New answers tagged security
3
votes
Letting a stranger in safely
Remove that sudoers line!
You don't need to say that someone can't have access as that's the default. Furthermore you're opening up a major security hole with a trivial attack surface. These commands ...
- 108k
3
votes
Letting a stranger in safely
You don't have to do anything. By default a user does not have sudo access, and to use su the user needs the root password.
As long as you don't explicitly allow a user to use sudo, either by adding ...
- 836
0
votes
Moving /var, /home to separate partition
mounting your /var directory on a different partition. Let’s get started by attaching a new LVM, partitioning, and creating a desired file system.
Create a LVM Using New Disk: /dev/sdb
# pvcreate /dev/...
- 11
0
votes
chkrootkit reports possible malicious Linux.Xor.DDoS installed - how do I verify?
This is due to the install of docker-compose, see https://github.com/docker/compose/issues/4388
It's because of the use of https://pyinstaller.org/
You can remove this directory.
It's a false positive....
- 32.2k
1
vote
Accepted
OpenSSH: how to disallow weak (<2048 bits) RSA keys
The RequiredRSASize option was added in OpenSSH 9.1, released on October 4th, 2022:
ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum
RSA key length. Keys below this length will be ...
0
votes
How can I prevent normal users from being able to look up other logged-in users?
If you create a chroot environment for your users, then you'll have complete control over the available commands.
- 244
0
votes
How to add my own created certificate authority to system trusted repositories
Copy the PEM file with your root certificate to /etc/pki/ca-trust/source/anchors/
Run sudo update-ca-trust
- 244
2
votes
How to prevent the messages about REMOTE HOST IDENTIFICATION HAS CHANGED
If only for connecting to 127.0.0.1 (localhost) matters, then this ssh option should work:
-o NoHostAuthenticationForLocalhost=yes
This option has existed since at least OpenSSH 3.7 (from 2003).
- 133
0
votes
How pssh do the ssh activities without password
Your pcommand sets the ssh option PubkeyAuthentication=yes. This means it will use a key pair to log in instead of passwords. The private key is on the machine where you run this. Check whether the ...
- 244
0
votes
How to create a virtual FIDO U2F passkey for Chromium?
Passkeys (as implemented by Google/Apple) have some additional features on top of the standard FIDO2/WebAuthn HSKs (hardware security keys like Yubikey/Solokey) such as multi-device access, cross ...
- 118
1
vote
How can I enable/disable a jail using fail2ban?
The proper way is to create a file /etc/fail2ban/jail.d/service.local or edit /etc/fail2ban/jail.local:
[service]
enabled = true
Don't forget to restart fail2ban:
systemctl restart fail2ban.service
...
- 32.2k
1
vote
Is listing files with ls dangerous as stated on gnu.org documentation?
The danger is not in solely running ls. The danger is in typing or pasting its output. E.g. from an untrustworthy source you can get a file named &date;. If you run some traditional ls (or GNU ls -...
- 19.4k
8
votes
What program in Linux computes the hash of the input password when you log in?
when we input the credentials in the login prompt, the hash of the password is computed and then that hash is compared with the hash stored somewhere, and if I am not mistaken that "somewhere&...
20
votes
What program in Linux computes the hash of the input password when you log in?
No specific binary does the hashing; it's done by a library call crypt(3). So, in theory, any program (even a perl script) can generate the hash. e.g.
perl -e 'print crypt("hello","\$...
- 42.9k
3
votes
What program in Linux computes the hash of the input password when you log in?
The binary responsible for computing the hash of the input password is typically part of the authentication system and is not implemented by the kernel. In most Linux distributions, this is handled by ...
- 47
0
votes
Accepted
Make a custom, signed EFI executable? (safeboot.dev)
You're looking for a Unified Kernel Image, which is a single executable consisting of a kernel, initrd and command line (and possibly some other things), which can then be signed for secure boot. The ...
- 165
0
votes
Is it possible to list all processes which connected to particular ip and port?
The format is:
lsof -i [tcp|udp][@hostaddr][:[service name|port]]
E.g.,
lsof -i [email protected]:443
See lsof(8).
- 1
Top 50 recent answers are included