Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
0
votes
1answer
105 views

rsync copy file without user and password less access

Explain below mention command we are not passing username as well password still we can do rsync. rsync -avz rsync.apache.org::apache-dist /path/to/mirror
1
vote
1answer
156 views

How to provide OAuth2 “Client ID” and “Client Secret” to an open-source bash script?

I was writing a bash script for Gmail that would authorize itself using OAuth2, and make API calls using the received tokens. It worked. But now I'm stuck on thinking how to securely store the Client ...
0
votes
1answer
112 views

Is a php file with SGID bit and read-only & execute a security problem? [duplicate]

I find php files with SGID bit and read-only & execute. The group is root. Is this a problem? Because a user will need to run the php interpreter with their our account, could it led to privilege ...
-3
votes
1answer
79 views

Are there any x86 security Linux distributions based on Ubuntu? [closed]

Are there any x86 security distributions like Kali Linux or better them based on Ubuntu?
-1
votes
2answers
218 views

Priviledge separation for Firefox (aka: how to secure webbrowsing)

I do this on Scientific Linux 6.3 (to implement it, it requires a minimal Linux knowledge): Shared directory for downloads Remember you can only copy from or to this directory, never "move" files ...
1
vote
1answer
2k views

how to use rsa RSA SecurID with Linux?

I have just found an old RSA SecurID token, model SD600, at the back of a drawer. I only have the token - no documentation or pin numbers (long forgotten) or anything else. Is it possible to make use ...
2
votes
3answers
3k views

How to use YubiKeys with SSH keys in 2-step verification?

I can setup SSH keypair without Fido U2F as described SSH-agent working over many servers without retyping? Some flag? in the thread. Two step verification would be very good: password for the ...
1
vote
0answers
140 views

How to additional public keys to .secondary_trusted_keys?

I am trying to add additional keys to .secondary_trusted_keys. Documentation says, to do so the additional keys has to be signed by a key which is already a resident in either .builtin_trusted_keys or ...
0
votes
1answer
88 views

Is there a way to prevent root user from modifing kernel and boot loader?

Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel. Is there a way to prevent ...
122
votes
2answers
20k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
8
votes
8answers
63k views

Helo command rejected: need fully-qualified hostname Error

My mail server is in some blacklist cause of spams. I reconfugured postfix. Aften then My customers get this error they can't send emails. 404 4.5.2 <PLLAMNAZIFE>: Helo command rejected: need ...
2
votes
2answers
119 views

Why is /etc/sudoers not world-readable?

I'm struggling to think what security risks there could be to knowing who is allowed to use sudo.
1
vote
1answer
441 views

LAMP Server setup for personal development

I am setting up a LAMP server in VirtualBox for personal development. This will be an Ubuntu Server 12.04 install, and I will be using Virtual Hosts for Drupal, Yii, and other small PHP apps. Ideally ...
4
votes
2answers
559 views

Linux root access recovery by booting on the console

Very recently I recovered a root password for a Debian server by booting into single user mode. This resulted in me having access to a shell with root privileges (prompt said "root@none") Now this has ...
0
votes
1answer
68 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
0
votes
0answers
42 views

Order of scripts run before bash starts

I'm studying the scripts that run before a bash shell started by the user starts. As far as I understand, the order is: /home/username/.bashrc (modifiable by user) /etc/bashrc (modifiable by root) /...
3
votes
0answers
254 views

How to protect an EnvironmentFile used by a systemd service?

Background I have multiple RESTful web services being deployed through Azure DevOps Release Pipelines to a CentOS VM. Each of these services is managed by systemd and uses environment variables to ...
17
votes
1answer
488 views

Security Implications of using unsanitized data in Shell Arithmetic evaluation

In a comment to a recent question, Stéphane Chazelas mentions that there are security implications to double parentheses arithmetic such as: x=$((1-$x)) on most shells. My Google skills seem to be ...
-1
votes
1answer
28 views

Install program in Wine and analyze traffic

I need to install a Windows program in Wine and I would like to analyze how reliable it is, that is, if it does not generate any connection that can transfer my information without realizing it. This ...
0
votes
1answer
77 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
0
votes
3answers
322 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
1
vote
1answer
22 views

How to know if Jenkins is patched on CentOS 7

I've been using rpm -q --changelog package_name to check if a certain cve vulnerability has been patched on my system. However, when I'm doing the same for jenkins, all I got was Sat Apr 19 ...
1
vote
2answers
126 views

What is the reason FreeBSD jails don't get the entropy pool

I've noticed that the FreeBSD script that generates entropy, bails out if it finds it itself is running from within a jail. # uname -srm ## notice: install of mfsBSD (https://mfsbsd.vx.sk) FreeBSD ...
2
votes
1answer
2k views

logging wrong passwords in /var/log/auth.log

/var/log/auth.log logs (among other things) failed login attempts to my debian linux. I was wandering if it is possible to ask it to log the password that was used in the failed attempt. This is ...
4
votes
3answers
3k views

