Access control based on user, group, or global access.

learn more… | top users | synonyms

2
votes
2answers
311 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
2
votes
1answer
942 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
2
votes
3answers
893 views

Can I use 777 file permissions inside server virtualisation (that only I have access to) without worry?

For this question, please assume I have followed every possible security measure to secure my Linux server. Only I have access to the web server via one open SSH port. If there are security issues ...
2
votes
2answers
2k views

Safe user/group for rsyslog to read application log?

I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody What exactly is nobody:...
2
votes
1answer
54 views

Why are PID suffixed temporary files a vulnerability

Why is this a security issue? > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331 > > very predictable temporary files (like > /tmp/cronic.out.$$) that depends only on PID: > ...
2
votes
1answer
476 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
2
votes
1answer
496 views

Local Admin has Domain Admin rights

While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found ...
2
votes
2answers
163 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
2
votes
1answer
338 views

Upload a file into directory with public write access

I know it is not right to set a permission for the folder as 777, but if it is done so will it be possible to upload a file into that directory without ftp access ? Here is what I mean Lets say the ...
2
votes
1answer
1k views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
2
votes
2answers
51 views

When would group permissions be a security issue?

I frequently hear that 600 and 700 is recommended for security when possible before 660, 770. I'd like to understand the risk that 660, 770 would have that 600, 700 wouldn't.
2
votes
1answer
92 views

Give only execute permissions to a Linux binary (prevent inspection)?

I'm writing an assignment for a security course, and I'm trying to create an executable which students can interact with (ie, execute), but not inspect. In particular what I'd like is for them to be ...
2
votes
1answer
104 views

How do I customize /proc permissions?

So that: Only process owners, and root, can access information about their processes, Or, at the very least, cmdline permissions are only readable by root, and My system (CentOS 6.x) still runs ...
2
votes
0answers
85 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
2
votes
1answer
562 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
2
votes
2answers
49 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
1
vote
3answers
133 views

Permissions security scenarios for a web server

Having /var/www/site.com owned by www-data:www-data with a 750 permission for directories and 640 for files, and having my user alexb added to www-data group, I found my self with permission issues ...
1
vote
2answers
123 views

Does Java/Dalvik's Java Native Interface JNI make Android prone to better attacks?

Java has a feature named Java Native Interface (JNI), which allows to call native machine code function from inside the Java's bytecode. This feature allows effectively running machine native code ...
1
vote
1answer
49 views

Android Permissions and Explanations

I am doing some research on Android permissions and whether or not they could abuse data privacy. Does anyone have a good source on all updated Android permissions with a short explanation on what ...
1
vote
1answer
136 views

Reliability of windows OS security for “program files” safe guard

I want to do inter process communication between Firefox (via extension) and my application. Both reside in "Program files" (of windows 7 OS). I also assume that malware is running in the system and ...
1
vote
1answer
123 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
1
vote
2answers
31 views

755 permission of uploaded files

I just want to know, if giving 755 permission to an uploaded file is a security problem. If someone upload a malicious file, will the execute permission be a problem? In this answer, he is giving the ...
1
vote
1answer
365 views

How can one restrict Windows shared folders access to specific applications?

There are few shared folders in my company that are accessed by applications from different branches across the country for different transactions. Hence they are kept "open". During a recent PT ...
1
vote
1answer
94 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
1
vote
2answers
77 views

Requesting administrative access in a company

I have been given the task of defining a process for assigning administrative access. One of the requirements for this processs is that if a subject wishes to gain adminstrative access, only the ...
1
vote
2answers
503 views

What permissions should I give to a MySQL 'user' that searches my database?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
1
vote
1answer
95 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache MPM-...
1
vote
1answer
95 views

Securing Downloadable Files on Website Per User

I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
1
vote
0answers
69 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
1
vote
1answer
225 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
1
vote
0answers
59 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
1answer
226 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
1
vote
3answers
851 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
1
vote
1answer
2k views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
0
votes
2answers
508 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
3answers
140 views

How much faster would computers be if not for security? [closed]

I was wondering, assuming a "The Invention of Lying" world, but where no one was able to steal or misrepresent themselves how much faster would computers be? Just to give two examples of what I mean, ...
0
votes
2answers
398 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
0
votes
1answer
111 views

Found 0000 Permission Files on a hacked server

Its been a long week trying, at times when I can, to figure out what is happening on a server/website I am maintaining. The site was previously hacked, supposedly cleaned up by previous owners, and ...
0
votes
1answer
510 views

Would adding root to a group open a security hole? [closed]

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...
0
votes
1answer
637 views

is it OK to grant permission for IUSR_ to cmd.exe?

One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for ...
0
votes
2answers
128 views

How should permissions be stored?

In a system where users have multiple permissions that may overlap (i.e. "Write" might not include "Read" etc.) what is the best way to keep them in the database? Both in terms of security and "...
0
votes
2answers
193 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
0
votes
2answers
514 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
0
votes
1answer
654 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
0
votes
1answer
86 views

What technique should I use to prevent unpermitted access to my REST API

I need to build an REST API that can be accessed via HTTPS when given valid credentials. How should I implement those credentials? I am looking for advice whether I should use plain old passwords, ...
0
votes
1answer
75 views

Why is it ok that OS X defaults to ignoring owership on external volumes?

I just discovered this fact tonight and I was rather floored by it. Isn't that a gaping security flaw? I realize that an external drive is less secure by virtue of the fact that someone could simply ...
0
votes
1answer
61 views

What files would I be able to view as localhost?

If I was able to view any page on a website as localhost using SSRF, what files should I check for? I checked to see if I could view robots.txt normally, and I couldn't, but using SSRF, I was able to. ...
0
votes
1answer
673 views

Can local Admin on Windows be given restricted permissions?

Looking at a lot of different security software on Windows, a lot of them rely on some settings on the computer which can probably be overridden by a local administrator. For eg. some DLP software ...
0
votes
2answers
72 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
0
votes
1answer
897 views

Helpdesk role and local admins

I need to re-work our current security model for desktop computers, and would like some insight as to what changes can be made as well as best practices. Currently we have the helpdesk role that is ...