The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
3answers
58 views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 ...
0
votes
1answer
48 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
-1
votes
1answer
76 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
0
votes
2answers
63 views

How many accounts should I have in an information system?

Is it a problem to have more than one account in an information system from security point of view? Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
0
votes
3answers
65 views

Protecting local admin password against 3rd party software

I'm using a standard user account and then run whatever as administrator so that I type in administrator password... I wonder if potentially undetected malicious software such as a trojan is able to ...
0
votes
1answer
191 views

Can I use 2 factor authentication for shared accounts?

Is it possible to use SecurID 2FA for Highly Privileged shared accounts? I am currently using CyberArk to vault passwords for privileged accounts. when I checkout a password, I would like to make sure ...
3
votes
1answer
236 views

Safely Use sudo Without allowing Other applications root privileges on Mavericks

I have noticed recently on OS X Mavericks that running sudo will not only allow one to run it again in the same window or even the same application, but will permit any application to run shell ...
0
votes
1answer
767 views

Exploiting SUID Binary that connects to SSH server

While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges. One interesting thing that i have found is a binary called connect installed under ...
2
votes
2answers
175 views

Time based event, console application on Windows Server — security implications

I'm a software engineer, and I've written several discreet utilities that run at specific times on Windows Server 2008. Generally speaking, they are console applications, need to access SQL Server, ...
2
votes
1answer
177 views

Will “upgrading” www-data user open up known security issues?

On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline. It has worked quite smoothly in ...
16
votes
8answers
794 views

Should the requirement of admin privileges be extended?

Seeing this comic from xkcd.com made me thinking: Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
2
votes
2answers
129 views

Database security: Remove superuser role

I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles. I imagine that ...
1
vote
2answers
2k views

How is it possible that a virus can infect the system if the browser is started with non-admin rights

If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
6
votes
2answers
961 views

Is privilege escalation possible when shell is under www user?

So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
1
vote
3answers
194 views

Maintain User Privileges After Shutdown in Windows XP?

Is it possible, in Windows XP, to maintain user privileges of a command shell after a reboot? For example, I'm running as a non-privileged account LocalMachine\Pete, but have a shell running as ...
1
vote
1answer
223 views

Privilege usage checks

What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android). Android grants app privileges ...
10
votes
2answers
625 views

Should an admin user be able to edit passwords?

For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
3
votes
3answers
631 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
4
votes
3answers
2k views

Privilege Escalation Ubuntu

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
3
votes
1answer
287 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
8
votes
2answers
2k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
15
votes
3answers
527 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...
9
votes
4answers
685 views

Security policy for system administrators

I've been in charge of systems administration for a small company for a couple of years and am now training some new collaborators to take over. So far, there has been no security policy, but I would ...
6
votes
3answers
3k views

What differences are there between built-in Administrator and other Administrators?

Are there any significant differences in the rights, privileges, permissions, or other powers held by the built-in Administrator account, and those held by non-built-in Administrator accounts?
2
votes
2answers
227 views

OBSD X11 as non-root?

If running X11 as root is not a very good idea, then can anyone mention a method/solution, how to still use a GUI, and not having X11 as root?
11
votes
3answers
476 views

What security requirements do you have for Domain Administrators?

With regard to managing a Windows network, what security polices and processes do you use? For example Do you require/support Smart Card Authentication? Restrict logins from a particular ...