Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1,686
questions
2
votes
1answer
93 views
Can I blindly trust 127.0.0.1?
On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
1
vote
0answers
39 views
Why is keybase/gui_config.json owned by root?
I have keybase running on my Linux Desktop (Ubuntu 19.04). Since a recent update, the file ~/.config/keybase/gui_config.json is owned by root which is quite irritating. One negative effect of this is ...
0
votes
0answers
18 views
Issues with finding a gateway with static routing [duplicate]
I am doing this online lab where I am hosting a Kali Linux box in VmWare fusion, and VPNing into the online lab. These are my networking adapters once I connect via VPN:
eth0: flags=4163<UP,...
3
votes
1answer
89 views
Deactivate Linux Shell to prevent “blind” login on router
Today I analyzed my home router.
I connected a keyboard to the router's USB port, which is usually used for mass storage devices.
However, I pressed the key combination to reboot a Linux system from ...
0
votes
0answers
60 views
linux server appears to find and kill any tool which looks at the box's processes [on hold]
Something alerts on a linux box - so I take a look, then things get odd trying to fix it. Best to give an example:
# top
Killed
# ps aux
Killed
Ok (I tried every other process based thing, pstree ...
0
votes
0answers
68 views
If I was compromised, what are the solutions? [closed]
Yesterday evening, on Sunday I was using the computer as usual. I was streaming music from SomaFM's DEF CON channel via mpv.
I wanted to download a video from YouTube with youtube-dl. I ran the ...
1
vote
1answer
107 views
Exploiting cron job running as root
There is a cron job running as root on a web server every 15 minutes:
php cli-script.php
It is not possible to directly modify the PHP script cli-script.php. Hower it includes another PHP script db....
1
vote
0answers
33 views
x.509 certificate chain verification in Linux kernel prior to 4.12
I am trying to use certificate chain verification in Linux kernel.
The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA.
For this purpose I ...
0
votes
0answers
31 views
Trying to solve Vulnhub Vulnix machine. Cant write to mount even after changing user
I am currently trying to solve the Vulnix machine from Vulnhub and it seems like even after trying to go step by step as per the walkthroughs available online, i cant get through this machine. As of ...
0
votes
1answer
86 views
Analyze Windows Malware on Linux
I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows.
Is it possible to ...
2
votes
1answer
93 views
Unix/Linux shells which use effective UID instead of real UID
My question is build on top of the answer of the question about SUID exploitation:
SUID not used after exploit
The person (official answer) is stating that:
Many popular implementations of sh ...
0
votes
0answers
8 views
How to obtain volume encryption interoperability between Android and Linux (LUKS) [migrated]
On Linux, I use LUKS to encrypt containers (a filesystem on a file), which is portable as it can be easily copied, stored on any external filesystem, such as FAT or NTFS on external drives or SD cards....
3
votes
1answer
95 views
Replace forbidden characters function check python
I have "blackbox" with the following python function code (without permission to change it):
def exec_ping():
forbidden = ['&', ';', '-', '`', '||', '|']
command = input('Enter an IP: ')
...
2
votes
1answer
141 views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
1
vote
0answers
44 views
Getting Linux process list and state C++ [closed]
I have a pet project where I am trying to develop a small antivirus program for Linux. I have already designed the mathematical model and the heuristic approach that I plan on using, yet now I am ...
3
votes
0answers
92 views
Does Linux Kernel Support RSA Encryption/Decryption? [migrated]
I'm currently working on a prototype. I need RSA Encryption at the Linux Kernel level,although from my research, it seems that the Linux Kernel only supports signature verification. When I look ...
4
votes
0answers
106 views
How to securely delete a file after it was insecurely deleted (in linux)
How can I securely delete/shred a file after I accidentally deleted the file insecurely?
Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
1
vote
1answer
132 views
My production Ubuntu server was breached through Redis and I found this script. Is it a decoy?
A few days ago my VPS came under heavy load from spammers trying ssh attacks and script injections. I have since added new fail2ban regexps and new security measures for REDIS where it looks like they ...
0
votes
0answers
25 views
No networks or clients showing up when using airodump-ng
I'm new to ethical hacking and this is a problem I cannot find a fix for anywhere. When I put my wifi card into monitor mode and use airodump-ng, I don't get any networks showing up. I am using and ...
