Tag Info

New answers tagged

0

I suspect this is what you're looking for. It uses luks encrypted volume which is widely supported and store the password/key within the TPM (NVRAM). The key can be sealed (Trusted Computing terminology) against the proper boot sequence (BIOS, PCI ROMs, MBR, Boot Loader, etc). In other words, the key is derived from the running environment. If something ...


1

The location of the database is /var/lib/mlocate/mlocate.db or at /var/cache/locate/locatedb. This is outside your home folder. Probably you decrypted your homefolder prior to running the command and the results got saved in a non-encrypted folder.


1

As an immediate patch, you should run such an application in a separate X server on a different VT. This is the only way you can guarantee that the app does not use the X API to spy on other clients. You may also try your hand at XSELinux but I know of very few people in the world who know how to run it, and it usually severely limits what your target app ...


1

Please take below-mentioned as my personal opinion. I think is is less secure. But it depends on what you consider a security problem and what not. real life example my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x .. I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't ...


0

FF is likely a fine browser and it's either that or Chrome on Linux, so employees would probably feel more at home with Chrome. True security would be from a terminal based browser, but that's highly inconvenient. As for addons, likely none. I imagine that noscript would make an employee confused and angry. AdBlock might be fine though. Superuser would be ...


2

There's no good way to restrict accounts based on network interface in Linux (by the time a packet reaches a layer that understands the concept of "account", it's forgotten which interface it came in on). However, there are two easy ways to restrict access to an application based on which interface is used: At the OS level, the iptables firewall has ...


3

The information you're talking about (UID, GID, timestamp, et.c) is stored in the file's inode. In UNIX systems, the inode is created whenever a file is created and it stores meta information about the file. When copying a file from system A to system B, a new file is created at B, thus a new inode is created for it. This inode now contains information about ...


2

Philosophical differences. LibreSSL is designed under the philosophy that an SSL library should be an SSL library, and nothing more. This means it doesn't try to implement half of libc, or provide other OS-level facilities, and it should not compensate for flaws in the OS -- the OS should be fixed instead. A pool of high-quality entropy is one of those ...


0

The answer is a little murky, somewhere between the two. Linux has historically exposed the kernel's random number generator as /dev/random and /dev/urandom while BSD exposes it with the getentropy syscall. It turns out there are some advantages to the BSD approach, and because of LibreSSL pressure, Linux will be implementing a similar syscall. more info ...


1

As other posts have said, you can say things like "16GB Lexar Jumpdrives are allowed to work here, everything else is banned", but not say "This specific flashdrive can only work in this network". However, as with many things, you can fool the system. Here is a defcon talk where someone built a device to act as a USB MITM, and would convert commands between ...


3

USB devices are normally identified by vendor and device ID, and, in Linux, support for USB devices is handled with udev. You could write udev rules to reject all devices, save for a specific (white) list. See for instance this question. However, this might not bring the security you wish. Indeed, all devices of a specific model from a given vendor will ...


1

Yes. Sort of. "Load drivers" is a bit ambiguous. Typically USB drivers are baked-in to the kernel as they may be required during startup. Furthermore, you can't query the USB device to find out its device ID without "loading" the USB subsystem, and typically the device-specific driver is simply the mass storage or HID system which is shared by all similar ...


0

You can find all of the MD5 hashes here: https://help.ubuntu.com/community/UbuntuHashes Now all you have to do is compare the MD5 hash of your download with the hash on the page. You can generate an MD5 hash in Ubuntu by using: md5sum <file>


0

You are missing the option of ACLs. Linux has a very flexible ACL system that most people don't consider. I wrote up a blog post about this a while ago: http://bryan.ravensight.org/2010/01/linux-acl-management-functions/ I generally set the ownership and group to the shell user and whatever group of interactive users that need to be able to update those ...


1

Having /var/www/site.com owned by www-data:www-data If www-data is also the uid your webserver runs as then you have a really insecure system. The webserver should only have read access (and execute for directories). If you do need to allow the webserver to write data then this directory should be ringfenced - and preferably outside the document root. ...


0

xx4 in folder is more like having xx0, since "others" won't be able to see the contents of that directory. They would see the folder, but won't be able to do anything with it. As the web server probably won't need write permissions, I would use the alexb:www-data with 750 (directories) and 640 (files), as this way reduces privileges for the web server but ...


0

Using a secure connection will not help in validating the key either. How would you verify the identity of the server you are connecting to? E.g. I can use hkps to connect to a rogue server and securely retrieve a fake public key. Instead PGP works via a "Web of Trust" infrastructure whereby you trust a key because it is signed by someone whom you trust. ...


1

Security through obscurity (like "hidding" the administrator's account under another name) at most could delay a few minutes any attack, but does not increase your real level of security at all. Root accounts usually cannot log in remotely and in most cases their password are disabled by default, so any attack using "root" as username will not succeed on ...


