New answers tagged

0

Keys imported using rpm --import are only used to verify RPM packages, not YUM repos. yum stashes its own keys deep in /var/lib/yum/repos. It keeps a separate keyring for each repo. What you could do, if you really don't want to trust the remote keys at repo installation time, is download the keys separately, then set a local path as the gpgkey field for the ...


1

Port 514 is sometimes used for Remote Shell, a command called rsh. It is for remote control of a server but by default does not provide for encryption or passwords. Almost like telnet but with a shell around it. It is legacy software that most people do not use. Instead, ssh is the secure (remote) shell that everyone uses.


0

Add this after the UsePAM yes in /etc/ssh/sshd_config AuthenticationMethods publickey,keyboard-interactive


2

This information can be gathererd using the passwd utility. From man passwd -S, --status Display account status information. The status information consists of 7 fields. The first field is the user's login name. The second field indicates if the user account has a locked password (L), has no password (NP), or has a usable password (P). The third field gives ...


2

If you mean "system users", ones for some particular service, like sshd, postfix or www-data (just to pick some), they usually have their password set to something like * in /etc/shadow. It's not empty, but it's also not a valid password hash, so can't be used to authenticate against. (The way password-based authentication works is that the ...


0

Basically there are no side effects. Check this out that might interest you.


0

man adduser helpfully shows the option --disabled-password. Or use the traditional useradd which does not ask for password at all.


1

The short version is that this is very hard and always involves encrypting the files and preventing users from finding the decryption key. Attempts to do this at an industry level (DRM) have repeatedly failed (Eg: here, here and here) because someone has always managed to "find" the private key. Once someone find's the key and publishes it, ...


3

Since Linux-PAM 1.4.0 (8th June, 2020) pam_tally and pam_tally2 were deprecated and pam_faillock was introduced, version 1.5.0 (10th November, 2020) removed pam_tally and pam_tally2 If your distro provides pam_faillock use that one, if not use pam_tally2 Source: https://github.com/linux-pam/linux-pam/tags


1

If you can read a file (play it back/open it), you can copy it. You can encrypt the file (DRM) and require the user to use a proprietary player to open the file, but even that is not 100% protection, because a clever user will either extract the decryption key from the player, or will capture the decrypted file stream from memory as it’s played back. Finally,...


-1

My guess (and it's just a guess) is that it was a random ssh attack. Bots often try to log into random IP addresses with common usernames and a dictionary of passwords. I guess this because the process with the large overhead is sshd and a common username is www-data. A couple of ways to fix this: Disallow www-data to login (it's usually a system user, so ...


1

DynamicUser is more secure because it implies: ProtectSystem=strict: The entire file system hierarchy is mounted read-only, except for the API file system subtrees /dev/, /proc/ and /sys/. ProtectHome=read-only: The directories /home/, /root, and /run/user are made read-only for processes invoked by this unit. PrivateTmp=yes: Sets up a new file system ...


0

You need a NSS/PAM service running on your Linux boxes such as sssd, nss-pam-ldapd (aka nslcd) or Samba's winbindd. Both have NSS and PAM frontend modules which you have to reference in /etc/nsswitch.conf and /etc/pam.d. You can find various how-tos describing such a setup for using MS AD as LDAP server. You should read several of them to understand all the ...


3

There are no easy answers. Your priority should be to find out what piece of software actually allowed this, because so far you haven't closed off the attacker's means of access, only prevented them from installing a crontab. You know it was most likely a web application, but you don't know which one. When I am investigating such things I first try to ...


0

Officially, it looks like you have to update your official sources to archive based on this linked closed-github issues thread and this official debian note (security link). The Freexian project mentioned in this answer (by Stephen Kitt) looks like a good option but mentions it will not be supporting a lot that is in debian and it will continue to drop ...


0

Short questionable answer: https://en.wikipedia.org/wiki/Security_through_obscurity Long answer: Your point of view is completely acceptable. GNU/Linux was designed without security through obscurity in mind. Some examples: /etc/passwd - everyone in your system is allowed as default to discover whatever user and group exist. This is fine because the only ...


3

You can edit it directly, but making a wrong entry can cause damage to the OS, even making it inoperable which is why the program vipw (with -s flag) loads a temporary copy to make edits in and checks the syntax before saving and overwriting it.


7

What prevents me from just editing the /etc/shadow file in unencrypted systems? Nothing, there is no specific protection for /etc/shadow. Some systems might have tampering detection, so the system administrator would know that /etc/shadow was changed (unless you also overrode the tampering detection, typically by updating it so it considered your modified /...


-2

NOTE: the task described in the original question can be achieved in a safe way using sudo and sudoers configurations. This answer is going to stay for people that are still committed in running scripts with setuid, also after being warned of security implications. The method described also put bases for writing a more robust treatment of environment, like ...


1

Native Linux filesystems which sport defragmentation (ext4/xfs) don't offer the luxury of choosing where your files end up being, so your only option seems to be backing up your data, repartitioning and restoring. Backing up data is crucial anyways. Just moving your user data somewhere will not save you from from mechanical/electrical failures of your disk ...


0

Package signing is automatically done by apk. The packages built in the repo are signed and when installed are checked with the keys you can find in /etc/apk/keys, so it works out-of-the-box if you are using official repositories. If you are planning to add some custom packages built by yourself, you need to add your keys in /etc/apk/keys. These keys can be ...


6

Since you’re using Ubuntu, you should follow the procedure for filing security issues there. In most cases, that involves filing a bug in Launchpad, making sure that the checkboxes for security issues are appropriately checked so that the security team is notified and the bug isn’t made public.


Top 50 recent answers are included