Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1,878
questions
0
votes
1answer
79 views
Is it possible to decrypt file encrypted with Openssl?
I have a genareted a file with this command : tar cz inputFile | openssl enc -aes-256-cbc -pass pass:myPassword -e > outputfile. Is it possible to decrypt it without myPassword by bruteforcing or ...
0
votes
1answer
27 views
MIT Kerberos: getting keytabs onto hosts securely
When setting up a host (... or updating its keytab if it needs new entries), what's the standard way to set up keytabs?
Looks like the MIT Kerberos docs themselves recommend using ktadmin on the host ...
0
votes
1answer
118 views
Linux Privilege Escalation [closed]
I've been trying to solve a box. I got into the box by exploiting a web app and got reverse shell so I was www-data. I then found an ssh key that I used to login as another user and I ran sudo -l ...
2
votes
1answer
90 views
Is the MIT implementation of Kerberos protocol as vulnerable as the one used by Microsoft?
I am doing some research for school about the Kerberos protocol and its vulnerabilities, especially the Pass the Ticket attack.
Related articles are always talking about Active Directory so I was ...
0
votes
0answers
10 views
How can I get my gnome lockscreen as default instead of the grey system one? [migrated]
Suddenly my lockscreen changed from the gnome (blue one) lockscreen that detects the username and asks for password to the login screen that asks for both username and password. I am trying to get it ...
2
votes
2answers
153 views
How do I gain root access to a system using a setuid root binary?
Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
0
votes
0answers
23 views
How to make timeout work with airodump-ng on raspberry pi running buster? [migrated]
I wish to run airodump-ng run a set period of time on a Raspberry Pi running Raspbian Buster.
I've researched here and elsewhere and tried this:
timeout 10 sudo airodump-ng wlan1mon
... but the ...
1
vote
0answers
45 views
Why does sudo remove environment variables by default? [duplicate]
The sudo command has the -E option that allows users to pass through all environment variables, although it's still subject to the security policy configuration. So, is the use of -E inherently unsafe?...
1
vote
1answer
73 views
Wiping a hard drive before reinstallation
A few years ago, I left a new laptop at a sketchy computer shop to downgrade the OS to Windows 7. The experience was a disaster. My goal now is to install Cinnamon Linux on the laptop and remove ...
2
votes
0answers
54 views
Using a TPM as a hardware authentication device
My company is currently developing a product which consists of a fairly generic PC hardware platform and a software stack (the software stack is based on a Debian Buster Linux OS + some applications ...
2
votes
1answer
65 views
Check TRIM space on SSD
Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
0
votes
1answer
50 views
Linux security modules (LSM) and reference monitor implementation
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux ...
0
votes
0answers
67 views
Linux whitelist-based Mandatory Access Control instead of a blacklist-based model
I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
0
votes
0answers
38 views
Dreamhost hosted wordpress site attacked - SSH password was changed - Need help assesing attack vector
My client had his wordpress site attacked, his site is not a juici target, the attack consisted in redirecting the site to another site.
That in itself is no surprise, the weird thing is that both the ...
0
votes
0answers
40 views
Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]
Background
In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
-1
votes
1answer
92 views
What is “environmental noise”?
I'm looking at way to generate random numbers for cryptographic purposes. More specifically, I looked at the Linux /dev/urandom function, which is considered a real random number generator. There are ...
1
vote
1answer
67 views
Shell escaping vs. /etc/sudoers. What's the difference?
I am trying to grasp some basic principles of security in Linux (I used Centos 8.0 and Kali 2020 in the example below).
I found that providing you have an account in a particular system that is in the ...
2
votes
2answers
146 views
How does the weakness of SHA-1 introduce attack vectors in SSH?
The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
4
votes
1answer
102 views
Why does openSUSE sporadically prompt during boot to trust its built-in certificate?
The conundrum
My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently ...
0
votes
1answer
108 views
Getting AVAST alert during program update/upgrade in Kali Linux
So i started to use VirtualBox in windows 10 and i would like to know if those alert from my windows 10 security program (avast antivirus), during my installation/upgrading of TheHarvester program at ...
-1
votes
2answers
82 views
Can I check if ransomware is running by using a VM [closed]
I am not an expert, but as far as I understand, ransomware will encrypt files and (for an undefined period) decrypt as well, so it appears all is well. At some point in time, the decrypting ends and ...
0
votes
2answers
70 views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
0
votes
0answers
63 views
how to document and check apt inrelease files? are there blockchain records for that?
apt InRelease files update like twice every day, in ubuntu repositories and their mirrors. similarly in ubuntu and debian based distros, and other apt repositories. these files are small text files ...
3
votes
4answers
115 views
Real value of MAC models in Linux
I have read about MAC vs. DAC in the Internet, but I still fail to understand, what kind of attack it is impossible to protect against if one only uses DAC+capabilities in comparison to MAC+DAC+...
