Access control based on user, group, or global access.

learn more… | top users | synonyms

21
votes
1answer
12k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
15
votes
3answers
1k views

Is hacking legal when a friend allows you to attempt to hack their system?

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the ...
13
votes
2answers
2k views

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under ...
12
votes
4answers
318 views

Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?

Background We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
10
votes
6answers
2k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
10
votes
2answers
1k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
10
votes
1answer
91 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
8
votes
2answers
240 views

What's ownership concept for?

I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity. What cannot be done without concept of owner(ownership) in filesystem/database object ...
8
votes
1answer
1k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
8
votes
1answer
174 views

What is your default umask set to?

What is your default umask set to? Did you run into any problem setting a stricter default umask?
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
7
votes
4answers
787 views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
6
votes
2answers
671 views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
6
votes
2answers
1k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
5
votes
2answers
399 views

What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?

In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
5
votes
1answer
116 views

OpenBSD, fbtab and X Window [closed]

The afterboot(8) man page of OpenBSD advises "You might wish to tighten up security more by editing /etc/fbtab as when installing X. " I would like to know what entries in /etc/fbtab would make sense ...
4
votes
1answer
221 views

What are the dangers with creating MySQL databases on the fly?

I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database. I ...
4
votes
1answer
135 views

Should I use sudo with the normal user or root or sudo with another user?

on a UNIX OS, ex.: OpenBSD (used as a desktop by me only), which one is the best choice in regards to security. I want to run desktop operations (like pkg_add) with root permissions. 1. having the ...
4
votes
2answers
536 views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
4
votes
1answer
58 views

Are viewable permissions an issue?

Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some ...
4
votes
3answers
142 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
4
votes
1answer
2k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
3
votes
3answers
2k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
3
votes
4answers
376 views

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
3
votes
1answer
349 views

Can UNIX Domain Sockets be locked by user ID?

If I created a folder /tmp/me with permissions 700, and started a process under me that starts a listen socket under /tmp/me/socket. I currently assume that a connection to that socket originated ...
3
votes
1answer
872 views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
3
votes
3answers
420 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
2
votes
3answers
1k views

How can winlock virus change Windows Registry without admin permission?

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command. So I'm interested in how does this virus works. How can it edit ...
2
votes
1answer
703 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
2
votes
2answers
618 views

Safe user/group for rsyslog to read application log?

I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody What exactly is ...
2
votes
1answer
172 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
2
votes
1answer
254 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
2
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
1answer
19 views

How do I customize /proc permissions?

So that: Only process owners, and root, can access information about their processes, Or, at the very least, cmdline permissions are only readable by root, and My system (CentOS 6.x) still runs ...
2
votes
1answer
308 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
2answers
280 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
1
vote
2answers
212 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
1
vote
3answers
131 views

Can I use 777 file permissions inside server virtualisation (that only I have access to) without worry?

For this question, please assume I have followed every possible security measure to secure my Linux server. Only I have access to the web server via one open SSH port. If there are security issues ...
1
vote
1answer
101 views

Reliability of windows OS security for “program files” safe guard

I want to do inter process communication between Firefox (via extension) and my application. Both reside in "Program files" (of windows 7 OS). I also assume that malware is running in the system and ...
1
vote
1answer
212 views

Local Admin has Domain Admin rights

While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found ...
1
vote
2answers
51 views

Requesting administrative access in a company

I have been given the task of defining a process for assigning administrative access. One of the requirements for this processs is that if a subject wishes to gain adminstrative access, only the ...
1
vote
2answers
90 views

What permissions should I give to a MySQL 'user' that searches my databse?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
1
vote
1answer
77 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
1
vote
1answer
78 views

Securing Downloadable Files on Website Per User

I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
1
vote
1answer
106 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
1
vote
1answer
80 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
1
vote
3answers
574 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
0
votes
3answers
105 views

How much faster would computers be if not for security? [closed]

I was wondering, assuming a "The Invention of Lying" world, but where no one was able to steal or misrepresent themselves how much faster would computers be? Just to give two examples of what I mean, ...
0
votes
2answers
187 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
0
votes
1answer
243 views

Would adding root to a group open a security hole?

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...