Questions tagged [debian]
One of the earliest Linux distros and officially consist of only free software. Many distros has been derived from the Debian codebase, like Ubuntu and Knoppix.
98
questions
2
votes
2
answers
93
views
Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it
I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build.
Debian's security tracker states it's fixed: https://security-tracker.debian....
0
votes
0
answers
61
views
Risk of spyware with proprietary firmware packages on Linux, even after removing them?
When I installed Debian 12 LXQt ISO with the graphical install, it installed many proprietary firmware packages that were not needed and without my consent.
Is it possible that proprietary firmware ...
- 103
5
votes
2
answers
143
views
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
- 53
1
vote
1
answer
378
views
fail2ban - syntax for setting bantime in a unit other than seconds?
I have just installed fail2ban on my host.
All documentation I found, including fail2ban's latest official page, mentions seconds as the time unit to use to ban any given host.
So for example the ...
- 113
2
votes
2
answers
364
views
What can a virus hidden in a video do and will the video be playable?
Based on existing answers, I found out that viruses can "hide" in a video by exploiting the software/libraries used to open the video, say ffmpeg. But my question is:
If a video contains ...
- 217
0
votes
1
answer
453
views
Clarification on vulnerability statuses
What do statuses of Ubuntu and Debian security trackers mean exactly in plain of definitely vulnerable\definitely not vulnerable\unknown?
I have found this answer How to read CVE - 2016 - 5696 ...
0
votes
1
answer
64
views
How exactly do security fixes get to the users in PHP?
I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the ...
- 145
0
votes
1
answer
79
views
Ubuntu vs. Debian SSH public key login
In the Debian 9 server I have, these are the least restrictive permissions I can set for SSH login with public key to work:
/home/user 775
/home/user/.ssh ...
- 101
1
vote
0
answers
137
views
Was the kernel I used vulnerable/deprecated?
Background Information
As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous ...
- 11
0
votes
0
answers
19
views
strange file name in user's home directory [duplicate]
I recently found a strange file in my user home directory.
~$ ls -li
total 16
...
262994 -rw-r--r-- 1 user1 user1 0 Jul 14 12:13 ''$'\020\243''end'$'\202\243''row̹'$'\246''column'$'\316\001'
...
I ...
- 1
1
vote
0
answers
154
views
Does secure boot prevent evil maid attacks when using LUKS?
When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger?
Disk is formatted using defaults which ...
- 219
19
votes
5
answers
7k
views
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
- 675
1
vote
1
answer
316
views
How can an ELF binary call a Windows API from WSL(2) to deploy a payload?
In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was:
written in Python
compiled to an ELF exe using PyInstaller in Debian in WSL
and "injected into ...
- 138
0
votes
1
answer
771
views
Is DSA-1024 safe to sign package repositories ? What are the reasons?
I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg
It also probably uses SHA-1 as the signature ...
0
votes
1
answer
297
views
Why is my SecAction rule being ignored?
I'm trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
- 51
0
votes
0
answers
222
views
Guessing UUIDv1 hashes?
I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX.
I'm trying to identify which ...
- 91
0
votes
2
answers
506
views
Remediating base image vulnerabilities
I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian....
- 11
0
votes
1
answer
108
views
Can I use root account if every server only runs one service [Debian/Ubuntu Server] [duplicate]
Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine ...
user129187
1
vote
0
answers
87
views
Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get packages ...
- 998
3
votes
1
answer
349
views
Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded ...
- 998
1
vote
1
answer
3k
views
How to remove a ca certificate in debian?
I have added a root ca in my debian machine by using the following commands:
mkdir /usr/local/share/ca-certificates/custom/
mv myserver.crt /usr/local/share/ca-certificates/custom/
update-ca-...
- 63
4
votes
2
answers
1k
views
Was there ever any malware found in Debian/Ubuntu packages?
With over 30,000 projects packaged by Debian, it doesn't seem too unlikely that some of them may contain malware. On Ubuntu's side, the review process is apparently rather superficial, aimed at ...
- 333
2
votes
1
answer
519
views
Linux security modules (LSM) and reference monitor implementation
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux ...
- 171
0
votes
1
answer
186
views
How to pin public root key when downloading an image with docker pull (Docker Content Trust)?