Do I need a special firewall on a personal computer

I was wondering about Linux security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable and before used Ubuntu ...
0
votes
1answer
184 views

How can I make Linux as secure as possible? [closed]

With the rise of Windows 10 I am getting more concerned about my privacy and the risks of using an unsecured system. My question is three fold Which distro of Linux is most secure? How do keep the ...
3
votes
0answers
353 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
0
votes
1answer
103 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...
3
votes
0answers
116 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
-2
votes
1answer
94 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
7
votes
2answers
26k views

Allow a specific user or group root access without password to /bin/date

I'd like to give a user or group full root access to the /bin/date command, including any manner of arguments as defined in the man pages. I understand /etc/sudoers expects explicit command ...
1
vote
1answer
293 views

pf not stopping bruteforce attempts

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I have read many articles on how to get pf to stop brute force attacks and am not having any luck. ...
2
votes
3answers
2k views

How to password-protect a script on Linux?

How do you set a password to execute a command or script in Linux? I need to avoid a script (in which user and password details are included) from being used/executed from unauthorized users. So is ...
5
votes
1answer
225 views

How to fill a device with zeros, without overwriting the bytes that are already zeros?

I have a USB flash drive usb 3, the reading speed is much more than the writing speed. Let's say that 99% of the flash memory is already full with zeros, and I would like to fill it with zeros until ...
3
votes
1answer
2k views

Is there a way to get security updates for wheezy after EOL

I know the best solution would be to upgrade the server after Debian wheezy has reached End Of LIfe in May 2018, but is there a way to continue running an old wheezy instance and get some minimal ...
1
vote
3answers
5k views

Centos 7 Firewall Defaultly Not Working

I have a vps from godaddy and as i mention in article i have centos 7 in my system. The first things that i did as i headstart the server are; $ yum update $ yum install firewalld $ systemctl start ...
2
votes
1answer
43 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
0
votes
1answer
132 views

SSH IP access restriction using tcpwrappers is not working. (hosts.allow and hosts.deny not taken into account)

I am using sles-12 server and i am trying to restrict ssh access to my server to my pc alone. I have tried to use tcpwrappers and it's not working..!!. I am able to ssh to the server from any IP in my ...
0
votes
1answer
132 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
1
vote
1answer
81 views

Using command (dd if=/dev/mmcblk0p1 | sha1sum) while running from initramfs

I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com I have provided a method for installing LUKS full disk encryption seen at the following: https:/...
0
votes
1answer
85 views

Running Tor service in the jail environment

I want to torify my FreeBSD old machine purposed to mainly darknet activities. Questions: Should I worry about these errors during creating jail? Warning: Some services already seem to be listening ...
1
vote
1answer
74 views

Spectre V2 on Linux

I have a 64Bit PC Running Ubuntu. The processor (AMD E1-1200) did not receive microcode updates for Spectre protection. What is the best strategy to stay secure? How do you treat the problem?
75
votes
8answers
68k views

Does /usr/sbin/nologin as a login shell serve a security purpose?

In my /etc/passwd file, I can see that the www-data user used by Apache, as well as all sorts of system users, have either /usr/sbin/nologin or /bin/false as their login shell. For example, here is a ...
1
vote
1answer
66 views

I'm wondering about CUPS security. What can I do?

I run Debian Wheezy on a old Acer Aspire One ZG5 model netbook as a server. I have a printer shared to all my other systems and I'm worried about security. On the server I have IPtables set up to ...
1
vote
1answer
165 views

Bitnami Moodle Apache module mod_evasive don't work at all

I have Debian 9 with Apache/2.4.29 (Bitnami appliance with Moodle). I'm trying to secure web server with mod_evasive and mod_security modules. I installed the module: apt-get install libapache2-mod-...
50
votes
2answers
80k views

What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading ...
1
vote
1answer
1k views

How to know who accessed a file or if a file has 'access' monitor in linux

I have some questions about viewing who accessed a file. I found there are ways to see if a file was accessed (not modified/changed) through audit subsystem and inotify. However, from what I have ...
-1
votes
3answers
146 views

How to prevent “rm -rf ~” from being executed by mistake?

Is there any way to completely prevent this command from being executed, by mistake, in the terminal? I know that bash, for instance, has aliases. Is there a way to use them?
0
votes
1answer
37 views

Who have previously accessed a shared file?

I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, ...
2
votes
2answers
95 views

lockout local logins on reverse-ssh appliance

I have set up a reverse-ssh appliance with a Raspberry-Pi for use at a customer site to connect to a piece of equipment I have to support via a USB-to-RS232 adapter. I've cleared this with the ...