Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Binwalk IMOU Firmware Dump

I have recently acquired a firmware dump of an IMOU Cue IP camera. When I ran binwalk -eM on it I got the following output, however, It failed to extract any files: Scan Time: 2023-02-04 19:37:14 ...
1 vote
0 answers
35 views

How can I sandbox wine itself, and all wine applications?

I don't want wine accessing my ext4 partition which is typically the Z: drive. How can I restrict or sandbox wine?
0 votes
0 answers
60 views

Password gets cached by keyboard? [closed]

I noticed something very strange today: one of my passwords is being saved by the keyboard (or programmable G-keys on the keyboard). Explanation of my system: Dual-Boot-Setup with Windows 10 (always ...
1 vote
0 answers
36 views

Using the readlink function to avoid symbolic link race conditions when opening a file path [migrated]

I'm reading this paper. On the page 11 the paper says: Unix applications can obtain access to files without encountering symlink races. This is important for normal application programmers who, for ...
  • 11
0 votes
0 answers
17 views

Security and practicality of passing secrets to services running as non-privileged user

I strongly dislike and mistrust the practice to store secrets in plain text files for unattended access by services. This is increasingly less of an issue in modern deployments where secrets are ...
  • 113
0 votes
1 answer
81 views

Vulnerability in the source code, but can't elevate do Privilege Escalation

Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
1 vote
0 answers
27 views

Evil twin WiFi station has no internet connection [migrated]

I am trying to create a fake AP using the airbase-ng to test how evil twin works. I have a WiFi adapter TP-link WN4226 [Atheros AR9271 chipset], which supports monitor mode. My laptop (running on ...
  • 111
0 votes
0 answers
7 views

What linux distro allows full encryption when dual booting from windows 11 [migrated]

I want to install a distro to work with windows when I dual boot. I know that lubuntu allows full disk encryption, but it doesnt encrypt /boot. I am also aware to this ubuntu guide: https://help....
1 vote
1 answer
58 views

user namespaces: do they increase security, or introduce new attack surface?

user namespaces in Linux are presented as a security feature, which should increase security. But is this really true? Is it possible that while user namespaces fix one kind of problem, they introduce ...
0 votes
0 answers
51 views

How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux

I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message: openssl pkcs12 -export -out ./star_domain_com.pfx -...
0 votes
0 answers
31 views

Why doesn't this reverse shell work?

If I have the following php code: $output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}"); why does this code work when injecting with burpsuite: delim=comma;bash -c ...
  • 101
0 votes
3 answers
113 views

What is the most secure way to transfer untrusted data between containers?

Let's suppose we have two containers running on a linux box and one has untrusted user data that the other needs to process. What is the most secure way to transfer this data? Is it better to write ...
1 vote
0 answers
25 views

TPM FAPI sealing data inside /dev

I am using TPM simulator in my local VM to test FAPI API and able to seal the important data inside directory ~/.local/share/tpm2-tss/user/keystore as per the path mentioned in config file /etc/fapi-...
  • 151
2 votes
2 answers
141 views

What can a virus hidden in a video do and will the video be playable?

Based on existing answers, I found out that viruses can "hide" in a video by exploiting the software/libraries used to open the video, say ffmpeg. But my question is: If a video contains ...
0 votes
1 answer
169 views

Format a probably infected USB, is it safest Ubuntu live or Ubuntu installed?

I have an USB drive that probably is infected. I have a PC where currently I have not any partition, just an "empty" PC and I have a CD with Ubuntu 22.04. I would like to copy USB data, ...
0 votes
0 answers
18 views

Can I know kernel address layout and memory mapped IO layout from the user privilege in linux kernel?

My current understanding is that the user does not have any way of knowing the kernel address space layout due to the protection mechanisms such as Kernel Address Space Layout Randomization (KASLR). ...
6 votes
4 answers
743 views

How can non-root intercept privileged loopback ports?

Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below. This warning is consitently displayed across many versions of Chrome in many ...
4 votes
0 answers
136 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
  • 140
1 vote
3 answers
40 views

Authenticating a request from a valid application (unshadowed)

I am working on an application which has an architectural description as below, There is a docker container, lets say Microservice-A, in which multiple processes are running. Each process is ...
13 votes
3 answers
5k views

How do we know that our SSL certificates are to be trusted?

On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
  • 185
1 vote
3 answers
85 views

Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?

I use this initramfs-based FDE on my headless server. My motivation is to secure my system against physical tampering. I am aware that securing an untrusted hardware is not possible. This question is ...
  • 113
2 votes
1 answer
72 views

FTPS with IP restriction OR SFT over SSH without IP restriction - which one is more secure?

Im able to connect to my managed Linux Ubuntu Server only through FTP using explicit SSL (Auth TLS) with IP restriction and SFT over SSH without IP restriction Question: which method is more secure to ...
3 votes
1 answer
167 views

Docker Apache - safe to chown /usr/local/apache2 to non-root user?

I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this): chown -hR appuser:...
  • 153
0 votes
2 answers
148 views

How to backdoor windows?

Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this: #define _GNU_SOURCE #include <stdlib.h> #include &...
0 votes
3 answers
155 views

What can an attacker do with physical access to a Linux server?

I have physical access to a Linux computer (Ubuntu 20.04). My colleague asked me what an attacker could do if he had physical access to this computer? I would like to know if, by default (after a ...
2 votes
1 answer
179 views

Store/Secure openssl cert and key file in TPM2.0

I have my TPM2.0 connected to my raspberry pi. I generated a Cert file and Private key using openssl. These files are used to connect MQTT with TLS. How do I store/secure these files in/with the TPM ...
0 votes
0 answers
97 views

Restrict node.js filesystem access

I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine. When Node starts, the script has access to the files outside its directory (as least by default), so ...
  • 289
1 vote
0 answers
84 views

Buffer overflow on a program that only accepts arguments as input

I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, ...
  • 11
0 votes
0 answers
32 views

fscrypt master key handling at kernel space adding additional secure params

In fscrypt, the master key is generated from userspace and actual encryption keys are derived from this master key using KDF. If any other process is able to get hold of the master key, they can ...
1 vote
0 answers
17 views

Can you configure Tripwire to produce an actual diff between modified files

I'm using the open source version of Tripwire on Ubuntu 22.04. Right now when a file is modified Tripwire will document this in the integrity check with an "Expected" vs "Observed" ...
0 votes
2 answers
117 views

My Linux Mint just accessed a wifi network WPA2 without knowing the password [closed]

I brought my personal notebook to work. Asked the IT technician to access the WiFi on it (it's a federal institution of health research, lots of biological risks involved). Then he noticed that the ...
12 votes
3 answers
6k views

Understanding suspicious HTTP GET Request

I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code: "GET /?...
  • 153
2 votes
2 answers
653 views

Is it safe to install curl and openssl in Alpine Docker image

I want to install curl and openssl packages in a Docker image based on Alpine Linux that I use in production. These packages will help me with debugging SSL certificates and HTTPS connections in my ...
0 votes
1 answer
46 views

Dismissing 500 errors in logwatch

Logwatch shows those attacks giving a 500. Given that 500 is an internal server error, does that mean I need to examine further or dismiss? 421 (undefined) /: 4 Time(s) 500 Internal Server Error ...
0 votes
0 answers
27 views

Using your own server as a proxy without having set it up as a proxy

In logwatch I got Connection attempts using mod_proxy: 146.66.178.78 -> mkzaim.ru:443: 1 Time(s) 90.151.171.106 -> host64.ru:443: 1 Time(s) Can this mean that they used my server as a ...
1 vote
1 answer
27 views

Does i need vpn to update/upgrade packages on fedora or debian if https is configured in sources file

Does i need vpn to update/upgrade packages on fedora or debian if https is configured in sources file ? Can packages be replaced by malicious ones through wifi attacks like fraggattacks ?
  • 13
0 votes
2 answers
117 views

Is a Linux live CD safe? Password is known

For the Mint Linux live CD the login is "mint" and the password is blank (there is no password, when asked, simply press Enter). It appears that the live CD is in root or superuser mode by ...
0 votes
0 answers
111 views

Which of these filesystem encryption philosophies and methodologies are better for which purpose?

Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few: encfs (I guess ...
1 vote
2 answers
101 views

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page: [bits 64] global _start section .text _start: xor rcx, rcx ...
2 votes
1 answer
485 views

Explanation of capabilities: CAP_NET_BIND_SERVICE

I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain. I am in a VM (Kali). ❯ uname -a ...
1 vote
0 answers
40 views

Is "pam_ssh_agent_auth" more secure than passwords for sudo on a remote server?

I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/...
0 votes
0 answers
35 views

Making time(0) produce an error

I'm currently reviewing/reversing a software (coded in C) and it has a line like this : time_t var = time(0); My goal it to get this time(0) call to return -1. (I cannot modify the parameter.) ...
1 vote
1 answer
98 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
0 votes
1 answer
80 views

How do you trust two different cloud provider servers?

I've found a question with an answer here on Security StackExchange or on Unix StackExchange, but I can't find it anymore apparently :( If you find this answer already, help would be appreciated, I ...
0 votes
1 answer
99 views

Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?

I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
  • 123
-1 votes
1 answer
63 views

Confused about memory examination using gdb

I started reading "Hacking, The Art of Exploitation" and I am confused about some things regarding memory examination. When I disassemble main, I get an output of all memories where the ...
1 vote
1 answer
54 views

Purpose of Real UID in spite of setresuid()

While reading the manual page of setresuid() a question arose about the purpose of Real UID. As mentioned in the man page: setresuid() sets the real user ID, the effective user ID, and the saved set-...
1 vote
1 answer
46 views

Details: snoop environment variables using D-Bus IPC

The page at: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment says: Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC [...] I don't ...
0 votes
1 answer
45 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
0 votes
1 answer
48 views

Honeyd not responding to TCP

I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
  • 1

1
2 3 4 5
42