Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

Grep Commands with User Input

I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string. I could ...
1
vote
0answers
106 views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working up to a point. I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but the ...
1
vote
1answer
83 views

Feeding entropy pool with my own data [duplicate]

Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
0
votes
0answers
58 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
1
vote
1answer
77 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
1
vote
1answer
147 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
2
votes
1answer
60 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
1answer
157 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
0
votes
0answers
167 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
1
vote
0answers
73 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
2
votes
1answer
3k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
4
votes
1answer
132 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
1
vote
3answers
2k views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
1
vote
1answer
111 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
8
votes
1answer
1k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
8
votes
1answer
706 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
4
votes
1answer
1k views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
5
votes
5answers
276 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
2
votes
1answer
246 views

In-memory encrypted Linux/unix kernel

Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
1answer
56 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2
votes
1answer
552 views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
1
vote
1answer
269 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
94 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
5
votes
1answer
8k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
8
votes
1answer
2k views

Unix command to generate cryptographically secure random string

Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)? dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20 ...
2
votes
1answer
174 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
2
votes
2answers
896 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
1
vote
2answers
319 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
5
votes
3answers
280 views

Can a self-build router minimize the potential risk of intels management engine (ME)?

I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0
votes
1answer
254 views

Security of Linux/Unix user information

Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
1
vote
1answer
126 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
2
votes
2answers
138 views

Sniff plaintext password written in /tmp directory

I was recently reading about Ansible and the way it manages the sudo passwords. More specifically: When using become_user to a user other than root, the module arguments are briefly written into a ...
6
votes
2answers
618 views

`rsync -K`-based exploit

In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis): One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
5
votes
2answers
4k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
1answer
164 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
1answer
446 views

Gaining shell access on a Unix Webserver [closed]

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now. I have access to the web admin console but ...
0
votes
1answer
201 views

it is possible to make a copy of an iPhone?

Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer? Can I use the dd command to do this? Are any alternative ways to a clone an ...
0
votes
2answers
43 views

Can environment variables created for a unix account be viewable by another account?

If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
2
votes
2answers
176 views

Paste-once or paste-and-clear [closed]

I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
3
votes
3answers
119 views

Are environment variables entered *directly* before a command visible to other users?

UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
3
votes
1answer
150 views

Audio Streaming Server associated vulnerabilities

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff. The first thing made me think of ...
5
votes
1answer
5k views

Why is `cd` restricted in rbash/restricted bash?

The bash manual says: A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed: Changing directories with the cd builtin. Why is ...
0
votes
2answers
370 views

How secure is it to use secret directory names to share files on unix?

There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users. mkdir share chmod 711 share #others can traverse share, but can't list its ...
7
votes
2answers
394 views

Security of o=rwx with classical Unix permissions

Is it in anyway insecure to go o=rw or o=rwx on files and directories confined to directories that are marked o=? In other words, given private (g=,o=) home directory, is it perfectly safe to write ...
0
votes
1answer
150 views

Are path traversals attacks possible with invalid directories between?

Let's say I can control the variable $path and the full path is generated as follows: $full_path = "./valid_dir/docs/" . trim($path) ; readfile($full_path) ; where docs a non existent dir in the ...
1
vote
1answer
120 views

What is the rationale for calling setgroups on a list of length one?

The Secure Programming Cookbook for C and C++ says that: "Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
5
votes
1answer
1k views

Always setgroups before setuid?

On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid. The idea is that before dropping privileges, a process ...
3
votes
2answers
5k views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
28
votes
5answers
9k views

Why should one use sudo? [duplicate]

Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...