5

Escaping to a local shell means just that -- the user now has a shell on the client, not on the server. Touch a file in /tmp on both systems (named differently!) to see the difference.


4

The safest Linux-based distributions are those which limit the users’ ability to change them, and which isolate applications from each other. One good example is Fedora Silverblue: the base operating system is immutable, and applications are provided using container-style techniques. A recent blog post on the topic describes the advantages in a little more ...


3

No, most, if not all, places where you can have hostnames in .ssh/config also allow wildcards, and you can't realistically guess any wildcard-string that could potentially match your target hostname. (This is completely leaving aside that there are many other configuration statements where hashing does not make sense at all, because you need to read the ...


2

This is only for apt systems, other package managers will be different. Are they stored all in one place? Do you mean the package archives or the files pointing to the repository? Package archives are stored in /var/cache/apt/archives. The specific repo files or entries are stored in /etc/apt/sources.list or /etc/apt/sources.list.d/*.list. Note that ...


2

By simply setting it to 0 again: sudo sysctl -w kernel.unprivileged_userns_clone=0


1

I'm not running ubuntu, but I don't think that's possible in newer versions of glibc. See this commit. Short of writing your own stack smashing detector, of course. You can have a look at the source of the function printing that message: void __attribute__ ((noreturn)) __fortify_fail_abort (_Bool need_backtrace, const char *msg) { /* The loop is added ...


1

I'll answer the general question here, on the line of @MichaelHomer comment, because I think he hit the crucial point: honestly, not copying and pasting (sudo!) code off the internet that you don't understand is probably the biggest thing to be careful about for your security You ask "What is important to be careful about (for your security) when adding ...


1

I see two ways you could do this: You could try disabling all repos except the one that has the package you want, thus querying and installing from that repo alone. See the yum manpage for repolist, --disablerepo, and --enablerepo. The other option would be to download the RPMs for that package and its dependencies and install those: repoquery --requires --...


1

You will not find two different packages for the same software, in the same branch, one patched and another not. So, an update generally includes a security fix. .: Francesco


1

No, it is not possible using Linux File Permissions. Admin/root has access to any file and directory on your system. You could use encryption (e.g. a Luks container).


1

Piping your audit line through ausearch -i at least gets the most information out of it: » echo "type=SYSCALL msg=audit(1561851079.335:286): arch=c000003e syscall=9 success=yes exit=140507297914880 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=22818 pid=24283 auid=1005 uid=1005 gid=1005 euid=1005 suid=1005 fsuid=1005 egid=1005 sgid=1005 fsgid=1005 tty=pts0 ses=89 ...


1

You can add the service you want to be managed by regular user to sudoers file: Adding commonads in sudoers: https://www.atrixnet.com/allow-an-unprivileged-user-to-run-a-certain-command-with-sudo/ example command: <your-user> ALL=(ALL) NOPASSWD: /usr/bin/systemctl start program.service


Only top voted, non community-wiki answers of a minimum length are eligible