All Questions
68 questions
194
votes
6
answers
31k
views
Isn't Ubuntu's system prompt for my password spoofable?
Sometimes, Ubuntu shows the following window:
This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
- 4,824
58
votes
6
answers
27k
views
How secure is NOPASSWD in passwordless sudo mode?
On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
- 923
36
votes
11
answers
12k
views
One liner to create passwords in linux?
How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy?
EDIT
By readable I mean the 94 printable ascii characters (without space). It can use ...
- 871
29
votes
5
answers
11k
views
Is Linux really that secure, with only root password denying external access?
While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
- 421
20
votes
5
answers
8k
views
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
- 725
16
votes
1
answer
730
views
Password shown on screen after crash on Linux, any idea why?
So, my computer crashed during the night and when I came to work in the morning I had the following screen on.
I did not type the password a single time after the crash.
It appears to be related to ...
- 261
15
votes
1
answer
2k
views
Linux /etc/shadow password change security
I wonder what happens what happens when I am changing my password on a Linux system. Basically all passwords are stored in a file called /etc/shadow or /etc/master.passwd in BSD-like systems as I do ...
- 273
14
votes
2
answers
3k
views
Linux password changed. Is this an attack or a hardware glitch?
My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
- 263
14
votes
5
answers
9k
views
Security of the KWallet password encrypting application?
According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt.
The key ...
- 191
10
votes
4
answers
8k
views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
- 332
9
votes
2
answers
31k
views
How to reverse engineer password from /etc/shadow
I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution.
Question:
You have the ...
- 203
8
votes
3
answers
16k
views
What key does Linux use when storing user passwords?
Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow.
Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
- 191
8
votes
1
answer
311
views
Do command substitution and piping prevent prying eyes from seeing hashed password being passed from process A to B?
This is loosely related to one of my recent answers. I've listed 4 methods of adding a new user via mkpasswd and useradd combination on Ubuntu 16.04.
Command substitution:
sudo -p ">" useradd -m -...
7
votes
2
answers
3k
views
When running shell scripts, is it safer to pass sensitive information using stdin or as a string option?
I'm building a number of automated scripts that will run within an encrypted environment (full disk encryption).
Many commands in both Windows and *nix have two ways of entering sensitive information ...
- 233
6
votes
3
answers
1k
views
Why do some people think linux machine accounts with passwords are more secure than accounts without passwords?
It seems to be a recurring theme that some people are dead set to add passwords to password less system accounts on Linux "because its more secure". I currently have regular discussions with customers ...
- 243
6
votes
1
answer
554
views
Desktop Flickers Past Lock Screen
I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
- 153
6
votes
2
answers
2k
views
How can I delete a password and lock the account in one step?
I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value.
I have added a separate administrator user. This user has an authorized key for SSH, no ...
- 223
6
votes
2
answers
4k
views
Is there something insecure about storing secrets in plain text on the host FS?
There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
- 163
5
votes
2
answers
3k
views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
- 885
4
votes
2
answers
8k
views
Is user password in ubuntu 13.04 in plain text?
Is it stored in plain text or not?
Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?
user13779
4
votes
3
answers
2k
views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
4
votes
1
answer
1k
views
Why does Debian security guide recommend md5 hashed passwords?
I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords (http://www.debian.org/doc/manuals/securing-debian-howto/...
4
votes
1
answer
313
views
Banking: Ubuntu virtual machine and virtual keyboard, or full Ubuntu install on USB drive?
I am mildly paranoid about protecting the security of my financial accounts. I often use Tails on a live USB for its light weight and amnesia. However, I also require the use of Chrome to visit some ...
- 41
3
votes
1
answer
16k
views
Retrieving saved password from Firefox on Linux [closed]
I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
3
votes
3
answers
6k
views
Dump linux password in clear text
Is it possible to dump a Linux password in clear text format?
In Windows it is possible to do so using "Windows Credential Editor".
- 193
3
votes
1
answer
2k
views
Does the Ophcrack LiveCD require hash collection via programs like pwdump?
When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
- 133
3
votes
2
answers
1k
views
Input password to Bitcoin CLI
I'm new to bitcoin and I'm very concerned about keeping my wallet secure. As I prefer CLIs over GUIs for many reasons including security, I'm learning how to use the bitcoin-cli command on GNU/Linux. ...
- 153
3
votes
2
answers
984
views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
3
votes
1
answer
377
views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
2
votes
5
answers
500
views
Why can't we protect the password file so that only the system can read it?
Can't we design an OS in such a way that it doesn't allow anyone (not even root) to read the passwords file? Then there will be no need for encrypting the passwords. Why can't we hard-code a computer ...
- 129
2
votes
1
answer
156
views
Running an Open Server (contents are visible)
I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
- 131
2
votes
1
answer
448
views
Where to store the password: in RAM or another user's home folder (Linux)
There is user1 and user2. All work is done from under user1. user2 is only created to store important information.
If important information is stored in RAM, but in the session of user1, which is ...
- 35
2
votes
2
answers
989
views
Storing database password in application
Let's say my application connects to my database. This requires me to have the username and database in my config as follows:
postgresql://scott:tiger@localhost/mydatabase
I have an automated ...
- 121
2
votes
2
answers
12k
views
How to recover a lost zip file password (Extract Zip Spec '2.0')
I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123)
user@PC:/media/user/MyData$ zipdetails -v backup2.zip
0000000 0000004 50 4B 03 04 ...
- 41
2
votes
1
answer
931
views
Is that a way break Linux user password by bypassing grub protected?
The best way to delve into others Linux machine is by editing the grub.
Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
- 2,251
2
votes
1
answer
696
views
How strong do linux user account passwords have to be when using Full Disk Encryption (FDE) too?
Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.
assume: full disk ...
- 784
2
votes
2
answers
740
views
Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future
Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is:
# Generate a password and set it to $PASSWORD
PASSWORD=$(tr -...
user31679
2
votes
1
answer
173
views
Gnome-keyring iteration count location
I know that Gnome-keyring hashes the master password between 1000 and 2000 times. It picks a random number. I would like to ask where it saves this number, what is the location of that file? As far as ...
- 21
2
votes
0
answers
253
views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
- 99
2
votes
0
answers
225
views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
- 1,092
1
vote
3
answers
12k
views
Cracking passwords after a pattern with John
So I am trying to find out how easy it is to crack a password using some great Linux tools.
We all know about John as a password cracker and how great it is. But how about specifying a pattern.
Let'...
- 195
1
vote
2
answers
506
views
What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?
Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
- 13
1
vote
2
answers
40k
views
Hydra https-form-post [closed]
I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives.
This is what I have done so far:...
- 41
1
vote
1
answer
18k
views
Free John the Ripper Dictionary Install [closed]
What can I download a real free dictionary to use with John the Ripper? And where do I install the dictionary?
- 13
1
vote
1
answer
4k
views
What to do with .hash files when cracking WPA2
So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
- 123
1
vote
2
answers
604
views
Linux and Windows Password Security Settings
I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
- 11
1
vote
2
answers
4k
views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
- 11
1
vote
1
answer
933
views
Domain socket authentication as in MySQL and PostgreSQL secure?
Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure?
The background for my ...
- 113
1
vote
2
answers
308
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
- 13
1
vote
0
answers
45
views
Is Linux password login inherently insecure or is it just that people use weak passwords? [duplicate]
The normal advice you see everywhere when setting up a Linux server is to setup SSH and disable the password login. Is this because there is some security issue with password logins or because sooner ...
- 111