Questions tagged [debian]

One of the earliest Linux distros and officially consist of only free software. Many distros has been derived from the Debian codebase, like Ubuntu and Knoppix.

Filter by
Sorted by
Tagged with
1 vote
0 answers
67 views

Was the kernel I used vulnerable/deprecated?

Background Information As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous ...
user avatar
  • 11
0 votes
0 answers
19 views

strange file name in user's home directory [duplicate]

I recently found a strange file in my user home directory. ~$ ls -li total 16 ... 262994 -rw-r--r-- 1 user1 user1 0 Jul 14 12:13 ''$'\020\243''end'$'\202\243''row̹'$'\246''column'$'\316\001' ... I ...
user avatar
  • 1
0 votes
0 answers
42 views

Does secure boot prevent evil maid attacks when using LUKS?

When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger? Disk is formatted using defaults which ...
user avatar
18 votes
5 answers
7k views

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
user avatar
  • 625
0 votes
1 answer
158 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
user avatar
  • 138
0 votes
1 answer
295 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
user avatar
0 votes
1 answer
173 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
user avatar
  • 51
0 votes
0 answers
125 views

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which ...
user avatar
  • 89
0 votes
2 answers
237 views

Remediating base image vulnerabilities

I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian....
user avatar
  • 11
0 votes
1 answer
95 views

Can I use root account if every server only runs one service [Debian/Ubuntu Server] [duplicate]

Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine ...
user avatar
1 vote
0 answers
80 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
user avatar
2 votes
1 answer
187 views

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? My understanding was that software downloaded ...
user avatar
1 vote
1 answer
1k views

How to remove a ca certificate in debian?

I have added a root ca in my debian machine by using the following commands: mkdir /usr/local/share/ca-certificates/custom/ mv myserver.crt /usr/local/share/ca-certificates/custom/ update-ca-...
user avatar
  • 33
2 votes
2 answers
428 views

Was there ever any malware found in Debian/Ubuntu packages?

With over 30,000 projects packaged by Debian, it doesn't seem too unlikely that some of them may contain malware. On Ubuntu's side, the review process is apparently rather superficial, aimed at ...
user avatar
  • 302
1 vote
1 answer
354 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
user avatar
  • 161
0 votes
1 answer
108 views

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
user avatar
3 votes
1 answer
256 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
user avatar
2 votes
2 answers
601 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
user avatar
  • 21
2 votes
1 answer
526 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
user avatar
  • 21
1 vote
1 answer
178 views

Sufficient to only install security updates on Debian?

On my Debian, I only do security updates: deb http://security.debian.org/debian-security/ buster/updates main deb-src http://security.debian.org/debian-security/ buster/updates main For example, ...
user avatar
  • 11
1 vote
0 answers
88 views

Create signed release binaries and distribute with custom repository (debian)

I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther. I set up a ...
user avatar
2 votes
1 answer
506 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
user avatar
  • 123
0 votes
2 answers
157 views

Security a Linux VPS: is the "standard advice" enough?

Like so many others, I'm an intermediate web developer who is starting to get into the security side of things and I'm looking to start running a Linux VPS (Debian). For years, I've resisted the move ...
user avatar
  • 141
1 vote
1 answer
151 views

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
user avatar
  • 13
-1 votes
1 answer
161 views

Does this iptables entry indicate someone's trying to break in?

Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
user avatar
  • 119
0 votes
1 answer
455 views

Any known vulnerabilities for thttpd 2.25b 29dec2003

Quick question, having trouble finding any information online relating to that specific year for the given version thttpd 2.25b 29dec2003. Need to explain what vulnerabilities this may have had, if it ...
user avatar
2 votes
1 answer
2k views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
user avatar
  • 135
2 votes
1 answer
239 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
user avatar
  • 421
1 vote
1 answer
207 views

Can not setting password for root when installing linux be exploited?

Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
user avatar
  • 13
1 vote
0 answers
117 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
user avatar
  • 3,530
3 votes
0 answers
99 views

Version earlier than 0 in Debian OVAL feeds

I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
user avatar
0 votes
1 answer
375 views

authby=secret serve as alternative to AH in ipsec.conf

I have employed strongSwan U5.5.1 for installing an IPsec tunnel between two Debian hosts with a firewall in between. My ipsec.conf specifies authby=secret but not ah=. The firewall currently permits ...
user avatar
  • 213
1 vote
1 answer
4k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
user avatar
  • 113
33 votes
2 answers
10k views

Is having a hidden directory under /etc safe?

On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
user avatar
0 votes
0 answers
91 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
user avatar
  • 101
0 votes
3 answers
317 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
user avatar
9 votes
2 answers
533 views

Remote Code Execution in apt/apt-get

Recently, a vulnerability has been found in apt that allows arbitrary code execution, see here. Is it reasonable just to update the system? Or we should be worried that this has been used and so ...
user avatar
  • 216
6 votes
1 answer
2k views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
user avatar
0 votes
2 answers
381 views

How does default Debian boot drive encryption works?

When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password. It looks ok, but how does it work? ...
user avatar
  • 103
3 votes
1 answer
480 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
user avatar
  • 81
2 votes
1 answer
496 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
user avatar
  • 1,087
3 votes
1 answer
491 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
user avatar
  • 165
1 vote
1 answer
371 views

Remove sync user to harden the system

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, ...
user avatar
3 votes
1 answer
431 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
user avatar
  • 133
2 votes
1 answer
328 views

How to understand how someone had ssh access, and how to remove CVE-2017-0358

I have a home server that was compromised recently, it has been used to mine some crypto currencies. I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
user avatar
1 vote
1 answer
536 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
user avatar
  • 121
1 vote
0 answers
297 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...
user avatar
  • 11
2 votes
1 answer
1k views

How fix warnings from Debsecan

I'm new in linux admin and security approach, and need some tips about warnings from Debsecan scanner tool. I have some warnings returned by simple check, like this below: CVE-2017-1000158 python2.7-...
user avatar
  • 121
1 vote
1 answer
989 views

Suspicious SSH connection

this is the situation: vps with debian 8x32 virgin (new template of the provider's repository); exotic "user" and strong "password" ; 30 seconds later: command (apt-get update); 30 seconds later: ...
user avatar
-1 votes
1 answer
250 views

Debian 9 opted out of data collection, doing it anyway?

I've noticed when I log in to my Debian 9 account, it informs me that there are updates. I update and upgrade in terminal and it informs me that 0 bytes have been downloaded but requests to upload ...
user avatar