Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

Filter by
Sorted by
Tagged with
5 votes
1 answer
1k views

Explanation of capabilities: CAP_NET_BIND_SERVICE

I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain. I am in a VM (Kali). ❯ uname -a ...
cactuschibre's user avatar
1 vote
0 answers
231 views

Is "pam_ssh_agent_auth" more secure than passwords for sudo on a remote server?

I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/...
student_at_work's user avatar
0 votes
0 answers
73 views

Making time(0) produce an error

I'm currently reviewing/reversing a software (coded in C) and it has a line like this : time_t var = time(0); My goal it to get this time(0) call to return -1. (I cannot modify the parameter.) ...
531-M31C's user avatar
1 vote
1 answer
435 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
Alexis Wilke's user avatar
  • 1,007
0 votes
1 answer
135 views

How do you trust two different cloud provider servers?

I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
Sir Muffington's user avatar
1 vote
1 answer
306 views

Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?

I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
Kalcifer's user avatar
  • 173
-1 votes
1 answer
137 views

Confused about memory examination using gdb

I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination. When I disassemble main, I get an output of all memories where the ...
jprossv's user avatar
1 vote
1 answer
223 views

Purpose of Real UID in spite of setresuid()

While reading the manual page of setresuid() a question arose about the purpose of Real UID. As mentioned in the man page: setresuid() sets the real user ID, the effective user ID, and the saved set-...
Amit Gabay's user avatar
1 vote
1 answer
232 views

Details: snoop environment variables using D-Bus IPC

The page at: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment says: Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC [...] I don't ...
Jeff Hemmen's user avatar
0 votes
1 answer
88 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
SandMan's user avatar
0 votes
1 answer
135 views

Honeyd not responding to TCP

I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
DavidM's user avatar
  • 1
1 vote
2 answers
183 views

What ways other than password and authorized SSH key are there to log in to a Linux system?

When deleting a user on a Linux system, if you lock their password and kill all their processes, a logged in user disconnects and can't log in with his password anymore. But if they still have an ...
lolz's user avatar
  • 11
1 vote
2 answers
238 views

How does /dev/random not leak future bytes from old ones

I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index. I know /dev/random should be ...
Xephobia's user avatar
0 votes
0 answers
56 views

SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?

I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
Ben Holness's user avatar
2 votes
1 answer
374 views

How to keep data in eBPF maps secure

I have read that there are some capabilities that are broken out of CAP_SYS_ADMIN specifically CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON etc. I also read that data structures called maps are used to store ...
Flint_security's user avatar
0 votes
1 answer
95 views

Add directory of Luks partition to system PATH

I would like to keep some secret executable binaries inside a LUKS partition. This partition is not mounted automatically at boot, but only manually in some moments I would like to automatically add a ...
stefd's user avatar
  • 121
2 votes
4 answers
2k views

How dangerous can an anti-cheat software be, on Linux operating systems?

There are anti-cheat software for Windows that run with really high privileges in order to detect cheats on the users' machine. These anti-cheat claim to run 'on kernel' and scan the user files and ...
rmauter's user avatar
  • 53
2 votes
1 answer
191 views

How do you boot from the network using https?

How do you boot a Linux live image from a CDN using Https as boot protocol? The reason for netbooting using a CDN would be to start fresh with a non persistent operating system image. Booting fresh ...
Christian's user avatar
  • 265
0 votes
1 answer
170 views

Legitimate use cases for writable etc/passwd files

I´m learning about linux privilege escalation via a writable /etc/passwd file and was wondering how common that actualy is? Are there any use cases where a regular user might have (or even needs) ...
Opera of the Phantom's user avatar
1 vote
0 answers
37 views

Full disk encryption and data recovery capabilities [duplicate]

So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
Gateejunle's user avatar
0 votes
1 answer
225 views

Does linux in windows with wsl2 carry the usual security advantages of linux

I'm planning on running some bitcoin wallets I would like to be extra resilient to hack attempts. I plan on installing them on an encrypted usb stick and only interacting with the stick with linux ...
hedgedandlevered's user avatar
0 votes
1 answer
370 views

EAP-TLS for securing internal local WLAN?

I'm looking at securing a wi-fi network used in an industrial context. I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
Hydrargyrum's user avatar
0 votes
0 answers
216 views

I cannot make a reverse connection

I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell. Possible a UFW ...
Shinomoto Asakura's user avatar
0 votes
0 answers
146 views

What is the steps to be taken when you suspect a linux malware has infected your computer?

