All Questions
68 questions
0
votes
1
answer
127
views
Passing password through terminal when using pass + gpg
I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I ...
- 45
-2
votes
1
answer
291
views
Why are passwords in the Linux terminal unmasked? [closed]
When entering a password into the password field in a Linux terminal- the password is just in the clear!
This is a commonly known fact.
But what if I'm in public, like in an office, and need to enter ...
- 3,025
1
vote
2
answers
308
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
- 13
2
votes
1
answer
448
views
Where to store the password: in RAM or another user's home folder (Linux)
There is user1 and user2. All work is done from under user1. user2 is only created to store important information.
If important information is stored in RAM, but in the session of user1, which is ...
- 35
0
votes
0
answers
646
views
Encrypt SVN for passwords
Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
- 1
20
votes
5
answers
8k
views
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
- 725
0
votes
0
answers
211
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
2
votes
0
answers
253
views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
- 99
0
votes
0
answers
502
views
Where to store passwords needed by linux processes?
I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system.
Where should I store the password for this encrypted file?
...
- 75
1
vote
2
answers
506
views
What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?
Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
- 13
0
votes
2
answers
1k
views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
- 331
4
votes
3
answers
2k
views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
2
votes
5
answers
500
views
Why can't we protect the password file so that only the system can read it?
Can't we design an OS in such a way that it doesn't allow anyone (not even root) to read the passwords file? Then there will be no need for encrypting the passwords. Why can't we hard-code a computer ...
- 129
3
votes
1
answer
376
views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
0
votes
3
answers
1k
views
What type of encryption/encoding is this? (Linux) [duplicate]
I've been struggling with encrypting this hash for a school homework.
(Backstory) I had to gain access from my Kali Linux machine to an "unknown" Linux machine and I've done it, but now I have to ...
- 5
0
votes
1
answer
872
views
Is it secure to set the encryption password the same as the root password? [duplicate]
When installing Manjaro Linux, it shows the following screen:
What's the logic behind that?
6
votes
2
answers
4k
views
Is there something insecure about storing secrets in plain text on the host FS?
There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
- 163
0
votes
2
answers
147
views
Does a user password protect against network attacks, or only physical?
If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?
1
vote
0
answers
45
views
Is Linux password login inherently insecure or is it just that people use weak passwords? [duplicate]
The normal advice you see everywhere when setting up a Linux server is to setup SSH and disable the password login. Is this because there is some security issue with password logins or because sooner ...
- 111
1
vote
2
answers
604
views
Linux and Windows Password Security Settings
I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
- 11
2
votes
1
answer
695
views
How strong do linux user account passwords have to be when using Full Disk Encryption (FDE) too?
Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.
assume: full disk ...
- 784
1
vote
2
answers
4k
views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
- 11
7
votes
2
answers
3k
views
When running shell scripts, is it safer to pass sensitive information using stdin or as a string option?
I'm building a number of automated scripts that will run within an encrypted environment (full disk encryption).
Many commands in both Windows and *nix have two ways of entering sensitive information ...
- 233
16
votes
1
answer
730
views
Password shown on screen after crash on Linux, any idea why?
So, my computer crashed during the night and when I came to work in the morning I had the following screen on.
I did not type the password a single time after the crash.
It appears to be related to ...
- 261
9
votes
2
answers
31k
views
How to reverse engineer password from /etc/shadow
I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution.
Question:
You have the ...
- 203
0
votes
2
answers
3k
views
Pros and cons of my method of storing passwords in plain text files instead of a password manager (on linux)
I thought of this way of managing passwords without using an external password manager.
The hard disk is fully encrypted (of course).
The passwords and all the data you need are stored in plain text ...
- 15.9k
1
vote
0
answers
200
views
Is there a way to make the login screen in ubuntu need ctrl-alt-del to put in your info? [closed]
In Windows, there is an option for a logon screen that looks like this:
Image
is there a way to do the same thing on Ubuntu?
- 11
4
votes
1
answer
313
views
Banking: Ubuntu virtual machine and virtual keyboard, or full Ubuntu install on USB drive?
I am mildly paranoid about protecting the security of my financial accounts. I often use Tails on a live USB for its light weight and amnesia. However, I also require the use of Chrome to visit some ...
