Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Linux automated SMB connection attempts: has my server been compromised [migrated]

We have a Linux server running CentOS7. A few days ago we found out that it has started continuously attempting to connect to a Windows server share via port 445 using a certain user's AD credentials. ...
swami's user avatar
  • 101
0 votes
1 answer
39 views

Is it possible to hide a secret value from my own processes on Linux?

I have an application with a shared secret. This application runs as my user. However, Linux has the /proc directory, and particularly /proc/{pid}/mem and /proc/{pid}/maps. Any process created with ...
Cort Ammon's user avatar
  • 9,236
0 votes
0 answers
32 views

Spoofing MAC address not working with wired interface [closed]

I run the following script at boot to spoof my mac address before starting NetworkManager and connecting to any AP: #!/bin/bash # Wireless mac spoofing echo "Spoofing wireless mac address (wlan0)...
alex4breakme's user avatar
6 votes
3 answers
2k views

Security implications of increasing sudo timeout in terminal

I often need to run commands with sudo during development and since my password is lengthy I don't like to type it every time sudo times out which by default is 5 minutes. To deal with that I've run ...
metablaster's user avatar
0 votes
0 answers
30 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
Michael Altfield's user avatar
0 votes
1 answer
68 views

Launch a process with secrets as environment variables

I have a process that needs secret keys to be passed as environment variables. That is for historical reasons. I have a AWS machine where this process runs but I do not want to store these keys in ...
Henrique Bucher's user avatar
0 votes
0 answers
48 views

Bash deletes null bytes in exploit input for ROP/returntolibc

I am trying to do a returntolibc exploit. The goal is to gain a shell with root privilege by calling setuid(0) and then system("/bin/sh"). I have been agonizing over trying to get this thing ...
germphjd's user avatar
11 votes
1 answer
410 views

XZ compromise and consequences for people having used it

Here's a hot topic: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users https://lwn.net/Articles/967180/ https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@...
Artem S. Tashkinov's user avatar
2 votes
1 answer
126 views

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
OneAndOnly's user avatar
0 votes
2 answers
96 views

Is a MITM attack possible for my apt repo?

OS is Debian. Imagine I have my own apt repo set up inside a private network. This repo is set up to provide a single package to other servers on this network. I can easily create a signing key for my ...
cat pants's user avatar
  • 101
3 votes
1 answer
275 views

Current (Feb 2024) High-Severity unfixed Linux Kernel CVEs

[Originally posted on ServerFault, was told it would fit better here] Our vulnerability scanner (AWS Inspector V2) in the last couple of weeks started reporting ~10 High severity CVEs with the Linux ...
laserslasers's user avatar
1 vote
1 answer
325 views

Safe usage of bitaddress.org

I want to use bitaddress.org to create a wallet. Can you please verify my approach? Change the password of my router and wifi and unplug all devices from the network except my notebook. Go to https:/...
Ohumeronen's user avatar
0 votes
0 answers
57 views

AppArmor deny all files except specifics

I have a Rust-app which uses PyO3 to execute arbitrary Python code. The Python code should only be able to do basic math operations and in now way should be able to access the network (except ...
O'Niel's user avatar
  • 2,914
0 votes
1 answer
69 views

Add child-process to cgroup?

Following the advice in my previous question here I currently have a Rust-binary that gets executed by my main-app using std::process::Command. The executed binary first gets validated by a hash. The ...
O'Niel's user avatar
  • 2,914
0 votes
1 answer
124 views

Is an antivirus needed for linux home usage when there is exchange of files with other OS e.g. Windows?

I was under the impression that an antivirus for Linux makes sense only for installing in business computers. Checking Norton/BitDefender/Karpesky I don't see any Linux option for the first or any non ...
Jim's user avatar
  • 183
1 vote
1 answer
86 views

How secure is XScreenSaver against physical attacks

We use LUKS/dm-crypt encrypted workstations with long passwords. But if an laptop is unlocked and booted into Debian, using Xscreensaver then the disk is in an unencrypted state but the keyboard is ...
Ludwig Van Beethoven's user avatar
0 votes
1 answer
171 views

How to block 192.168.0.1 for connected clients?

