3,743 reputation
617
bio website
location Ireland
age
visits member for 1 year, 9 months
seen 18 hours ago

Oct
22
comment One liner to create passwords in linux?
It depends on the version of coreutils/shuf, it used to use /dev/urandom, this was undone in the shared randread code (affecting multiple tools) in coreutils-7.3 due to poor performance of shred. Insert face in palm.
Oct
17
comment Bash command argument security
See also openssl.org/docs/apps/openssl.html#PASS_PHRASE_ARGUMENTS for OpenSSL's take on this.
Oct
17
awarded  Critic
Oct
17
comment Bash command argument security
Both using a variable or substitution on the command line almost certainly expose it to other users via ps (and/or /proc), the shell expands them first. Try it and see: echo 60 > password.txt; sleep $(cat password.txt) & ps -fp $!
Oct
16
revised How nmap guesses the operating system?
added 187 characters in body
Oct
16
answered How nmap guesses the operating system?
Oct
15
answered PKI expired and renewed, do my correspondents have to do anything?
Oct
15
awarded  Organizer
Oct
15
revised What is the name for “imperfect” verification options?
tags
Oct
15
answered What is the name for “imperfect” verification options?
Oct
10
answered Isn't the behaviour of the switch to flood packets when it's MAC table is still empty dangerous?
Sep
29
revised How do I secure Apache against the Bash Shellshock vulnerability?
mod_security, privileged mode
Sep
26
revised How do I secure Apache against the Bash Shellshock vulnerability?
SSI includes, remove stray quotes
Sep
25
comment How do I secure Apache against the Bash Shellshock vulnerability?
Bear trap: SSI (includes) using #exec cmd start life with a "/bin/sh". CGI scripts do not have this extra layer, so a #!/bin/ksh CGI script is safe AFAICT (tested under httpd-2.2 only).
Sep
25
awarded  Nice Answer
Sep
25
comment Is there a short command to test if my server is secure against the shellshock bash bug?
@Ajedi32 /bin/sh -c is a used heavily to start child-processes. If the environment can be controlled by an attacker then there's a problem - the most common case is a web server using the environment as a form of IPC when running a CGI scripts.
Sep
25
revised How do I secure Apache against the Bash Shellshock vulnerability?
added 832 characters in body
Sep
25
comment How do I secure Apache against the Bash Shellshock vulnerability?
Red Hat's "do not use environment variables and we believe they are not affected" is misleading IMHO: the modules themselves might not be direct vulnerable, but they are almost certainly running code which might be. Consider if the modules might create/preserve problematic environment content, and if they pass this to a vulnerable shell. Have a peek at perl's Perl_do_exec3(), PHP's proc_open() or Python's pipes or subprocess.
Sep
25
revised How do I secure Apache against the Bash Shellshock vulnerability?
added 762 characters in body
Sep
25
revised How do I secure Apache against the Bash Shellshock vulnerability?
added 762 characters in body