers
3k views

Privilege escalation detection?

Everytime when I read about some local privilege escalation exploit (e.g. this). I wonder if an OS can detect that there is someone logging in as root (or new root process starting)? Imagine a Gnu/...
1
vote
0answers
114 views

Hibernate command very important security problem

I use Debian 9 and use hibernate command very much. Recently I give attention to how it is working and understand after I turn on PC and hibernate was restoring images and wakes up, it does not ask ...
4
votes
1answer
15k views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
0
votes
2answers
88 views

How to hide the encrypted version of a file put in a cryptfs filesystem?

Say I create an encrypted folder and add a file to it: # mount -t ecryptfs /srv /srv # echo word > /srv/file The content of file is unavailable only after unmounting the filesystem. How can I ...
5
votes
1answer
2k views

What are the dangers of having writable chroot directory for FTP?

People around the net are all yelling how insecure it is to have writable root FTP directory, if you configure your FTP server with the chroot option (vsftpd won't even run). I miss the explanation ...
1
vote
1answer
575 views

preventing brute force attack on samba server [closed]

I have a LAN with many users(clients) in it. Each of them has a private samba share folder. How can I prevent somebody (within the same network) brute forces another account (so he can access ...
6
votes
2answers
3k views

Why is mount.cifs not installed suid by default?

I am using Gentoo, and on my machine at least mount.cifs is not installed suid root by default. In particular, this means that I can't use the user mount option with CIFS shares. I noticed that mount....
2
votes
1answer
549 views

Restrict `expect` to stdin/stdout interaction only

I need to accept job files from users, which would essentially consist of console interaction with a process I will be running for them. Naturally, the first idea that came to mind is to use expect ...
168
votes
8answers
202k views

What's the difference between /sbin/nologin and /bin/false

Technically, unless pam is set up to check your shell with pam_shells neither of these can actually prevent your login, if you're not on the shell. On my system they are even different sizes, so I ...
112
votes
2answers
10k views

Is Vim immune to copy-paste attack?

You should never paste from web to your terminal. Instead, you should paste to your text editor, check the command and then paste to the terminal. That's OK, but what if Vim is my text editor? Could ...
2
votes
1answer
29 views

How is find's {} substitution pattern vulnerable to injection attack? [duplicate]

I'm trying to understand more about this edit that was made to an answer of mine: https://unix.stackexchange.com/revisions/510388/5 How does running cd "{}" in the context of a find command ...
3
votes
2answers
24k views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
0
votes
0answers
100 views

show history of curl requests including executing user or program?

Little Snitch just told me that curl made a silent connection to tools.google.com. I'd like to know why. is there a way to get the history of commands on my system including who executed them?
1
vote
2answers
192 views

Understanding the audit log - file permissions and file content changed

I need to understand the log below, my index.php got obfuscated code, and file permissions changed from 644 to 755 as well. I've got something in my audit but can't really tell what and how it ...
5
votes
4answers
183 views

Protecting access to NFS shares in Docker

I would like people to access NFS shares from within Docker. Problem is inside of Docker they can become root, and then they can have write access to anyone's files by becoming that user. Is there a ...
14
votes
4answers
4k views

If the heap is zero-initialized for security, then why is the stack merely uninitialized?

On my Debian GNU/Linux 9 system, when a binary is executed, the stack is uninitialized but the heap is zero-initialized. Why? I assume that zero-initialization promotes security but, if for the ...
3
votes
1answer
102 views

Why is +::0:0::: not supposed to be found in /etc/passwd?

I was reading the BSI Security Guidelines (GERMAN), on NIS and it explicitly mentioned that one should prevent the entry +::0:0::: from occuring in the /etc/passwd file of the NIS server. From my ...
2
votes
1answer
33 views

rpm -V verify purpose

I am told I should do rpm -Va because: operating system must be configured so that the cryptographic hash of system files and commands matches vendor values... Without cryptographic integrity ...
1
vote
1answer
193 views

How to trap an event when a file with a specific content (given by e.g. checksum) was created on the local file system?

I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by me)....
0
votes
1answer
50 views

uninitialized pointers dangerous?