I installed Raspberry Pi OS on a RPi 3B, then I installed NetworkManager, set the Ethernet connection to "Shared to other computers" and connected an ethernet cable between the RPi and a ...
Dzenis Zigo's user avatar
1 vote
2 answers
98 views

Detecting if application connects remotely in linux

Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters. Background: Say ...
ciru_4011's user avatar
2 votes
1 answer
205 views

airodump-ng no associated station

i have a question many people asked in the last years but there seem to be no answer. So i will reask that. i am running "airodump-ng --essid [MyAP] -c [MyAP-Channel]" and getting no info ...
Yuki's user avatar
  • 23
0 votes
1 answer
518 views

Which Intel CPUs do not have Management Engine (ME) [duplicate]

The Intel Management Engine (ME) is a security risk which I would prefer not to take. I do not trust it, it seems to be a backdoor, and there are reported vulnerabilities on it. I do not trust the ...
user5623335's user avatar
0 votes
0 answers
198 views

how to exploit read -p in bash script

i wanna execute ls command inplace of the output being "your name is ls" is there a way to do it ? read -p "name??" name echo "your name is $name"
AverageUser69's user avatar
2 votes
0 answers
55 views

What optimization can be made for nanosecond IO and CPU stability when performing a timing attack?

I'm using Rust to create a program to attempt a timing attack on a network resource (a printer I lost a password to). I'm wired directly into it. What Linux environmental constraints can I optimize to ...
Evan Carroll's user avatar
  • 2,813
1 vote
0 answers
52 views

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server. I've read RFC4559, which describes how authentication should ...
Shuzheng's user avatar
  • 1,237
0 votes
0 answers
85 views

If I hibernate my Linux distro (which has an encrypted partition) and store it in a unencrypted swap partition, can an attacker access all my data?

Is it possible? How? Should I encrypt my swap partition? If I don't encrypt it, basically I make encryption in the main partition useless.
Allexj's user avatar
  • 137
6 votes
3 answers
4k views

Escalating user privileges on Linux

I've been battling with one school task for a couple of days and can't seem to find any idea how to solve it. The task is pretty simple: On the server there is a secret.txt file in the /root folder, ...
Paul's user avatar
  • 95
0 votes
1 answer
129 views

How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?

Here is my thought process: I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
user300431's user avatar
1 vote
0 answers
131 views

Why is there no prevention of malicious polkit authentication agents?

A polkit authentication agent provides the user interface for administrators to input their password. It runs in user space. (https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) An ...
Felix Ernst's user avatar
0 votes
1 answer
237 views

The safest and fastest way to upload files in Docker Container

In a docker project of Asp.net Core MVC 6.0, users must upload files to wwwroot of the project but nothing checks to see if the file is safe or not. I check file extensions with my file header library ...
mamad2559's user avatar
  • 103
2 votes
1 answer
629 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
barnyard9's user avatar
  • 143
0 votes
0 answers
57 views

Can guest access host clipboard despite sharing turned off?

Host: Win10 Guest: Linux Software: VirtualBox Clipboard information might not seem important, but it could very well contain a copied password or other useful data. On the host, clipboard history is ...
No Name's user avatar
  • 217
0 votes
0 answers
116 views

Risk of spyware with proprietary firmware packages on Linux, even after removing them?

When I installed Debian 12 LXQt ISO with the graphical install, it installed many proprietary firmware packages that were not needed and without my consent. Is it possible that proprietary firmware ...
baptx's user avatar
  • 103
1 vote
1 answer
88 views

Can Firejails protect against malicious links?

I would like to ask, if Firejails on Linux, protects when clicking a malicious link in the browser e.g. from downloading a keylogger or a trojan.
Dion's user avatar
  • 121
0 votes
0 answers
147 views

Downsides of increased ASLR entropy

ASLR allows to randomize the base address of userspace applications. In Linux, the length of the randomized part of the mmap address can be specified via the kernel build config. It is bound by the ...
user5626466's user avatar
0 votes
0 answers
89 views

Is hashdeep deprecated?

