Questions tagged [debian]

One of the earliest Linux distros and officially consist of only free software. Many distros has been derived from the Debian codebase, like Ubuntu and Knoppix.

Filter by
Sorted by
Tagged with
2
votes
2answers
121 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
2
votes
1answer
67 views

ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity?

Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really ...
1
vote
1answer
51 views

Sufficient to only install security updates on Debian?

On my Debian, I only do security updates: deb http://security.debian.org/debian-security/ buster/updates main deb-src http://security.debian.org/debian-security/ buster/updates main For example, ...
1
vote
0answers
26 views

Create signed release binaries and distribute with custom repository (debian)

I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther. I set up a ...
2
votes
1answer
82 views

Transfer requests for localhost zone on my bind DNS server

I use Debian stretch and Bind 9.10.3 as my DNS server. Today I saw the following entry in my log file: Apr 17 23:04:22 ns named[111]: client 45.83.65.112#48974 (localhost): transfer of 'localhost/IN'...
-1
votes
2answers
83 views

Security a Linux VPS: is the “standard advice” enough?

Like so many others, I'm an intermediate web developer who is starting to get into the security side of things and I'm looking to start running a Linux VPS (Debian). For years, I've resisted the move ...
1
vote
1answer
87 views

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
-1
votes
1answer
93 views

Does this iptables entry indicate someone's trying to break in?

Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
0
votes
1answer
103 views

Any known vulnerabilities for thttpd 2.25b 29dec2003

Quick question, having trouble finding any information online relating to that specific year for the given version thttpd 2.25b 29dec2003. Need to explain what vulnerabilities this may have had, if it ...
1
vote
1answer
541 views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
1
vote
1answer
70 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
1
vote
1answer
142 views

Can not setting password for root when installing linux be exploited?

Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
1
vote
0answers
75 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
0answers
24 views

Version earlier than 0 in Debian OVAL feeds

I'm trying to parse Debian OVAL feeds to establish if some packages are vulnerable or not. I'm using criterions to establish what's the vulnerable version for a package, however often there are ...
0
votes
1answer
75 views

authby=secret serve as alternative to AH in ipsec.conf

I have employed strongSwan U5.5.1 for installing an IPsec tunnel between two Debian hosts with a firewall in between. My ipsec.conf specifies authby=secret but not ah=. The firewall currently permits ...
1
vote
1answer
2k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
33
votes
2answers
9k views

Is having a hidden directory under /etc safe?

On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
0
votes
0answers
41 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
0
votes
3answers
275 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
9
votes
2answers
451 views

Remote Code Execution in apt/apt-get

Recently, a vulnerability has been found in apt that allows arbitrary code execution, see here. Is it reasonable just to update the system? Or we should be worried that this has been used and so ...
6
votes
1answer
2k views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
0
votes
2answers
187 views

How does default Debian boot drive encryption works?

When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password. It looks ok, but how does it work? ...
2
votes
1answer
322 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
2
votes
1answer
308 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
3
votes
1answer
272 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
1
vote
1answer
73 views

Remove sync user to harden the system

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, ...
2
votes
1answer
177 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
2
votes
1answer
194 views

How to understand how someone had ssh access, and how to remove CVE-2017-0358

I have a home server that was compromised recently, it has been used to mine some crypto currencies. I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
1
vote
1answer
302 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
1
vote
0answers
201 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...
2
votes
1answer
893 views

How fix warnings from Debsecan

I'm new in linux admin and security approach, and need some tips about warnings from Debsecan scanner tool. I have some warnings returned by simple check, like this below: CVE-2017-1000158 python2.7-...
1
vote
1answer
530 views

Suspicious SSH connection

this is the situation: vps with debian 8x32 virgin (new template of the provider's repository); exotic "user" and strong "password" ; 30 seconds later: command (apt-get update); 30 seconds later: ...
-1
votes
1answer
194 views

Debian 9 opted out of data collection, doing it anyway?

I've noticed when I log in to my Debian 9 account, it informs me that there are updates. I update and upgrade in terminal and it informs me that 0 bytes have been downloaded but requests to upload ...
2
votes
1answer
1k views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
0
votes
1answer
160 views

chkrootkit weird output DEBIAN 9 [closed]

I recently had this in the chkrootkit output comparison : +! 7:0| 255 0:0|242:0|243:0|245:0|253:1|254:1|7:0| -stringPrefs 3:7;release|174:3;1.0|191:332; ¼½¾ǃː??։֊׃״܁܂܃܄ᅟᅠ᜵           ???‐’․‧?...
0
votes
2answers
494 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
600 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
0
votes
1answer
45 views

Is this version of openssl vulnerable?

I have an old Debian 3.1 (kernel 2.4.19) where the version of ssl is $ openssl version OpenSSL 0.9.8c 05 Sep 2006 I read that there was some issue about random generator being guessable. https://...
0
votes
1answer
287 views

/etc/sudoers file with permissions set to 640 instead of 0440: what does it mean?

So I'm still new to GNU/Linux: recently I installed Debian 9.1 with KDE. Now after executing: stat --format '%a' /etc/sudoers I found out that my sudoers file has the 640 permissions instead 0440 ...
2
votes
1answer
1k views

ClamAV findings under Debian 9: LibreOfficeMacros and PUA.Win.Exploit.CVE_2012_0110-1 - false positives?

I'm running a recently installed Debian 9.1 with KDE and a ClamAV scan gives me these findings: /usr/lib/libreoffice/share/extensions/wiki-publisher/WikiEditor/Module1.xba PUA.Doc.Tool....
1
vote
0answers
270 views

Frequent heavy CPU load from firefox browser -> malware? [closed]

Since recently I started to get very heavy CPU load on my 64bit Debian 9.0 Cinnamon machine. I have all my packages up to date including Firefox-ESR. Often the load is so heavy that I can hear my CPU. ...
0
votes
1answer
101 views

secure the code of a server physically rented to the client

My company rents a Debian server to the clients, that they have to connect to their own network. The server provides various services, an administration interface, and connects to the online service ...
5
votes
2answers
490 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
5
votes
1answer
3k views

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

According to NIST and HIPAA guidance, I miss one cipher on a new web server: TLS_RSA_WITH_3DES_EDE_CBC_SHA Despite I read this one is discouraged, I am curious as to how do I add it? I am on Linux ...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
1
vote
1answer
154 views

Is there a way to ask cracklib-check to go through a list of passwords?

I know cracklib-check can be used to check individual password, like - $ echo "12345" | /usr/sbin/cracklib-check 12345: it is too short If not wanting to be super-user as on Debian it requires to ...
1
vote
2answers
285 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
2
votes
4answers
2k views

Unauthenticated packages in debian

Yesterday I updated my debian server using: apt-get update && apt-get upgrade I received message that some of the packages cannot be authenticated being in a rush I hit yes to install ...
1
vote
1answer
585 views

protect c ++ application via an automatic hardware binding

I have a Qt App which is running on a raspberry pi (Debian Wheezy). The raspberry image is autogenerated via a python script: - Get the latest version of the generic custom-raspi-image - Mount the ...
1
vote
0answers
206 views

Vulnerable Keys? CVE-2008-0166 openssl DSA Key Signature Blacklist coverage?

Would the current set of DSA key blacklists detect a DSA key that was generated with openssl on an affected/vulnerable system, BUT whose DSA parameters (dsaparam) were generated on an unaffected ...