0
votes
1answer
43 views
WordPress script injections [duplicate]
I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception
PHP Fatal error: Namespace declaration statement has to be the very ...
0
votes
3answers
231 views
How can I protect me from… myself?
So, here is the deal:
I have a file I cannot change. I cannot, but I know in the future I will want to change it. It's of my understanding that it's not possible to make this file unchangeable while ...
1
vote
1answer
68 views
Way to remove rc4 from Linux Cipher Suites
Running this command resulted with the list of ciphers which supports rc4:
/usr/bin/openssl ciphers -v | grep -i "rc4"
What's the easiest way and how to remove specifically ciphers that ...
0
votes
0answers
70 views
Visual Studio Code on Linux - Privacy risk? [duplicate]
I'm a fan of Visual Studio, and recently installed VSC on my Linux Mint. However recently I did a deep-dive on Richard Stallman's site reading about just how evil and depraved all the big tech ...
0
votes
0answers
67 views
Setuid on rcp not working as expected
While pentesting in a lab, came across an rcp binary with setuid bit which looked like a potential privilege escalation vector.
bash-3.1$ ls -l /usr/bin/rcp
-rwsr-xr-x 1 root root 18544 May 18 2007 /...
1
vote
0answers
47 views
Log/Detect Clipboard access
With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...
3
votes
1answer
119 views
Is it possible to run commands that exist only on the host on a docker container?
We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...
0
votes
1answer
298 views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
2
votes
1answer
63 views
reading a file with other read permissions set
For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file
A non-root user can techincally read that file but in practice to read it the ...
0
votes
0answers
66 views
Securely execute child process on embedded Linux
Background
I have an embedded Linux devices and need to invoke a subprocess. I try to avoid it but sometimes it's the most practical thing to do, e.g. calling networking commands like ip, ...
2
votes
1answer
43 views
Is there a good reason (and what can it be) to require DAC restriction on IPC in addition to SELinux rules?
Our company is developing an AOSP-based platform for our customer. Some of our vendor services are using HWBinder for IPC which is using SELinux to restrict service discovery and access. The problem ...
0
votes
1answer
84 views
Send hex code into standard input after getting some output
I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.
I'm trying to input hex code into my ...
0
votes
1answer
48 views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
0
votes
1answer
82 views
Is LXD virtualization as isolated and secure as KVM virtual machines?
Stumbled upon a privacy conscious hosting provider that uses LXD vs KVM to manage user VPS instances.
My understanding is KVM is more isolated so using LXD doesn’t make sense from a privacy ...
0
votes
2answers
142 views
How bad is rsync with no-password sudo?
I need to backup files with preserved attributes from a source workstation to a LAN server (both on Linux Mint, the server is running sshd and Samba). One of the solutions which preserves files' ...
0
votes
1answer
145 views
“Life is not easy.” Linux virus : what to do next? [duplicate]
Context
I found out my Linux server was infected.
Symptoms were : 100% CPU usage when idle, slow download speed, iptables rules keeps growing.
After finding the processes, killing it and all the ...
3
votes
4answers
170 views
Why did “terminal commands” never get a version of SQL “parameterized queries”?
I was taught horrible bad practice when I initially "learned" SQL, which baked in user-submitted input with quotes and attempted to "escape" this (in the beginning, I didn't even ...
1
vote
0answers
79 views
linuxpam-pam unix-security-bypass
https://exchange.xforce.ibmcloud.com/vulnerabilities/31739
linuxpam-pamunix-security-bypass (31739) reported Jan 23, 2007
Linux-PAM could allow a remote attacker to bypass security
restrictions, ...
3
votes
3answers
311 views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
2
votes
5answers
279 views
Why can't we protect the password file so that only the system can read it?
Can't we design an OS in such a way that it doesn't allow anyone (not even root) to read the passwords file? Then there will be no need for encrypting the passwords. Why can't we hard-code a computer ...
0
votes
0answers
69 views
Reverse sudo - sudo ro untrusted user
I want to split my terminal sessions to different users, to compartmentalize them.
If I sudo -i -u user1 in one terminal window,
can user1 attack my main session?
Everyone talks about sudo to escalate ...
0
votes
2answers
93 views
Assigning static IP address other than 127.0.0.0/8 to loopback interface
We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
1
vote
1answer
61 views
Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]
Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
0
votes
0answers
48 views
Risks of running network services on a LAN hardware firewall
I am planning to set up a dedicated hardware firewall like Protectli and run a pfsense on it. I already know that:
it is a good practice NOT to have a wireless adapter on the firewall unit
it is ok ...
0
votes
1answer
62 views
Checking system integrity after clicking scam email link on Linux
Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link.
The link loaded a page of fairly nonsensical text. The source of the page had no ...
1
vote
1answer
77 views
Properly granting restrictive administrative privileges to developers on a production server [closed]
I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
