Questions tagged [unix]
Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.
146
questions
2
votes
2answers
129 views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
1
vote
1answer
165 views
Pass the Hash & Unix
Purpose: test if PtH (Pass the hash) is feasible against Unix box
Scenario:
Windows host (Windows Server 2008) vulnerable to eternalblue
got Administration hash as part of the post-exploitation ...
1
vote
3answers
94 views
Grep Commands with User Input
I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string.
I could ...
1
vote
0answers
244 views
GPG Agent SSH Forward Pinentry
I have GPG agent forwarding via SSH RemoteForward working up to a point.
I can list my private and public keys on the remote host.
If I try to decrypt a file remotely, the PIN is prompted for but the ...
1
vote
1answer
105 views
Feeding entropy pool with my own data [duplicate]
Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
0
votes
0answers
60 views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
2
votes
1answer
98 views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
1
vote
1answer
148 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
2
votes
1answer
61 views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
1answer
201 views
Unix/Linux shells which use effective UID instead of real UID
My question is build on top of the answer of the question about SUID exploitation:
SUID not used after exploit
The person (official answer) is stating that:
Many popular implementations of sh ...
0
votes
0answers
197 views
set-guid exploit of a program with relative path
I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c):
#include <stdio.h>
#include <stdlib.h>
#include <unistd....
1
vote
0answers
73 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
2
votes
1answer
3k views
Advice to help crack MD5crypt hash
I've been given a homework task to crack a particularly difficult password on a Unix system.
I have found users and hashes in the etc/shadow file and cracked all but this one:
$1$TyPfW4pp$...
4
votes
1answer
172 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
1
vote
3answers
3k views
Why is linux filesystem considered DAC and not MAC
Citing wikipedia's MAC article:
With mandatory access control, this security policy is centrally
controlled by a security policy administrator; users do not have the
ability to override the ...
1
vote
1answer
124 views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
8
votes
1answer
1k views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
8
votes
1answer
753 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
4
votes
1answer
1k views
Default value of ACLs mask
This is the question I faced in an interview as a system administrator.
If we didn't set the mask value, what is the default value of mask?
I was thinking that if we didn't set the mask, it ...
5
votes
5answers
286 views
Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
2
votes
1answer
261 views
In-memory encrypted Linux/unix kernel
Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
1answer
56 views
Block external http calls
I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2
votes
1answer
677 views
Way to properly escape user input which gets run by shell_exec() in PHP?
I have the following script:
$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");
Is there a way to properly escape the ...
1
vote
1answer
311 views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
113 views
Local server applications using a web frontend on multi-user desktop environments
Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.
But I'm a bit concerned about the increasing popularity of ...
6
votes
2answers
9k views
What is the easiest way to sandbox an application in a *NIX environment?
I have a significant number of untrusted binary applications that need to be executed on a *nix box.
I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
9
votes
1answer
2k views
Unix command to generate cryptographically secure random string
Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)?
dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20
...
2
votes
1answer
200 views
Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?
Scenario/question:
A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere
In such a ...
2
votes
2answers
978 views
Permissions for configuration file for program run as root that must be modifiable by SFTP
A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections.
myscript uses a regexp (...
1
vote
2answers
330 views
Unix - Automated MD5 Checksum Verification
I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.
So far we have implemented WAF's (Web Application Firewall), SSL ...
5
votes
3answers
323 views
Can a self-build router minimize the potential risk of intels management engine (ME)?
I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0
votes
1answer
254 views
Security of Linux/Unix user information
Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
1
vote
1answer
130 views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
2
votes
2answers
158 views
Sniff plaintext password written in /tmp directory
I was recently reading about Ansible and the way it manages the sudo passwords. More specifically:
When using become_user to a user other than root, the module arguments are briefly written into a ...
6
votes
2answers
642 views
`rsync -K`-based exploit
In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis):
One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
5
votes
2answers
4k views
Best practices for securing a public facing web server? [closed]
I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
1answer
173 views
Open SFTP on the main server - the safe way?
We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options:
Open SFTP on our main server with restrictions (directory, user, size,...
51
votes
7answers
11k views
Why does one need a strong password on Unix?
SSH Server: I only allow public key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
1answer
458 views
Gaining shell access on a Unix Webserver [closed]
I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.
I have access to the web admin console but ...
0
votes
1answer
204 views
it is possible to make a copy of an iPhone?
Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer?
Can I use the dd command to do this? Are any alternative ways to a clone an ...
0
votes
2answers
45 views
Can environment variables created for a unix account be viewable by another account?
If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
2
votes
2answers
188 views
Paste-once or paste-and-clear [closed]
I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
3
votes
3answers
126 views
Are environment variables entered *directly* before a command visible to other users?
UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
2
votes
1answer
153 views
Audio Streaming Server associated vulnerabilities
What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff.
The first thing made me think of ...
5
votes
1answer
5k views
Why is `cd` restricted in rbash/restricted bash?
The bash manual says:
A restricted shell behaves identically to bash with the exception that
the following are disallowed or not performed:
Changing directories with the cd builtin.
Why is ...
0
votes
2answers
407 views
How secure is it to use secret directory names to share files on unix?
There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users.
mkdir share
chmod 711 share #others can traverse share, but can't list its ...
7
votes
2answers
400 views
Security of o=rwx with classical Unix permissions
Is it in anyway insecure to go o=rw or o=rwx on files and directories
confined to directories that are marked o=?
In other words, given private (g=,o=) home directory, is it perfectly safe to write ...
0
votes
1answer
172 views
Are path traversals attacks possible with invalid directories between?
Let's say I can control the variable $path and the full path is generated as follows:
$full_path = "./valid_dir/docs/" . trim($path) ;
readfile($full_path) ;
where docs a non existent dir in the ...
1
vote
1answer
121 views
What is the rationale for calling setgroups on a list of length one?
The Secure Programming Cookbook for C and C++ says that:
"Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
5
votes
1answer
1k views
Always setgroups before setuid?
On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid.
The idea is that before dropping privileges, a process ...
