Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
1
vote
1answer
69 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
1
vote
1answer
145 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
2
votes
1answer
60 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
1answer
127 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
0
votes
0answers
107 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
1
vote
0answers
72 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
2
votes
1answer
3k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
4
votes
1answer
124 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
1
vote
2answers
2k views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
1
vote
1answer
95 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
6
votes
1answer
1k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
8
votes
1answer
699 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
4
votes
1answer
985 views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
5
votes
5answers
267 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
2
votes
1answer
236 views

In-memory encrypted Linux/unix kernel

Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
1answer
56 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2
votes
1answer
475 views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
1
vote
1answer
256 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
87 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
3
votes
1answer
7k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
8
votes
1answer
1k views

Unix command to generate cryptographically secure random string

Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)? dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20 ...
2
votes
1answer
159 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
2
votes
2answers
872 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
1
vote
2answers
314 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
5
votes
3answers
266 views

Can a self-build router minimize the potential risk of intels management engine (ME)?

I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0
votes
1answer
252 views

Security of Linux/Unix user information

Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
1
vote
1answer
126 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
2
votes
2answers
122 views

Sniff plaintext password written in /tmp directory

I was recently reading about Ansible and the way it manages the sudo passwords. More specifically: When using become_user to a user other than root, the module arguments are briefly written into a ...
6
votes
2answers
603 views

`rsync -K`-based exploit

In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis): One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
5
votes
2answers
4k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
1answer
157 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
1answer
440 views

Gaining shell access on a Unix Webserver [closed]

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now. I have access to the web admin console but ...
0
votes
1answer
199 views

it is possible to make a copy of an iPhone?

Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer? Can I use the dd command to do this? Are any alternative ways to a clone an ...
0
votes
2answers
43 views

Can environment variables created for a unix account be viewable by another account?

If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
2
votes
2answers
169 views

Paste-once or paste-and-clear [closed]

I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
3
votes
3answers
116 views

Are environment variables entered *directly* before a command visible to other users?

UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
3
votes
1answer
147 views

Audio Streaming Server associated vulnerabilities

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff. The first thing made me think of ...
5
votes
1answer
4k views

Why is `cd` restricted in rbash/restricted bash?

The bash manual says: A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed: Changing directories with the cd builtin. Why is ...
0
votes
2answers
356 views

How secure is it to use secret directory names to share files on unix?

There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users. mkdir share chmod 711 share #others can traverse share, but can't list its ...
7
votes
2answers
388 views

Security of o=rwx with classical Unix permissions

Is it in anyway insecure to go o=rw or o=rwx on files and directories confined to directories that are marked o=? In other words, given private (g=,o=) home directory, is it perfectly safe to write ...
0
votes
1answer
149 views

Are path traversals attacks possible with invalid directories between?

Let's say I can control the variable $path and the full path is generated as follows: $full_path = "./valid_dir/docs/" . trim($path) ; readfile($full_path) ; where docs a non existent dir in the ...
1
vote
1answer
119 views

What is the rationale for calling setgroups on a list of length one?

The Secure Programming Cookbook for C and C++ says that: "Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
5
votes
1answer
955 views

Always setgroups before setuid?

On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid. The idea is that before dropping privileges, a process ...
3
votes
2answers
4k views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
28
votes
5answers
9k views

Why should one use sudo? [duplicate]

Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
3
votes
2answers
1k views

sharing private key sTunnel

All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
21
votes
5answers
5k views

Is it possible for a file that is non-executable and read-only to run malicious code?

On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine? If so, can you explain how it would do so?
3
votes
2answers
1k views

Should I compile as root?

When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account? ./configure ...