How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
- 998
3
votes
1
answer
341
views
How to list all of the known root keys in docker (Docker Content Trust)
How can I list all of the Docker Content Trust root keys on my system?
I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
- 998
2
votes
2
answers
928
views
Is autologin dangerous? (Debian/Linux)
If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin:
/etc/lightdm/lightdm.conf
[Seat:*]
autologin-...
- 21
2
votes
1
answer
917
views
ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?
Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
- 21
1
vote
1
answer
222
views
Sufficient to only install security updates on Debian?
On my Debian, I only do security updates:
deb http://security.debian.org/debian-security/ buster/updates main
deb-src http://security.debian.org/debian-security/ buster/updates main
For example, ...
- 11
2
votes
0
answers
112
views
Create signed release binaries and distribute with custom repository (debian)
I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther.
I set up a ...
- 467
2
votes
1
answer
833
views
Transfer requests for localhost zone on my bind DNS server
I use Debian stretch and Bind 9.10.3 as my DNS server.
Today I saw the following entry in my log file:
Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
- 123
0
votes
2
answers
223
views
Security a Linux VPS: is the "standard advice" enough?
Like so many others, I'm an intermediate web developer who is starting to get into the security side of things and I'm looking to start running a Linux VPS (Debian). For years, I've resisted the move ...
- 141
1
vote
1
answer
199
views
Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?
I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
- 13
-1
votes
1
answer
176
views
Does this iptables entry indicate someone's trying to break in?
Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
- 119
0
votes
1
answer
734
views
Any known vulnerabilities for thttpd 2.25b 29dec2003
Quick question, having trouble finding any information online relating to that specific year for the given version thttpd 2.25b 29dec2003. Need to explain what vulnerabilities this may have had, if it ...
Hazza
2
votes
1
answer
3k
views
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d.
Then if I ...
- 135
3
votes
1
answer
557
views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
- 441
1
vote
1
answer
212
views
Can not setting password for root when installing linux be exploited?
Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
- 13
1
vote
0
answers
133
views
How can I maintain and automate a list of download URLs with known hashes? [closed]
I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
- 3,610
3
votes
0
answers
110
views
Version earlier than 0 in Debian OVAL feeds
I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
0
votes
1
answer
656
views
authby=secret serve as alternative to AH in ipsec.conf
I have employed strongSwan U5.5.1 for installing an IPsec tunnel between two Debian hosts with a firewall in between. My ipsec.conf specifies authby=secret but not ah=. The firewall currently permits ...
- 213
1
vote
1
answer
5k
views
Why doesn't my systemctl command work? [closed]
I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
- 113
33
votes
2
answers
10k
views
Is having a hidden directory under /etc safe?
On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
- 857
0
votes
0
answers
98
views
Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be.
Is it ...
- 101
0
votes
3
answers
325
views
Is my PC safe after DSA-4371?
I used
sudo apt-get update
sudo apt-get upgrade
before I read https://www.debian.org/security/2019/dsa-4371
There was I change that my PC got exploited/hacked/virused.
So I used
chkrootkit
and ...
9
votes
2
answers
577
views
Remote Code Execution in apt/apt-get
Recently, a vulnerability has been found in apt that allows arbitrary code execution, see here.
Is it reasonable just to update the system? Or we should be worried that this has been used and so ...
- 216
6
votes
1
answer
2k
views
I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]
This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing:
What is this process? How can I get ...
0
votes
2
answers
524
views
How does default Debian boot drive encryption works?
When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.
It looks ok, but how does it work? ...
- 103
3
votes
1
answer
525
views
the state of ASLR, PIE, SSP on Debian in 2018?
As far as I remember,
most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).
Did the situation improve with Debian Squeeze or the upcoming Debian ...
- 81
3
votes
2
answers
675
views
Detect and remove rootkit from Debian 8.5 (x64)
My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp.
I found out about the infection by seeing high CPU loads ...
- 1,207
3
votes
1
answer
580
views
Is there a security tracker aggregated file for Ubuntu server like Debian has?
Debian has a JSON file containing all CVE<->Fixed package versions map.
Link: https://security-tracker.debian.org/tracker/data/json
Does Ubuntu have something similar?
- 175