Questions tagged [unix]
Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.
151
questions
1
vote
1
answer
93
views
Is TLS needed on loopback for local security?
So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments.
The server is running a service on loopback ...
- 13
0
votes
3
answers
214
views
Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?
OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com :
https://www.cvedetails.com/product/163/Openbsd-...
- 303
1
vote
1
answer
323
views
Private IPC between two processes
I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
- 13
1
vote
1
answer
448
views
Reverse PHP shell exit when netcat listening
My reverse shell is exiting when i lsten it with netcat: here is netcat output:
listening on [any] 5555 ...
connect to [10.9.3.117] from (UNKNOWN) [10.10.47.117] 37602
bash: cannot set terminal ...
- 11
0
votes
1
answer
166
views
Using ATA Secure Erase after buying a second-hand laptop : is this enough?
I bought a second-hand laptop from a stranger. My (totally unjustified) concern is that there might be malware on the device.
According to this answer, there is no easy fix if it's malicious firmware. ...
- 3
2
votes
2
answers
210
views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
1
vote
1
answer
388
views
Pass the Hash & Unix
Purpose: test if PtH (Pass the hash) is feasible against Unix box
Scenario:
Windows host (Windows Server 2008) vulnerable to eternalblue
got Administration hash as part of the post-exploitation ...
- 39
1
vote
3
answers
483
views
Grep Commands with User Input
I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string.
I could ...
- 299
3
votes
0
answers
707
views
GPG Agent SSH Forward Pinentry
I have GPG agent forwarding via SSH RemoteForward working up to a point.
I can list my private and public keys on the remote host.
If I try to decrypt a file remotely, the PIN is prompted for but the ...
- 43
1
vote
1
answer
268
views
Feeding entropy pool with my own data [duplicate]
Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
- 111
0
votes
0
answers
102
views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
- 1
2
votes
1
answer
254
views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
- 421
1
vote
1
answer
197
views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
- 113
2
votes
1
answer
96
views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
- 1,660
2
votes
1
answer
378
views
Unix/Linux shells which use effective UID instead of real UID
My question is build on top of the answer of the question about SUID exploitation:
SUID not used after exploit
The person (official answer) is stating that:
Many popular implementations of sh ...
- 562
0
votes
0
answers
366
views
set-guid exploit of a program with relative path
I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c):
#include <stdio.h>
#include <stdlib.h>
#include <unistd....
1
vote
0
answers
116
views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
- 1,043
2
votes
1
answer
5k
views
Advice to help crack MD5crypt hash
I've been given a homework task to crack a particularly difficult password on a Unix system.
I have found users and hashes in the etc/shadow file and cracked all but this one:
$1$TyPfW4pp$...
- 31
5
votes
1
answer
383
views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
- 188
1
vote
3
answers
4k
views
Why is linux filesystem considered DAC and not MAC
Citing wikipedia's MAC article:
With mandatory access control, this security policy is centrally
controlled by a security policy administrator; users do not have the
ability to override the ...
- 141
1
vote
1
answer
244
views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
user192382
9
votes
1
answer
2k
views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
- 247
9
votes
1
answer
921
views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
- 5,607
4
votes
1
answer
2k
views
Default value of ACLs mask
This is the question I faced in an interview as a system administrator.
If we didn't set the mask value, what is the default value of mask?
I was thinking that if we didn't set the mask, it ...
- 143
5
votes
5
answers
387
views
Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
- 51
2
votes
1
answer
373
views
In-memory encrypted Linux/unix kernel
Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
- 121
0
votes
1
answer
102
views
Block external http calls
I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
- 121
2
votes
1
answer
1k
views
Way to properly escape user input which gets run by shell_exec() in PHP?
I have the following script:
$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");
Is there a way to properly escape the ...
- 197
1
vote
1
answer
469
views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
- 25
4
votes
1
answer
227
views
Local server applications using a web frontend on multi-user desktop environments
Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.
But I'm a bit concerned about the increasing popularity of ...
- 41
7
votes
2
answers
13k
views
What is the easiest way to sandbox an application in a *NIX environment?
I have a significant number of untrusted binary applications that need to be executed on a *nix box.
I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
- 514
11
votes
1
answer
4k
views
Unix command to generate cryptographically secure random string
Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)?
dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20
...
- 1,117
2
votes
1
answer
392
views
Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?
Scenario/question:
A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere
In such a ...
- 1,664
2
votes
2
answers
1k
views
Permissions for configuration file for program run as root that must be modifiable by SFTP
A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections.
myscript uses a regexp (...
- 1,961
1
vote
2
answers
394
views
Unix - Automated MD5 Checksum Verification
I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.
So far we have implemented WAF's (Web Application Firewall), SSL ...
- 111
5
votes
3
answers
511
views
Can a self-build router minimize the potential risk of intels management engine (ME)?
I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
- 51
0
votes
1
answer
297
views
Security of Linux/Unix user information
Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
- 109
1
vote
1
answer
178
views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
- 287
2
votes
2
answers
300
views
Sniff plaintext password written in /tmp directory
I was recently reading about Ansible and the way it manages the sudo passwords. More specifically:
When using become_user to a user other than root, the module arguments are briefly written into a ...
- 143
6
votes
2
answers
769
views
`rsync -K`-based exploit
In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis):
One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
- 1,043
5
votes
2
answers
5k
views
Best practices for securing a public facing web server? [closed]
I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
- 153
1
vote
1
answer
282
views
Open SFTP on the main server - the safe way?
We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options:
Open SFTP on our main server with restrictions (directory, user, size,...
- 125
52
votes
6
answers
11k
views
Why does one need a strong password on Unix?
SSH Server: I only allow public-key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
- 819
1
vote
1
answer
555
views
Gaining shell access on a Unix Webserver [closed]
I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.
I have access to the web admin console but ...
- 143
0
votes
1
answer
262
views
it is possible to make a copy of an iPhone?
Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer?
Can I use the dd command to do this? Are any alternative ways to a clone an ...
- 23
0
votes
2
answers
93
views
Can environment variables created for a unix account be viewable by another account?
If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
- 133
2
votes
2
answers
294
views
Paste-once or paste-and-clear [closed]
I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
- 121
3
votes
3
answers
190
views
Are environment variables entered *directly* before a command visible to other users?
UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
- 3,379
2
votes
1
answer
195
views
Audio Streaming Server associated vulnerabilities
What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff.
The first thing made me think of ...
- 246
5
votes
1
answer
7k
views
Why is `cd` restricted in rbash/restricted bash?
The bash manual says:
A restricted shell behaves identically to bash with the exception that
the following are disallowed or not performed:
Changing directories with the cd builtin.
Why is ...
- 153