The other day corporate or the vendor used their cloud deployment tool to replace some of our DLLs, and it got me wondering; does anyone still use hashdeep when they initially roll out a server or ...
leeand00's user avatar
  • 1,441
0 votes
1 answer
166 views

Do I need to study how to find security flaws in order to harden my Linux server?

I'm wondering this. I am planning to resolve Vulnerability Assessment and Penetration Testing reports. Do I need to learn how to do such attacks in order to harden the server? Or don't I?
Team B.I's user avatar
0 votes
0 answers
190 views

Encoding shellcode to hide in filename / directory

Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
TKC's user avatar
  • 1
2 votes
1 answer
370 views

Risks from usage of CHROOT inside a Docker container

Can --cap-add SYS_CHROOT on a docker container be questioned as a potential security risk, and why? I'm seeking references and information from security professionals about using the chroot tool (and ...
Matteo T.'s user avatar
  • 121
0 votes
0 answers
74 views

Is specifying resume_offset for hybernation to LUKS-encrypted drive safe?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
CurtisB's user avatar
  • 33
1 vote
1 answer
126 views

Does allowing binfmt_misc significantly increase the attack surface for unprivileged users that already can launch - native - binaries?

The Linux kernel lets me register and execute additional binary formats as if they were regular executables. I am thinking of this mostly as a convenience method, completing what specifying the ...
anx's user avatar
  • 370
0 votes
0 answers
76 views

Trying to ret2text on 64bit program issues, can't jump to shell

Here is the elf summary of the program: Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) This is the ...
Nsion's user avatar
  • 1
0 votes
0 answers
143 views

Hooking system calls for a specific process on Linux

I want to make it so that syscalls from a particular process are controlled by another process (admin or same user, doesn't really matter to me.) I realize this gives some rootkit trojan vibes, but I'...
R-Rothrock's user avatar
0 votes
1 answer
977 views

Doing a diff between two keystore files

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one. One approach would be to extract the certificates using keytool ...
Jim's user avatar
  • 183
1 vote
1 answer
311 views

disabling root login and using rescue mode

We all know that disabling access to root over ssh is essential for security, that's not what I'm referring to here. I have seen a security best-practice recommendation to either completely disable ...
Kevin Keane's user avatar
  • 1,107
0 votes
0 answers
86 views

Apparmor profile for executing untrusted binaries for online judge

I am writing an online judge so I need to sandbox execution of untrusted binaries for judging and for that, I am using apparmor. Here's my current simple profile: #include <tunables/global> ...
Saad Ahmed's user avatar
0 votes
0 answers
194 views

Is UAC an overestimated protection measure in Windows? Does Linux do it better?

Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
Sir Muffington's user avatar
0 votes
1 answer
144 views

Linux found preloaded shared library: potential threat to security?

On a Linux Raspbian system, I have performed variuos security checks and among those I have performed a rkhunter scan to seek for rootkits, backdoors, and other malicious software with the following ...
Luca Spuntoni's user avatar
0 votes
1 answer
114 views

Security issues with cgroup device access in privileged container

I'm currently working on a project where I need to edit a runc configuration to stop allowing for wildcard cgroup device access inside the container, or essentially writing below to devices.allow. ...
Acohen's user avatar
  • 1
0 votes
0 answers
95 views

How to isolate a bash script process?

I have a bash script that opens various random files that could be anything (PDF, xlsx, MKV, MP4, WebM, html). Since I don't fully trust the source of these files, there is a chance that some of them ...
Arrow Root's user avatar
0 votes
0 answers
105 views

Check BadUSB or similar threats via software [duplicate]

I recently purchased a fake USB flash drive for its cool and beautiful case. I know that the seller modified the firmware so that it shows a different capacity to the operating system, but I am not ...
fflianjie fflianjie's user avatar
0 votes
1 answer
693 views

LUKS brute force risk?

If a person finds an old hard drive that was partially overwritten and let's say 1GB of that wasn't and was formerly used for part of a LUKS encrypted partition, what is the risk that such data, which ...
ppppppp2's user avatar

1
2 3 4 5
43