New answers tagged security
0
This helps:
https://wiki.archlinux.org/index.php/ECryptfs#Encrypting_a_data_directory
I am actually not encrypting the whole home right now. I am scared of messing up, my disk space is limited, and there is a bunch of stuff which is overkill to be encrypted (e.g. Music).
0
I'm using ufw (Uncomplicated Firewall) for this, and hence wanted to contribute my setting. Ufw uses iptables in the background, but with a much simpler interface for such simple tasks.
I just had to issue:
sudo ufw allow from <your-ipv4-here> to any port 22
sudo ufw allow from <your-ipv6-here> to any port 22
That's it.
Of course you could also ...
0
Had the same problem and found this solution from Mr Postfix himself:
/etc/postfix/master.cf:
192.168.1.1:smtp inet n - - - - smtpd
127.0.0.1:smtp inet n - - - - smtpd
-o smtpd_tls_security_level=may
This, together with smtpd_tls_security_level = encrypt in main.cf (as a global ...
0
I also have this error after multiple ssh -Y to a host.
I managed to get a prompt for the passphrase by adding the --pinentry-mode loopback option.
1
Pluggable Authentication Modules (PAM) is a (not really) newer generic API for authentication originally proposed by Sun Microsystems in 1995 and adapted a year later on the Linux ecosystem. With an API change, don't expect things to keep the same name (nor to always map exactly the same).
from man pam_unix:
OPTIONS
[...]
minlen=n
Set a minimum password ...
0
Inspired by Fuseteam, I wrote a script called stprompt:
#!/bin/bash
prompt="$1"
answer=$(st -o "-" -g 100x5 -c st-prompt sh -c "echo -n '$prompt: '; read -s ANSWER; echo \$ANSWER")
echo "${answer#*: }" | tr -d '\r'
This script prompts the user, hides the input, and will output the response.
For your specific case, ...
1
Problem solved. The logging was actually working, but in my rule file I already had the rule
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid!=4294967295 -k file_access_denied
which monitors all attempts on all files. I forgot about that rule, and audit only logs the first instance of the rule. ...
2
Which firewall rule is considered if i 'drop' first then later adding 'accept' rule. drop or accept?
The -A flag appends to the set of rules. Using -I inserts a rule either at the beginning of the chain or at the numbered position. Rules are processed in order, so the first rule you added will be processed first and the second will never be actioned.
You can see the full set of rules for your INPUT chain with iptables -nvL INPUT.
Since you're on CentOS you ...
1
Since this question is so old, though, I suppose the current answer should be that logwatch now supports systemd-journal, so, the question is no longer accurate. (I don't know when this feature was added, but at least as early as version 7.4.3 from what I can tell.)
2
I use journal-brief as a replacement for logwatch, thought it doesn't work quite the same way.
https://libraries.io/pypi/journal-brief
0
Try turning off your firewall, and ssh'ing into your server.
TYPE
last
to see the IP you are coming from.
Turn on iptables while you reconfigure with the new (I expect) IP address.
0
Run in any terminal:
zip -r firefox.zip .mozilla
Upload firefox.zip to virustotal.com (mind that by doing that you'll share with them your browsing history, saved passwords and open website sessions).
0
From the output you showed i believe that your full UDP scan is giving you the same results as the single/multiple port scan. The output from your full scan says "All 65535 scanned ports on 192.168.232.2 are open|filtered because of 65535 no-responses". The other scan identified both ports also as "open|filtered". This means that nmap ...
0
For the browser, it is pretty easy to remove the folder, download and install it again. Alternatively, you could download the current version and compare the two folders.
For the profile, usually malware comes via extensions, so you can run Firefox without them (safe mode) and see if the suspect behaviour still happens. Or you can individually disable the ...
13
I think https://fedoraproject.org/wiki/Changes/EnableSysctlPingGroupRange answers your question:
Enable the Linux kernel's net.ipv4.ping_group_range parameter to cover all groups. This will let all users on the operating system create ICMP Echo sockets without using setuid binaries, or having the CAP_NET_ADMIN and CAP_NET_RAW file capabilities.
Cross-...
5
from Fedora 31 kernel parameter net.ipv4.ping_group_range has been set to cover all groups.
This will let all users on the operating system create ICMP Echo sockets without using setuid binaries, or having the CAP_NET_ADMIN and CAP_NET_RAW file capabilities.
sysctl net.ipv4.ping_group_range
net.ipv4.ping_group_range = 0 2147483647
Top 50 recent answers are included
