Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
2,079
questions
1
vote
1
answer
3k
views
Using Hardware Encryption on NVME SSD used as the boot device
I have a question relating to implementing encryption of data at rest. This is possibly more suited to another stackexchange site, so please let me know where would be better to post if I'm a little ...
- 113
3
votes
3
answers
956
views
Identifying a BadUSB using Linux
Using Linux, is there anyway to detect that an arbitrary USB device is a BadUSB or not?
For example:
Booting a Linux into multi-user.target.
No graphical interface / tty (getty login).
Plug the USB ...
- 41
0
votes
2
answers
526
views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
- 331
0
votes
1
answer
752
views
Adding a self-signed client certificate to HAProxy for mutual-tls?
I added the client cert into ca.pem as in
bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem
http-request set-header X-SSL-Client-Verify %...
- 135
1
vote
1
answer
653
views
SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf
Background
Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes.
I ...
- 345
1
vote
0
answers
348
views
How to encrypt and hide a GNU/Linux operating system and create a decoy system?
My goal is to be protected against key disclosure laws and possible extortion. I know dm-crypt can be used to perform full disk encryption for GNU/Linux distros. However, it is not enough. I want to ...
1
vote
2
answers
176
views
Is it insecure for the user to know the process id of a background script on my web server?
I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
- 113
0
votes
3
answers
560
views
How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)
UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
- 331
20
votes
3
answers
9k
views
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
- 331
0
votes
1
answer
113
views
When changing a PGP passphrase, does it only affect the same key on the other machine?
If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B?
Will I still be able to use the PGP key on Computer B ...
- 113
1
vote
1
answer
422
views
How should GNU/Linux noobs harden their dekstop OS?
I'm interested in using GNU/Linux for different reasons. Partly for freedom, privacy, and security. But also to force myself to learn Linux. One issue I’ve found is that desktop Linux seems to have ...
- 41
0
votes
2
answers
221
views
Haven't updated my Windows 10 for more than a year
Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS.
I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down.
Now, ...
0
votes
1
answer
109
views
Is there an effective way to disable root access on linux in an office setting
I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.
Is ...
- 101
2
votes
0
answers
191
views
Why does the CIS benchmark consider the presence of passwd- a (high) risk [closed]
I've just seen a "high-risk security alert" for the presence of /etc/passwd- (note the trailing '-') on RHEL 8 servers, and don't understand the issue. Apparently the issue originates with ...
- 139
2
votes
0
answers
406
views
How to harden portable Tor Browser installation (SELinux, sandbox)?
tldr
How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US?
How might Tor Browser be ...
- 21
1
vote
1
answer
182
views
Which remote desktop protocol offers the smallest attack surface? [closed]
I am trying to "outsource" potentially dangerous applications such as web browsing to a separate Linux machine sitting in its own network segment and which is isolated by a rigorous network ...
- 111
1
vote
2
answers
484
views
How to secure containerized python source code deployed at client side cloud
How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
- 23
0
votes
1
answer
137
views
How to detect fileless kernel compromise in linux
Is there a way to detect fileless kernel compromise in Linux?
The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
- 105
5
votes
0
answers
529
views
How did ntpd get patched to prevent NTP time synchronization attacks?
I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015.
Basically, the attack was mostly used to send the victim's clock in the future, so the ...
- 751
0
votes
1
answer
128
views
Changing Linux system files by malware from another OS. Is it possible?
Is it possible to infect important Linux system files with a malware from another operating system? For example, you are using Windows, you have a disk with the Debian operating system connected. You &...
- 3
1
vote
2
answers
133
views
Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?
Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
0
votes
2
answers
242
views
Syscalls are disabled with seccomp. What attacks are still possible? How to prevent them?
I want to run a piece of untrusted code on my machine.
I've disabled all syscalls (besides exit, sigreturn, read and write) with seccomp for a process. Now, I'd like to spawn a child process that will ...
- 357
2
votes
1
answer
371
views
How to verify a x509 certificate from Apple on a Ubuntu server?
I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this.
Steps 3 and 4 of that API say:
Use the publicKeyURL ...
- 121
0
votes
0
answers
33
views
How to recover a hacked site with WSO Shell [duplicate]
Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded.
Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed.
...
- 1
1
vote
0
answers
320
views
Spawning child processes from root using runuser command
I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank).
The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
- 113
3
votes
1
answer
808
views
ssh -Q key not listing all key types?
I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config):
...
