55

cp isn’t vulnerable to this race condition. When --no-clobber is set, it checks whether the destination already exists; if it determines it doesn’t, and it should therefore proceed with the copy, it remembers that it’s supposed to copy to a new file. When the time comes to open the destination file, it opens it with flags which enforce its creation, O_CREAT ...


41

Any application launched from under the current user has access to the keyboard, mouse, display (e.g. taking a screenshot), and this is not good. All the X11 clients on a desktop can access each other in depth, including getting the content of any window, changing it, closing any window, faking key and mouse events to any other client, grabbing any input ...


33

It's marginally "unsafe" It was marginally "unsafe" before the addition of scp -T in OpenSSH 8.0 and it still is marginally "unsafe" when using scp -r. Like other answers have stated, claims that scp is unsafe come from the client's previous inability to verify that it's receiving what it requested. The reason why scp couldn't verify is because the request ...


9

Applications running on the same machine with the same user account can use the ptrace system call to modify each other's process memory, so X11 is not the most convenient attack surface here. For applications you don't fully trust, you need to first run them with a different user ID (like Android does with applications from different vendors), and you can ...


4

Common practice ? Definitely. Good practice ? It depends on your threat model and how sensitive the data you are trying to protect is. I for example like to use PGP with smart cards and use a reader with a PINpad. Thus, a keylogger cannot steal the passphrase. If the computer is stolen, the subkeys are not stored locally. Then the risk of compromise of my ...


4

There's a lot of confusion about the new OpenSSH changes to scp made in response to CVE-2019-6111, and how safe they're supposed to make everything. Their purpose is to prevent a rogue server used as source for the files from sending other filenames than requested, and overwrite random files on the local machine. But they have no effect when the -r option ...


3

I have to mention, that the umask is also set in /etc/profile for all accounts to 022. Every shell that uses /etc/profile will override the umask set by pam_umask.so. So you should set the umask in /etc/profile also to 0077 if you want a system wide umask.


3

SSH does not send your private keys to the server. The mechanism is based on calculation using what the entity possesses - the server computes something based on the public key, the client based on the private key (see this Information Security Stack Exchange post for more). In any case, whether you add the keys to the agent or not, SSH tries all keys until ...


3

I have no idea about how it got past a NAT. But I will answer the rest. A port is not a protocol: While ssh is usually on port 22, and http on port 80. This is only so we can find them easily. There is nothing fixed about these protocols and ports. What seems to have happened is a web-browser (or web-spider) has tried to connect to port 22 (maybe it is ...


2

On the presumption that you did not create the admin account locked, or explicitly lock it, and that it has a password that you know: SSH in as pierre. Switch user to admin with the admin account's password. su admin Rename ~admin/.ssh out of the way to (say) ~admin/.ssh-pierre. mv -i ~/.ssh{,-pierre} Create a new ~admin/.ssh owned by admin. install -d -m ...


2

Add the -p option to ss, it will list the processes using the ports: ss -ultnp To see all processes, you’ll need to run it as root: sudo ss -ultnp


2

/proc is the interface between the kernel and userspace for all its contents, and most of those contents aren’t available in any other way (for content under pid directories, outside of that process). So hidepid=2 is effective in hiding information such as a process’ command line and environment from other users. Some information can be determined through ...


1

You could use pam_tally2 and pam_exec to achieve this result. If you add the following at the beginning of /etc/pam.d/login, the system should shutdown on the 6th attempt after 5 failed logins. auth [success=1 new_authtok_reqd=ok ignore=ignore default=bad] pam_tally2.so onerr=succeed deny=5 even_deny_root unlock_time=30 auth required pam_exec.so /usr/bin/...


Only top voted, non community-wiki answers of a minimum length are eligible