- 41
2
votes
0
answers
225
views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
- 1,092
8
votes
1
answer
310
views
Do command substitution and piping prevent prying eyes from seeing hashed password being passed from process A to B?
This is loosely related to one of my recent answers. I've listed 4 methods of adding a new user via mkpasswd and useradd combination on Ubuntu 16.04.
Command substitution:
sudo -p ">" useradd -m -...
1
vote
0
answers
2k
views
Password as environment variable- is it a good idea? [duplicate]
Is it possible in Unix/Linux to access environment variable from another sessions. For instance
export MYPASSWORD = 'MySecretPassword"
would it be possible by another user on the same machine to ...
- 422
194
votes
6
answers
31k
views
Isn't Ubuntu's system prompt for my password spoofable?
Sometimes, Ubuntu shows the following window:
This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
- 4,824
6
votes
3
answers
1k
views
Why do some people think linux machine accounts with passwords are more secure than accounts without passwords?
It seems to be a recurring theme that some people are dead set to add passwords to password less system accounts on Linux "because its more secure". I currently have regular discussions with customers ...
- 243
1
vote
1
answer
18k
views
Free John the Ripper Dictionary Install [closed]
What can I download a real free dictionary to use with John the Ripper? And where do I install the dictionary?
- 13
1
vote
0
answers
200
views
Storing salted&hashed passwords - file encoding/encryption?
Setup: Say I'm properly generating a password hash (e.g., concatenating it with a /dev/urandom salt and a local secret and hashing it with bcrypt), now I go to store the result in a "user information" ...
- 111
3
votes
2
answers
1k
views
Input password to Bitcoin CLI
I'm new to bitcoin and I'm very concerned about keeping my wallet secure. As I prefer CLIs over GUIs for many reasons including security, I'm learning how to use the bitcoin-cli command on GNU/Linux. ...
- 153
2
votes
2
answers
12k
views
How to recover a lost zip file password (Extract Zip Spec '2.0')
I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123)
user@PC:/media/user/MyData$ zipdetails -v backup2.zip
0000000 0000004 50 4B 03 04 ...
- 41
0
votes
3
answers
2k
views
Crack Linux password if you have plaintext and hash?
I have a relatively old Linux system, where password are not shadowed, therefore stored in /etc/passwd/.
My question is, since I know the cleartext password, and its hash (looking at the passwd file),...
- 179
2
votes
1
answer
931
views
Is that a way break Linux user password by bypassing grub protected?
The best way to delve into others Linux machine is by editing the grub.
Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
- 2,251
2
votes
2
answers
740
views
Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future
Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is:
# Generate a password and set it to $PASSWORD
PASSWORD=$(tr -...
user31679
-4
votes
1
answer
207
views
Time-based password change [closed]
I have created this script and it runs great, but important questions remain.
Is this script useful and secure? Does it have any possible problem or weakness?
root@010010:/# ls -la /root/...
- 5
3
votes
3
answers
6k
views
Dump linux password in clear text
Is it possible to dump a Linux password in clear text format?
In Windows it is possible to do so using "Windows Credential Editor".
- 193
6
votes
1
answer
554
views
Desktop Flickers Past Lock Screen
I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
- 153
6
votes
2
answers
2k
views
How can I delete a password and lock the account in one step?
I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value.
I have added a separate administrator user. This user has an authorized key for SSH, no ...
- 223
15
votes
1
answer
2k
views
Linux /etc/shadow password change security
I wonder what happens what happens when I am changing my password on a Linux system. Basically all passwords are stored in a file called /etc/shadow or /etc/master.passwd in BSD-like systems as I do ...
- 273
1
vote
1
answer
933
views
Domain socket authentication as in MySQL and PostgreSQL secure?
Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure?
The background for my ...
- 113
36
votes
11
answers
12k
views
One liner to create passwords in linux?
How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy?
EDIT
By readable I mean the 94 printable ascii characters (without space). It can use ...
- 871
14
votes
2
answers
3k
views
Linux password changed. Is this an attack or a hardware glitch?
My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
- 263
0
votes
3
answers
2k
views
Are windows users passwords easier to crack than linux?
If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
- 135
2
votes
1
answer
173
views
Gnome-keyring iteration count location
I know that Gnome-keyring hashes the master password between 1000 and 2000 times. It picks a random number. I would like to ask where it saves this number, what is the location of that file? As far as ...
- 21