0
votes
0answers
79 views
Why does linux cryptsetup use PBKDF2 instead of bcrypt?
I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
3
votes
1answer
113 views
Exposure of /etc/ssh, risks?
I accidentally exposed the keys in /etc/ssh
What is the risk?
I think it will allow someone to impersonate the server and conduct MITM.
Will it let someone SSH into the server? I think not because ...
0
votes
0answers
46 views
How to use browser bookmarks more securely?
I have been wondering in how far any tracking sites or other instances could gather information about me through my browser bookmarks (ie. in Firefox). An online search did not result in a lot of ...
0
votes
0answers
123 views
How strong do linux user account passwords have to be when using Full Disk Encryption (FDE) too?
Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.
assume: full disk ...
0
votes
3answers
81 views
Can antiviruses scan /var
I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ...
0
votes
0answers
32 views
Iptables ruleset changes when running a native vpn application
Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated?
Consider that one of the rules which always ...
0
votes
0answers
41 views
Sufficient to only require 2FA for su elevation?
I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network.
I wanted to turn on a 2FA ...
-1
votes
1answer
92 views
Does Shell-in-a-Box offer double encryption?
Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
1
vote
1answer
411 views
Why doesn't my systemctl command work? [closed]
I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
2
votes
0answers
145 views
What are the security implications of capabilities in Kubernetes pods?
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
...
0
votes
1answer
132 views
Is Opal-based full disk encryption fully working for Linux? [on hold]
I'd like to know to manage the password purely via the BIOS and not need to run any utility e.g. sedutil.
0
votes
1answer
40 views
Connection changes after waking from sleep
On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID).
I like to ...
0
votes
0answers
55 views
Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?
In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved.
But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff?
In this case,...
1
vote
2answers
89 views
Is it ok to allow a web application to write its own executable files?
Usually I setup my Ubuntu server to have at least 2 users:
A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data
A user that updates and maintains the web ...
1
vote
1answer
81 views
Simple buffer overflow trying to leak address of system()
Code:
#include <string.h>
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I've determined I ...
1
vote
0answers
43 views
Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address
I wrote a basic vulnerable app in C.
#include
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I ...
39
votes
8answers
10k views
How can I prevent a user from copying files to another hard drive?
I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
0
votes
1answer
45 views
SSH Timed out problem [closed]
I can't connect to my kali linux ssh server running in Virtualbox through puTTY. I didn't make any changes to /etc/ssh/sshd_config file, besides Port and PermitRootLogin
That's how i booted up my ssh ...
0
votes
1answer
149 views
Why isn't free software signed with self-signed certificates? [duplicate]
A majority of free software (in particular, Linux ports for Windows) are not signed.
As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
2
votes
0answers
141 views
How safe is it to enable unprivileged user namespace: unprivileged_userns_clone [duplicate]
Linux user namespaces are special, as they play the role of the owner of the other namespaces.
Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.
For ...
22
votes
1answer
3k views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
1
vote
1answer
105 views
Is double encrypting with AES safe?
Is it safe to encrypt twice with AES, with any mode? Are any combinations of AES, e.g. AES with XTS and AES with CBC, or twice with AES and XTS, more unsafe than just having it encrypted once?
I know ...
0
votes
1answer
76 views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
32
votes
2answers
4k views
Ability To Change Root User Password (Vulnerability?)
I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation.
How ...
3
votes
1answer
193 views
Do I need microcode update if I update Kernel?
There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling.
I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
33
votes
2answers
9k views
Is having a hidden directory under /etc safe?
On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
34
votes
2answers
8k views
Why is there a need to modify system call tables in Linux?
I have been learning about rootkits recently and have noticed this hooking techniques that kernel-land rootkits use in order perform malicious actions.
Where a typical hooking operation would be to ...
0
votes
1answer
60 views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
2answers
100 views
Is an encrypted private key which never leaves my home directory more secure than an unencrypted one?
On a Linux system I'm running an utility like this:
$ /usr/bin/myapp myprivatekey
Enter passphrase for the private key:...
...application runs and uses the private key
My understanding is that if I ...
1
vote
1answer
124 views
Honeypot for Linux user
Let's consider the following scenario:
You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
1
vote
0answers
100 views
How to stop logging for a specific user?
I'm a root user on my server. There are a bunch of users on my system.
As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
