Access control based on user, group, or global access.

learn more… | top users | synonyms

3
votes
2answers
102 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
0
votes
0answers
39 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
-1
votes
0answers
36 views

I can't copy files from a HDD, do I need permission from my own account? [migrated]

My friend wanted me to backup all the photos and music and text documents on his hard drive so I'm trying to do that. He gave me the whole computer. It's an OEM machine from 2005 running Windows XP. ...
1
vote
0answers
22 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
2
votes
2answers
146 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
0
votes
0answers
26 views

Correct permissions for /runtime and /assets folders

Could you suggest how to properly configure the right directories in CentOS 6.6? On a server running a framework Yii, which works with the runtime directories and assets. For these directories I need ...
1
vote
0answers
22 views

Linux PAX, execute and write permissions

I would like to know what happens when a section of a program is compiled with both execute and write permissions and PAX is enabled on the system? Is the program successfully loaded? Is the section ...
3
votes
4answers
95 views

How to give rights to a System Administrator in an application?

I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped ...
1
vote
1answer
174 views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
13
votes
4answers
709 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
1
vote
1answer
69 views

iOS permissions for 3rd party app developers [closed]

I am putting together a summary on iOS and Android security risks based on app permissions. On Android, it is easy to define all of the permissions and what 3rd party developers have access to (from ...
1
vote
1answer
35 views

Android Permissions and Explanations

I am doing some research on Android permissions and whether or not they could abuse data privacy. Does anyone have a good source on all updated Android permissions with a short explanation on what ...
3
votes
1answer
89 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
38
votes
7answers
4k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
18
votes
1answer
3k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
2
votes
3answers
629 views

Can I use 777 file permissions inside server virtualisation (that only I have access to) without worry?

For this question, please assume I have followed every possible security measure to secure my Linux server. Only I have access to the web server via one open SSH port. If there are security issues ...
1
vote
1answer
88 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
0
votes
0answers
29 views

Improve the security of a website implementing the least privilege principle [duplicate]

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
114 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
2
votes
1answer
146 views

Upload a file into directory with public write access

I know it is not right to set a permission for the folder as 777, but if it is done so will it be possible to upload a file into that directory without ftp access ? Here is what I mean Lets say the ...
1
vote
1answer
234 views

How can one restrict Windows shared folders access to specific applications?

There are few shared folders in my company that are accessed by applications from different branches across the country for different transactions. Hence they are kept "open". During a recent PT ...
5
votes
1answer
4k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
0
votes
0answers
127 views

Ethical hacking: using a named pipe to insert public key into a authorized_keys file?

I have a couple of CentOS VMs as part of a class I'm taking, I'm just trying to understand how loose permissions (other than the obvious 777) can be taken advantage of. The targetted account on VM1 ...
0
votes
1answer
66 views

What technique should I use to prevent unpermitted access to my REST API

I need to build an REST API that can be accessed via HTTPS when given valid credentials. How should I implement those credentials? I am looking for advice whether I should use plain old passwords, ...
0
votes
0answers
23 views

Is it a security risk to give read/write permissions to /Library/WebServer/Documents to my main account?

The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account ...
0
votes
1answer
61 views

Why is it ok that OS X defaults to ignoring owership on external volumes?

I just discovered this fact tonight and I was rather floored by it. Isn't that a gaping security flaw? I realize that an external drive is less secure by virtue of the fact that someone could simply ...
1
vote
2answers
169 views

What permissions should I give to a MySQL 'user' that searches my database?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
43
votes
6answers
7k views

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

The unix read permission is actually the same as the execute permission, so if e.g. one process has write access it's also able to execute the same file. This can be done pretty easily:First this ...
0
votes
1answer
117 views

Why doesn't the OS give every application a secret password?

As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way ...
0
votes
3answers
101 views

Permissions security scenarios for a web server

Having /var/www/site.com owned by www-data:www-data with a 750 permission for directories and 640 for files, and having my user alexb added to www-data group, I found my self with permission issues ...
1
vote
0answers
50 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
2
votes
1answer
55 views

How do I customize /proc permissions?

So that: Only process owners, and root, can access information about their processes, Or, at the very least, cmdline permissions are only readable by root, and My system (CentOS 6.x) still runs ...
0
votes
2answers
412 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
1
vote
2answers
61 views

Requesting administrative access in a company

I have been given the task of defining a process for assigning administrative access. One of the requirements for this processs is that if a subject wishes to gain adminstrative access, only the ...
1
vote
3answers
745 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
0
votes
1answer
59 views

What files would I be able to view as localhost?

If I was able to view any page on a website as localhost using SSRF, what files should I check for? I checked to see if I could view robots.txt normally, and I couldn't, but using SSRF, I was able to. ...
0
votes
2answers
139 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
1
vote
1answer
154 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
10
votes
1answer
138 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
0
votes
3answers
131 views

How much faster would computers be if not for security? [closed]

I was wondering, assuming a "The Invention of Lying" world, but where no one was able to steal or misrepresent themselves how much faster would computers be? Just to give two examples of what I mean, ...
0
votes
1answer
485 views

Can local Admin on Windows be given restricted permissions?

Looking at a lot of different security software on Windows, a lot of them rely on some settings on the computer which can probably be overridden by a local administrator. For eg. some DLP software ...
0
votes
2answers
56 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
5
votes
2answers
1k views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
2
votes
1answer
742 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
2
votes
1answer
349 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
0
votes
2answers
298 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
3
votes
3answers
979 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
4
votes
1answer
333 views

What are the dangers with creating MySQL databases on the fly?

I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database. I ...
0
votes
1answer
548 views

Helpdesk role and local admins

I need to re-work our current security model for desktop computers, and would like some insight as to what changes can be made as well as best practices. Currently we have the helpdesk role that is ...
4
votes
1answer
147 views

Should I use sudo with the normal user or root or sudo with another user?

on a UNIX OS, ex.: OpenBSD (used as a desktop by me only), which one is the best choice in regards to security. I want to run desktop operations (like pkg_add) with root permissions. 1. having the ...