I read, that pointers (in C), that are not initialized, could point to an address that contain data or program code from other programs. In the book it says, that this can cause damage. Is this issue ...
0
votes
1answer
28 views

Should I remove ICMP Protocol from firewall rules base on security concern?

As you can see from the screenshot of GCP firewall rule page, should I remove ICMP Protocol from firewall rules base on security concern? Will it lower the chance of being attacked? I'm using CentOS ...
15
votes
6answers
2k views

Echo with obfuscation

I need to print some variables to the screen but I need to preferebly obfuscate the first few characters and I was wondering if there was an echo command in bash that can obfuscate the first ...
2
votes
1answer
48 views

How quickly are Debian security patches moved to “stable”? [closed]

Debian is known for its stability. As they require rigorous testing, packages are known to take a long time to become Stable, comparing to other distributions. In light of the extended review ...
7
votes
3answers
508 views

Why is chroot(2) unavailable to unprivileged users?

Why is chroot(2) unavailable to unprivileged users? I don't understand existing answers on the Internet. For example this one https://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123....
2
votes
1answer
240 views

SELinux is preventing /usr/sbin/php-fpm from lock access on the file cert9.db

I have an selinux alert for the file /var/cache/nginx/.pki/nssdb/cert9.db., but I don't know what label I should give to it. The selinux report suggests hundreds of labels, but which is the correct ...
1
vote
1answer
64 views

Is this SSHD config appropriate / secure [closed]

On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions. no root login no password authentication / force public key authentication authentication by ...
3
votes
2answers
296 views

Has the filtering of all kinds of TCP attacks using iptables become obsolete as they get filtered elsewhere or something else?

Background I am on Debian 10 Buster. I started running a Tor relay on my home IP address. A dedicated full-fledged server is probably not the most energy efficient way, but I want to try it out. And ...
73
votes
3answers
12k views

Server admin sent me a private key to use. Why?

I'm supposed to be accessing a server in order to link a company's staging and live servers into our deployment loop. An admin over on their side set up the two instances and then created a user on ...
12
votes
7answers
48k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
3
votes
1answer
106 views

Does `sshfs -o allow_root` open any security holes? Why isn't allow_root enabled by default?

allow_root This option is similar to allow_other but file access is limited to the user mounting the filesystem and root. This option and allow_other are mutually exclusive. From mount.fuse(...
2
votes
1answer
155 views

keeping keys on an auxiliary removable drive

It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any ...
0
votes
2answers
58 views

Securing a simple Linux server that holds a MySQL database?

MI'm setting up a Linux server running Ubuntu to store a MySQL database. It's important this server is secure as possible, as far as I'm aware my main concerns should be incoming DoS/DDoS attacks and ...
4
votes
2answers
124 views

What is the best next step when faced with curl <url> | sh

Most installation scripts these days have this particular pattern: curl -fsSL <url> | sh --- and usually run as root Some sites might even have a disclaimer about running this as root and to ...
3
votes
0answers
140 views

What is the in depth explanation of Dirty COW vulnerability (CVE-2016-5195)? [closed]

I'm writing a report for a university assignment about the Dirty COW vulnerability that was discovered last October (CVE-2016-5195). I grasp most of how the attack takes place. However I have found ...
-3
votes
1answer
74 views

when update kernels do they close bugs?

When I upgrade my kernel to latest stable one which is 3.12.2, does it close all security bugs? How linux security bugs be closed? by installing newer kernel or how ??and who closes these bugs?
30
votes
5answers
18k views

Shell Script mktemp, what's the best method to create temporary named pipe?

I'm aware its best to create temporary files with mktemp, but what about named pipes? I prefer things to be as POSIX compliant as possible, but Linux only is acceptable. Avoiding Bashisms is my only ...
6
votes
7answers
64k views

OpenVPN - Socket bind failed on local address [AF_INET] IP:1194: Cannot assign requested address

How get it resolved? I am trying to start the openVPN server so that I can login remotely using username: demo and password: demo, but openVPN server is failing to start. What am I doing wrong? How ...