What prevents me from just editing the /etc/shadow file in unencrypted systems?
Nothing, there is no specific protection for /etc/shadow. Some systems might have tampering detection, so the system administrator would know that /etc/shadow was changed (unless you also overrode the tampering detection, typically by updating it so it considered your modified /...
dpkg-sig --list <deb-file.deb>
will list any items in the file which look like a signature, without verifying the file. This will list the role of any signature in the file; e.g.
$ dpkg-sig -l vuescan_9.7.50-1_amd64.deb
$ dpkg-sig -l zstd_1.4.8+dfsg-2.1_i386.deb
The /etc/ssl/certs/ca-certificates.crt is a long text file of concatenated certificates, each in PEM format. To view details of each one, you need something like:
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout
This creates a temporary PKCS#7 file of all the certificates in the file, then prints ...
There are no easy answers.
Your priority should be to find out what piece of software actually allowed this, because so far you haven't closed off the attacker's means of access, only prevented them from installing a crontab. You know it was most likely a web application, but you don't know which one.
When I am investigating such things I first try to ...
You can edit it directly, but making a wrong entry can cause damage to the OS, even making it inoperable which is why the program vipw (with -s flag) loads a temporary copy to make edits in and checks the syntax before saving and overwriting it.
Since Linux-PAM 1.4.0 (8th June, 2020) pam_tally and pam_tally2 were deprecated and pam_faillock was introduced, version 1.5.0 (10th November, 2020) removed pam_tally and pam_tally2
If your distro provides pam_faillock use that one, if not use pam_tally2
This information can be gathererd using the passwd utility.
From man passwd
Display account status information. The status information consists of 7 fields. The first field is the user's login name. The second field indicates if the user account has a locked password
(L), has no password (NP), or has a usable password (P). The third field gives ...
If you mean "system users", ones for some particular service, like sshd, postfix or www-data (just to pick some), they usually have their password set to something like * in /etc/shadow. It's not empty, but it's also not a valid password hash, so can't be used to authenticate against.
(The way password-based authentication works is that the ...
There are three issues I can see:
you're using chdir(2) on a file descriptor. The correct system call should be fchdir(2).
Although it might be possible python is smart enough to use fchdir() instead.
After using fchdir(2) you have to chroot(2) again so you current directory is again inside the "known space" of the current root tree.
You can't ...
Port 514 is sometimes used for Remote Shell, a command called rsh. It is for remote control of a server but by default does not provide for encryption or passwords. Almost like telnet but with a shell around it.
It is legacy software that most people do not use. Instead, ssh is the secure (remote) shell that everyone uses.
The short version is that this is very hard and always involves encrypting the files and preventing users from finding the decryption key.
Attempts to do this at an industry level (DRM) have repeatedly failed (Eg: here, here and here) because someone has always managed to "find" the private key. Once someone find's the key and publishes it, ...
If you can read a file (play it back/open it), you can copy it.
You can encrypt the file (DRM) and require the user to use a proprietary player to open the file, but even that is not 100% protection, because a clever user will either extract the decryption key from the player, or will capture the decrypted file stream from memory as it’s played back. Finally,...
DynamicUser is more secure because it implies:
ProtectSystem=strict: The entire file system hierarchy is mounted read-only, except for the API file system subtrees /dev/, /proc/ and /sys/.
ProtectHome=read-only: The directories /home/, /root, and /run/user are made read-only for processes invoked by this unit.
PrivateTmp=yes: Sets up a new file system ...