1

Many flavors of linux (e.g., ubuntu) by default disable password login to the root account, but let the primary account elevate to root permissions by prefixing commands with sudo and entering that account's password. https://help.ubuntu.com/community/RootSudo


0

nope. because, strictly speaking, nothing prevents you from renaming root-account on Linux too. the name is just a record in /etc/passwd file. it might lead to some incompatibilities in software, but that should be rare.


1

It is possible to fingerprint the OS to some level, but you won't be able to differentiate Kali Linux from Ubuntu/Red Hat. Or between some Windows versions. On the other hand detecting the behavior (eg. a port scan) instead of the OS would be simpler. If you are happy with the detection quality and don't mind some false positives, eg. that your boss new ...


1

It is technically possible for malware to infect your live USB if you create that live usb from the infected pc. Personally, I would never consider doing what you are asking to restore a system because you can never be sure you've gotten rid of all malware. However, you can attempt to create the live usb and restore your pc and once restored, simply compare ...


0

It is definitely not safe. You cannot trust any drive that has been written from an infected machine. There is no way to ensure the integrity of the live USB.


1

Yes Linux AV such as Sophos check for and find EICAR. EICAR is a test file with a known signature used to establish the fact that your signature-based AV is working. Many certifiers require a positive result for that test.


1

EICAR is so simple it doesn't need any Windows COM files or anything ! Have you actually looked at the EICAR code ? Its all self contained in one tiny file. As for why would Linux antivirus need to look for a Windows virus? Lots of people use Linux machines as servers (mail,web,file etc.) ... all of which may serve Windows clients. Seems fairly ...


1

Additional to the above answers, I'd like to point out that Linux PAM makes it possible to add additional security checks for any user (and thus also for root). For example requiring a certificate, a usb key (like YubiKey), etc.


5

The BadUSB attack bases on the fact that computers allow and enable HID devices on all usb ports. Faked network adapters are no real danger. My answer tries do describe how to use udev to temporarily disable the addition of new HID devices. I'm no udev expert, but I've tested my approach, and it works for me. For preparation, create a file ...


7

The idea behind BadUSB is that a malicious agent re-flashes a device's USB controller chip to do something nasty. This is an interesting possiblity, but there are some serious assumptions here that people tend to gloss over: 1: The USB controller chip has to allow firmware flashing over the USB connection This is a security vulnerability for sure if it's ...


6

There is no secure system. There are only systems which might be sufficiently secure against specific kind of attacks, and attack scenarios might change fast. Linux as a desktop system profits from low adoption, which means that you are not an attractive target for mass attacks. Also it provides better segmentation between security boundaries, that is, it ...


13

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new applications - therefore external malicious software can't do any harm as long as the administrator is the only person to know the password. You're right in that ...


0

What makes Linux secure, is proper segmentation. But in all cases, if you get the key to the kingdom, you are in. So the answer might be yes to your question, with the addition that you should guard your root password. If you are interested in Linux security, you will benefit from my auditing tool Lynis. Free and open source, diving deeply into the system ...


29

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/write/execute permissions, for user/group/everybody else. Traditionally, these permissions are actually used, rather than ignored and/or worked around. ...


2

I think this Q/A site maybe not the best place for discussing the whole of Linux security, but: root access is usually restricted to local accounts, which you first have to get application installation is usually restricted to software sources, not executable installers linux has fewer users, and those users keep to better software practices (mainly ...


4

BadUSB isn't an attack. It's a tool used when designing attacks. When you plug a USB device into a computer, the device tells the computer what sort of thing it is, so the computer can select the appropriate driver. For example, a thumb drive declares itself as a "USB Mass Storage" device, while a keyboard is a "Human Interface Device". BadUSB is a ...


9

Who are you worried about? Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips. Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You ...


14

For a single-user system, there's not much difference between the two from a security perspective: in either case, the attacker needs to guess one password to gain superuser privileges. The big difference shows up in a situation where you've got multiple administrators. In that case, requiring sudo creates an audit trail of exactly who performed which ...


1

I wouldn't assign a password to the root account, it makes guessing usernames too easy. I solved this "problem" by assigning my account to a admin group and gave this group sudo rights without the use of a password. Once you made a group and added yourself use visudo to alter the sudoers file and add the following line: %GROUPNAME ALL=NOPASSWD: ALL Now you ...


2

I don't know how exactly a UML kernel is run on the host system. I'm entirely speculating, but my speculations might be useful if you can combine them with some documentation on UML implementations. Privilege escalation in the guest with a guest-specific exploit Being root on the guest kernel should essentially allow you to do whatever you want with the ...



Top 50 recent answers are included