Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
2,126
questions
5
votes
1
answer
1k
views
Explanation of capabilities: CAP_NET_BIND_SERVICE
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
...
1
vote
0
answers
231
views
Is "pam_ssh_agent_auth" more secure than passwords for sudo on a remote server?
I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/...
0
votes
0
answers
73
views
Making time(0) produce an error
I'm currently reviewing/reversing a software (coded in C) and it has a line like this :
time_t var = time(0);
My goal it to get this time(0) call to return -1.
(I cannot modify the parameter.)
...
1
vote
1
answer
435
views
Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?
I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple").
I ...
0
votes
1
answer
135
views
How do you trust two different cloud provider servers?
I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
1
vote
1
answer
306
views
Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?
I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
-1
votes
1
answer
137
views
Confused about memory examination using gdb
I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination.
When I disassemble main, I get an output of all memories where the ...
1
vote
1
answer
223
views
Purpose of Real UID in spite of setresuid()
While reading the manual page of setresuid() a question arose about the purpose of Real UID.
As mentioned in the man page:
setresuid() sets the real user ID, the effective user ID, and the saved set-...
1
vote
1
answer
232
views
Details: snoop environment variables using D-Bus IPC
The page at: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment says:
Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC [...]
I don't ...
0
votes
1
answer
88
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
0
votes
1
answer
135
views
Honeyd not responding to TCP
I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
1
vote
2
answers
183
views
What ways other than password and authorized SSH key are there to log in to a Linux system?
When deleting a user on a Linux system, if you lock their password and kill all their processes, a logged in user disconnects and can't log in with his password anymore.
But if they still have an ...
1
vote
2
answers
238
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
0
votes
0
answers
56
views
SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?
I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
2
votes
1
answer
374
views
How to keep data in eBPF maps secure
I have read that there are some capabilities that are broken out of CAP_SYS_ADMIN specifically CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON etc. I also read that data structures called maps are used to store ...
0
votes
1
answer
95
views
Add directory of Luks partition to system PATH
I would like to keep some secret executable binaries inside a LUKS partition.
This partition is not mounted automatically at boot, but only manually in some moments
I would like to automatically add a ...
2
votes
4
answers
2k
views
How dangerous can an anti-cheat software be, on Linux operating systems?
There are anti-cheat software for Windows that run with really high privileges in order to detect cheats on the users' machine. These anti-cheat claim to run 'on kernel' and scan the user files and ...
2
votes
1
answer
191
views
How do you boot from the network using https?
How do you boot a Linux live image from a CDN using Https as boot protocol?
The reason for netbooting using a CDN would be to start fresh with a non persistent operating system image. Booting fresh ...
0
votes
1
answer
170
views
Legitimate use cases for writable etc/passwd files
I´m learning about linux privilege escalation via a writable /etc/passwd file and was wondering how common that actualy is?
Are there any use cases where a regular user might have (or even needs) ...
1
vote
0
answers
37
views
Full disk encryption and data recovery capabilities [duplicate]
So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
0
votes
1
answer
225
views
Does linux in windows with wsl2 carry the usual security advantages of linux
I'm planning on running some bitcoin wallets I would like to be extra resilient to hack attempts. I plan on installing them on an encrypted usb stick and only interacting with the stick with linux ...
0
votes
1
answer
370
views
EAP-TLS for securing internal local WLAN?
I'm looking at securing a wi-fi network used in an industrial context.
I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
0
votes
0
answers
216
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
146
views
What is the steps to be taken when you suspect a linux malware has infected your computer?
Using Linux is a different beast entirely but sometimes malware can blend as seemingly harmless system binaries like this post
Bpfdoor
Like this post which documents a highly evasive Linux malware.
...
2
votes
1
answer
398
views
Where to store the password: in RAM or another user's home folder (Linux)
There is user1 and user2. All work is done from under user1. user2 is only created to store important information.
If important information is stored in RAM, but in the session of user1, which is ...
3
votes
1
answer
830
views
Why I am unable to execute insmod on the docker container?
I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod.
docker ...
2
votes
1
answer
213
views
Linux access control policies sudoers
I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
1
vote
0
answers
270
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
0
votes
0
answers
488
views
Encrypt SVN for passwords
Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
0
votes
0
answers
91
views
File traversal vulnerability found on Ubuntu server running a node process using Nessus
I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus.
It looks like a pretty standard issue to me, and I will have shell access, ...
3
votes
0
answers
171
views
What are the dangers of using mainstream Linux distributions? [closed]
Niche Linux distributions can/may introduce risks such as lack of updates, limited community attention and reduced testing.
Ubuntu, openSUSE and Fedora can be considered mainstream. Mainstream ...
15
votes
2
answers
3k
views
What are the dangers of using niche Linux distributions?
Ubuntu, openSUSE and Fedora can be considered mainstream. In comparison distributions such as Solus, MX Linux, antiX, Void and others could be classed as niche.
Mainstream distributions are typically ...
3
votes
2
answers
821
views
Privilege escalation through arbitrary file delete
Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
0
votes
0
answers
50
views
How does ASLR work [duplicate]
I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run.
But I have a doubt, take an example of an elf executable. It tells ...
0
votes
1
answer
167
views
safely storing untrusted files on a trusted machine
given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
1
vote
2
answers
4k
views
Lab environment, allow ssh version 1
When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh [email protected] -1.
I ...
22
votes
2
answers
4k
views
What metadata from the Linux file system is in my uploaded photos?
Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the Linux file system itself seems to leave some metadata ...
3
votes
0
answers
3k
views
When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?
VirtualBox has an option to encrypt the drive of a VM.
When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted.
I'm thinking that both do pretty much the same ...
1
vote
2
answers
231
views
Does adding a new user (instead of just using root) help WSL2 security?
Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
0
votes
0
answers
14
views
How to pipe a character set on hydra [duplicate]
How to pipe a characterset to Hydra.
Something like this which can be done on hashcat
(crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49)
0
votes
1
answer
283
views
Is it possible to spoof a service running on a port in Ubuntu?
I was looking into the idea of port spoofing, and I came across this
GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
0
votes
0
answers
195
views
Hash-Based Technique to Detect Ransomware Corruption on the Fly?
I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
1
vote
1
answer
329
views
Security difference between changing permissions versus using sudo to execute
If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
2
votes
1
answer
114
views
ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?
I was browsing the ld.so man page and I saw an entry about Secure-Execution mode:
**Secure-execution mode**
For security reasons, if the dynamic linker determines that a binary
should ...
1
vote
2
answers
903
views
Can openssl client be used for checking if the server key size is what is expected?
I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using:
openssl s_client -connect "ip address":"port" -...
1
vote
1
answer
242
views
How does gVisor run its own kernel replacement under Docker for security? [closed]
I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security.
My question is: The whole point ...
2
votes
1
answer
211
views
Avoid stack addresses containing zeros
I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).
...
9
votes
2
answers
3k
views
Why is the mount option "hidepid=2" not used by default, is there a danger in using it?
While searching for an answer to the question "how to hide command arguments from ps/proc etc", I came across the hidepid mount option, which hides a user's own processes from another user (...
2
votes
0
answers
3k
views
What exactly is the pkexec bug and how to patch it on CentOS 7? [closed]
There is bug in pkexec program, CVE-2021-4034, which when exploited allows access to root shell.
Is the best way to fix an unpatched CentOS 7 server to just apply the temporary fix of running chmod ...
1
vote
1
answer
228
views
Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)
Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...