Questions tagged [security]

Content related to computer security., i.e. content about policies, mechanisms, etc. needed make sure data is not leaked or corrupted and services available in all circumstances.

Filter by
Sorted by
Tagged with
2
votes
3answers
8k views

How to make sure that iptables is completely disable?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting to ...
0
votes
0answers
74 views

Permanently disable all networking in Tails OS?

I would like to use Tails OS to create a pseudo air-gapped system. The system has WiFi hardware still, but it is "unusable" in Tails due to lack of firmware. I would like to further ensure it remains ...
0
votes
0answers
357 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
24
votes
12answers
10k views

How to create strong passwords in Linux?

I wonder how I can create strong passwords on Linux (for both normal and admin users) and if there are specific programs to do that.
1
vote
1answer
356 views

Should I have intel-microcode installed if my UEFI/BIOS is regularly updated (new machine)?

Hardware: Dell Inspiron 15 Gaming 7577, model number 7577-92774 (new machine). System: I am testing Linux Mint 19 Beta based on Ubuntu 18.04. I have an Intel Kaby Lake CPU: Intel© Core™ i7-7700HQ ...
2
votes
1answer
45 views

Where to verify and review various packages before installing them

I am setting up a Debian Wheezy server for my domain name. I am not sure where I can find a community that reviews those packages for safety. I am looking for postfix package, as an example. Which ...
10
votes
4answers
10k views

Debian: Which firewall?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there an easier way to install/configure a firewall?
2
votes
2answers
92 views

Switching from Win10 to Linux: AV, defrag, disk cleanup tools, etc [closed]

I installed Linux Mint on my desktop in place of Windows 10. I am used to having virus/malware Scanners, defragmenters, Disk Clean up tools etc. I was wondering if people here would be able to ...
1
vote
1answer
393 views

how to install bastille to kali linux

I'm just asking why kali show this phrases "E: Package bastile has no intallation candidate" .
0
votes
1answer
295 views

Can I lock down access to a TCP port in Linux

I'm trying to secure a single-node Elasticsearch machine. Basically, I want to put Elasticsearch behind a reverse proxy (nginx) and make sure that the only way any user or process can communicate with ...
0
votes
1answer
273 views

Intel® SGX™ (Software Guard Extensions™) and Linux Mint 19 driver installation

As I have the 7th gen Intel CPU (i7-7700HQ) and in UEFI BIOS there is a possibility to Enable Intel® SGX™ (Software Guard Extensions™), I would like to do so. In order to do that, I am unsure, if I ...
2
votes
2answers
321 views

Enabling SELinux on RHEL

I am using RHEL 6.5 and I need to enable SELinux. I have tried following commands, but it does not work: $ setenforce 1 $ echo 1 > /selinux/enforce Note: I also tried editing /etc/selinux/config, ...
50
votes
4answers
28k views

Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt? set imap_user = "username@gmail.com" set ...
0
votes
1answer
46 views

How to get a working clock on Debian 9? Clock is wrong by a couple minutes

How to get a working clock in Debian 9 with KDE? My clock is almost 10 minutes slow on multiple of my machines running Debian 9 with KDE and (re)setting the timezone via tzselect didn't work. (I ...
-5
votes
1answer
302 views

Installing Kali Linux along with Windows 10

I have recently purchased an ASUS ROG GL552vw from UK and its pre-installed with windows 10, I'm trying to install Kali Linux as the second OS but the PC can't boot from CD/DVD or even from a bootable ...
22
votes
4answers
4k views

How can I limit ssh *remote* port forwarding?

I need to limit which ports can be remotely 'ssh -R' forwarded by an user. I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding ...
19
votes
8answers
3k views

Is there a shell that checks to make sure the code is signed?

I was messing around with PowerShell this week and discovered that you are required to Sign your scripts so that they can be run. Is there any similar secure functionality in Linux that relates to ...
1
vote
1answer
315 views

What happened to elfsign and elfverify?

In "Uninformed Research -- informative information for the uninformed." 2003 mentions a tool called elfsign and elfverify. This is a tool to checksum and sign an ELF binary. I can't find that tool in ...
3
votes
1answer
375 views

Security review: classifying ssh log-in attempts [closed]

I see my own ssh logins to an AWS EC2 Ubuntu Linux instance as Nov 18 07:32:21 ip-10-20-30-40 sshd[9487]: Accepted publickey for ubuntu from 15.26.37.48 port 46273 ssh2: RSA SHA256:e37A/...
1
vote
2answers
317 views

How to allow external networks connect via ssh to the internal server using iptables [closed]

I am having a firewall with the IP of 10.0.0.2/24 which is the default gateway as well. I need to allow external networks to be able to SSH to the Server which its IP is 10.0.0.1/24. I have to use ...
7
votes
1answer
270 views

Root privileges can be restored after setuid(1000) in musl libc

musl libc allows you to change uid to root even after supposedly dropping permissions with setuid(1000). I am not able to reproduce the problem with glibc. Code: #define _GNU_SOURCE #include <...
1
vote
0answers
37 views

Solving Screenlock Bypass Issue for Expired User Account

I have created a script that I deploy to my children's computers via Salt. The script implements allowed working hours and has worked well, but one of my children have found a way of bypassing this ...
0
votes
1answer
27 views

Ubuntu 14.04 install “old lamp” stack for penetration testing

I am preparing WAF video for my team and I want to test a sample ubuntu server which will be my victim. I'd like to install "old version" of packages and deploy Wordpress on top of it and use some ...
0
votes
1answer
78 views

How to use sed to obfuscate an IPv6 address

I have the following sed command sed -i 'test.log' -e 's/\([0-9a-fA-F]\{1,4\}\:\)\{7,7\}[0-9a-fA-F]\{1,6\}/\1\w/g' The goal is to erase the last two blocks of the IPv6 address. However, this sed ...
6
votes
1answer
207 views

What is the purpose of extrausers?

Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /...
1
vote
1answer
78 views

Why not allow all users to schedule jobs with crontabs? [closed]

By setting /etc/cron.allow and/or /etc/cron.deny it's possible to restrict what user is allowed to use crontabs to schedule a cron job to run as that user. At least at my office our SAs default to ...
5
votes
2answers
579 views

How safe is SSH when used for tunneling?

Scenario: I want to connect from Client A to Client B using SSH/SFTP. I can not open ports on either client. To solve this issue, I got a cheap VPS to use as a relay server. On Client B I connect to ...
0
votes
1answer
69 views

How to add a new user and disable its root login? [closed]

A sysadmin may want to add a new user that will have no root access (nor sudo). I don't sell hosting services but I can bring this field as an example; an hosting company gives its customers the ...
0
votes
2answers
103 views

Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?

The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
0
votes
1answer
951 views

airmon ng ls: cannot access '/sys/class/ieee80211/': No such file or directory

Im using ubuntu bionic (UBUNTU WSL) I can't use airmon-ng! It throws the following ls: cannot access '/sys/class/ieee80211/': No such file or directory I checked airmon-ng: ls: cannot access '/...
-1
votes
1answer
39 views

Is someone spying me through my webcam?

I executed the following command in terminal and got the output: Command: lsmod | grep uvcvideo Output: uvcvideo 86016 0 videobuf2_vmalloc 16384 1 uvcvideo ...
0
votes
2answers
1k views

How can I hide my IP from linux who command [closed]

I am a Linux system admin, I will login every system of my local network. I don't want my IP to show up via who command. For example, if someone enters: $ who it reveals my IP. Is there any way to ...
-1
votes
1answer
90 views

SSH and VNC security issue question

My Centos 7.5 server in the past few days got thousands of incoming SSH login attempts and today I couldn't log in to my VNC clients because it just said "Too many security failures". So would like to ...
2
votes
0answers
577 views

Yama LSM seems to do nothing. RHEL/Centos 7.5

The Yama security module is supposed to be able to prevent users from running the ptrace system call, yet even with kernel.yama.ptrace_scope set to 3, users can still run strace (which uses ptrace). ...
2
votes
3answers
86 views

Is it safe to auto-login if the system is encrypted?

I'm running linux (specifically Debian 9) on my everyday-use laptop, where the disk with the system is encrypted, so whenever I boot it up, the password is required prior to entering the system. In ...
1
vote
1answer
338 views

SELinux vs AppArmor applicability

I am going through some primers on LSM implementations so eventually I am digging a bit into AppArmor and SELinux. I am aware of this discussion but this does not make very clear one question I am ...
1
vote
1answer
68 views

LUKS header modified? [closed]

When a LUKS password is sent to the LUKS header for decryption, can it be stolen by a hacker who modified the LUKS header? Suppose my boot partition is healthy.
3
votes
1answer
558 views

Where to put the SElinux policy generated by audit2allow?

I'm using CentOS7 minimal. I've installed acpid and the daemon is running. When I hit the power button, I get the following in /var/log/messages May 2 18:52:53 localhost systemd-logind: Power key ...
3
votes
1answer
139 views

How to access only world readable files in SElinux sandbox

I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students ...
7
votes
1answer
5k views

Why is the default umask 002 or 022 in many Unix systems? Seems insecure by default [closed]

I have been using Linux & Unix for a long time. The first time I learned Unix is in a computer classroom with many students, where the instructor told us that you can use ssh to log in to remote ...
3
votes
1answer
175 views

Is it possible to prevent a change in SELinux status without a reboot?

I'd like to be able to prevent even a privileged user from changing the SELinux mode from enforcing to permissive without a reboot. It's too easy for a root user to run setenforce permissive, make ...
1
vote
1answer
139 views

Is 'xhost local' (no colon) allowing malicious access?

I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly ...
0
votes
3answers
5k views

how to check if firewall is stopped on redhat 7

What is the elegant way to verify if firewall is stop/inactive on redhat 7 machines? example: we stop the firewall: systemctl status firewalld.service and my approach to verify the firewall ...
0
votes
1answer
129 views

What is postscreen_dnsbl_reply_map use for?

What is the meaning of postscreen_dnsbl_reply_map in postscreen (postfix) ? I've read from documentation: if your DNSBL queries have a "secret" in the domain name, you must censor this information ...
0
votes
2answers
218 views

iptables allow everything, is it safe?

The os is Ubuntu Server 18 and I am running a web server on it. Is it safe to accept all traffic on all ports? iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT I tried ...
1
vote
2answers
300 views

What's the difference between adding scripts in the /etc/cron.daily/ or editing in your script in crontab(-e)?

There are multiple options - with cron - to start your script at a specific time, but is one more secure over the other? My question is simple: What's the difference between adding scripts in the ...
2
votes
1answer
40 views

The password of previously encrypted volume got changed by the Debian installer

I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community. Short version of the issue: ...
2
votes
0answers
74 views

How important is os-variant for kvm configuration?

When searching the internet one can always read that specifying os-variant is important so KVM can optimize the guest system. Nowhere did I find an article, manual or documentation stating how ...
4
votes
1answer
516 views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
1
vote
1answer
151 views

How to make a port appear as being open every time it is scanned with nmap independently of its open/close state?

To make one open port undetectable with an external nmap scan, it seems easier to make all other scanned ports appear as being opened than to try to make this port appear as being closed. How can I ...