Using Linux is a different beast entirely but sometimes malware can blend as seemingly harmless system binaries like this post Bpfdoor Like this post which documents a highly evasive Linux malware. ...
geek's user avatar
  • 109
2 votes
1 answer
398 views

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...
bomiam's user avatar
  • 35
3 votes
1 answer
830 views

Why I am unable to execute insmod on the docker container?

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod. docker ...
tbhaxor's user avatar
  • 131
2 votes
1 answer
213 views

Linux access control policies sudoers

I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
guu1's user avatar
  • 21
1 vote
0 answers
270 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
santosh baruah's user avatar
0 votes
0 answers
488 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
samtech's user avatar
0 votes
0 answers
91 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
DaraJ's user avatar
  • 101
3 votes
0 answers
171 views

What are the dangers of using mainstream Linux distributions? [closed]

Niche Linux distributions can/may introduce risks such as lack of updates, limited community attention and reduced testing. Ubuntu, openSUSE and Fedora can be considered mainstream. Mainstream ...
fenixleon's user avatar
  • 301
15 votes
2 answers
3k views

What are the dangers of using niche Linux distributions?

Ubuntu, openSUSE and Fedora can be considered mainstream. In comparison distributions such as Solus, MX Linux, antiX, Void and others could be classed as niche. Mainstream distributions are typically ...
fenixleon's user avatar
  • 301
3 votes
2 answers
821 views

Privilege escalation through arbitrary file delete

Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
user16910689's user avatar
0 votes
0 answers
50 views

How does ASLR work [duplicate]

I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run. But I have a doubt, take an example of an elf executable. It tells ...
OSdev's user avatar
  • 1
0 votes
1 answer
167 views

safely storing untrusted files on a trusted machine

given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
nqzero's user avatar
  • 1
1 vote
2 answers
4k views

Lab environment, allow ssh version 1

When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh [email protected] -1. I ...
Garrett Strahan's user avatar
22 votes
2 answers
4k views

What metadata from the Linux file system is in my uploaded photos?

Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the Linux file system itself seems to leave some metadata ...
cardamom's user avatar
  • 379
3 votes
0 answers
3k views

When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?

VirtualBox has an option to encrypt the drive of a VM. When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted. I'm thinking that both do pretty much the same ...
Alexis Wilke's user avatar
  • 1,007
1 vote
2 answers
231 views

Does adding a new user (instead of just using root) help WSL2 security?

Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
belkarx's user avatar
  • 1,326
0 votes
0 answers
14 views

How to pipe a character set on hydra [duplicate]

How to pipe a characterset to Hydra. Something like this which can be done on hashcat (crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49)
officialstar's user avatar
0 votes
1 answer
283 views

Is it possible to spoof a service running on a port in Ubuntu?

I was looking into the idea of port spoofing, and I came across this GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
sketch54's user avatar
0 votes
0 answers
195 views

Hash-Based Technique to Detect Ransomware Corruption on the Fly?

I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
Ray Woodcock's user avatar
1 vote
1 answer
329 views

Security difference between changing permissions versus using sudo to execute

If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
durestudios's user avatar
2 votes
1 answer
114 views

ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?

I was browsing the ld.so man page and I saw an entry about Secure-Execution mode: **Secure-execution mode** For security reasons, if the dynamic linker determines that a binary should ...
linuxuser8's user avatar
1 vote
2 answers
903 views

Can openssl client be used for checking if the server key size is what is expected?

I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using: openssl s_client -connect "ip address":"port" -...
Sad.coder's user avatar
1 vote
1 answer
242 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
SRobertJames's user avatar
2 votes
1 answer
211 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
Cream's user avatar
  • 131
9 votes
2 answers
3k views

Why is the mount option "hidepid=2" not used by default, is there a danger in using it?

While searching for an answer to the question "how to hide command arguments from ps/proc etc", I came across the hidepid mount option, which hides a user's own processes from another user (...
NewLinux's user avatar
  • 685
2 votes
0 answers
3k views

What exactly is the pkexec bug and how to patch it on CentOS 7? [closed]

There is bug in pkexec program, CVE-2021-4034, which when exploited allows access to root shell. Is the best way to fix an unpatched CentOS 7 server to just apply the temporary fix of running chmod ...
Aulis Ronkainen's user avatar
1 vote
1 answer
228 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
Michael Altfield's user avatar

1 2
3
4 5
43