- 557
0
votes
2
answers
775
views
Is there a way to change your current UID to equal your EUID?
Here is the scenario:
running id gives this :
uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) -
This means that I am user test1, but my euid is set to another user.
My goal is ...
- 3
1
vote
0
answers
99
views
How to interpret received packets, although not being destination host
Set up:
Victim: 192.168.0.2
Attacker (also having SSH server installed): 192.168.0.3
SSH server: 192.168.0.4
I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address):
...
1
vote
2
answers
1k
views
Parrot OS live vs Tails [closed]
Is Parrot OS as secure as Tails?
Tails is running from USB, loading to RAM so it means that it doesn't use local computer storage. After each start, Tails starts a new session and doesn't store files ...
- 119
4
votes
2
answers
220
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 2,032
1
vote
2
answers
3k
views
Sudo "/usr/sbin/halt", "/usr/sbin/reboot", "/usr/sbin/poweroff" - how to leverage it to privilege escalation?
A normal user can execute these commands as root without providing any password (sudo includes the full path of the command so path hijack isn't the case here), could "halt", "reboot&...
- 21
1
vote
1
answer
118
views
How to make access to a remote program without that the user has the possibility to run any Linux command?
I have an interactive program. Actually, the program can be reachable over SSH. In the .profile file, the program is launched immediately and with the interactive interface it is not possible to ...
- 259
1
vote
2
answers
627
views
Path traversal in POST request?
Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?
For example
POST
[...]
----boundary
Content-...
- 557
2
votes
1
answer
211
views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
- 21
0
votes
2
answers
773
views
What is the practical approach for CIS Benchmark (Ensure permissions on all logfiles are configured)?
I am trying to harden RHEL with CIS benchmark. One of the items states the following:
Ensure permissions on all logfiles are configured
Description: Log files stored in /var/log/ contain logged ...
- 36
0
votes
1
answer
206
views
Change ettercap default port
Guys does anyone know how I can change the port that ettercap runs? I need it to run on port 8080.
When I try to run sudo ettercap -G it presents me with this error:
ERROR : 13, Permission denied
[/...
- 111
3
votes
1
answer
239
views
Why does file traversal not working in this PHP file upload code?
I am using this script to upload file to the system with apache2 as server and php7.
If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
- 33
1
vote
0
answers
143
views
AuditD and SysCall alerts
Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?
When an application gets executed do all the ...
- 3,086
1
vote
1
answer
274
views
What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?
I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
- 235
1
vote
0
answers
256
views
Cmd line tool to scan an eml file against spam/phishing rules [closed]
For a purpose of a security class I want to demonstrate a threat delivered via email. As a demo message I want to use an eml file that contains a banking-themed pdf attachment, requiring further ...
- 11
1
vote
0
answers
151
views
How to install Java 8 on Kali Nethunter [closed]
Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...
- 111
2
votes
1
answer
578
views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
- 153
1
vote
1
answer
146
views
CGI-BIN - suspicious activity (unknown IP made request)
I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data.
This scraping script is placed in cgi-bin folder so ...
- 113
1
vote
1
answer
1k
views
How to use msfvenom elf approach for metasploitable 2?
How to use msfvenom elf approach for metasploitable 2?
I am reading a book that teaches how to make a msfvenom executable for Windows. But I am learning on metasploitable 2. I really did not want to ...
0
votes
3
answers
2k
views
Is there a way to close 22 SSH port from public, ubuntu?
I am using putty and private key to access my development server. I used Nmap to see which ports are visible to the public, and in fact the 22 is open.
Is it possible to hide open port from the public?...
- 101
0
votes
0
answers
58
views
Is it possible to verify that a USB adapter is not malicious? [duplicate]
I have some generic USB C-to-A and A-to-C adapters that were bought cheaply.
I thought that if any of them had any advanced capabilities (other than being "dumb" adapters) such as mimicking ...
- 53
3
votes
1
answer
7k
views
How to do string buffer overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
- 167
0
votes
1
answer
99
views
Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]
This question is intended for better understanding of security features of Android architecture.
In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
- 103
0
votes
1
answer
162
views
How to distribute bash scripts to multiple IOT devices securely
Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source.
Our customers however will have to buy separate IOT devices ...
- 687
1
vote
0
answers
95
views
Linuxcontainers » LXC : Security Vulnerabilities
I have a question regarding Linuxcontainers. How do you classify the security vulnerability mentioned here, more specifically the ones that ends with 6441,1331,1134,1335 and 10124.
I mean are they a ...
- 11