Questions tagged [unix]
Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.
0
votes
0answers
28 views
set-guid exploit of a programm with relativ path
I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c):
#include <stdio.h>
#include <stdlib.h>
#include <unistd....
1
vote
0answers
64 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
0
votes
1answer
146 views
Advice to help crack MD5crypt hash
I've been given a homework task to crack a particularly difficult password on a Unix system.
I have found users and hashes in the etc/shadow file and cracked all but this one:
$1$TyPfW4pp$...
3
votes
1answer
88 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
0
votes
2answers
301 views
Why is linux filesystem considered DAC and not MAC
Citing wikipedia's MAC article:
With mandatory access control, this security policy is centrally
controlled by a security policy administrator; users do not have the
ability to override the ...
1
vote
1answer
58 views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
5
votes
1answer
279 views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
7
votes
1answer
576 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
3
votes
1answer
220 views
Default value of ACLs mask
This is the question I faced in an interview as a system administrator.
If we didn't set the mask value, what is the default value of mask?
I was thinking that if we didn't set the mask, it ...
5
votes
5answers
191 views
Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
2
votes
1answer
96 views
In-memory encrypted Linux/unix kernel
Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
1answer
51 views
Block external http calls
I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2
votes
1answer
213 views
Way to properly escape user input which gets run by shell_exec() in PHP?
I have the following script:
$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");
Is there a way to properly escape the ...
1
vote
1answer
152 views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
52 views
Local server applications using a web frontend on multi-user desktop environments
Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.
But I'm a bit concerned about the increasing popularity of ...
2
votes
1answer
852 views
What is the easiest way to sandbox an application in a *NIX environment?
I have a significant number of untrusted binary applications that need to be executed on a *nix box.
I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
8
votes
1answer
603 views
Unix command to generate cryptographically secure random string
Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)?
dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20
...
1
vote
1answer
57 views
Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?
Scenario/question:
A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere
In such a ...
2
votes
2answers
518 views
Permissions for configuration file for program run as root that must be modifiable by SFTP
A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections.
myscript uses a regexp (...
1
vote
2answers
220 views
Unix - Automated MD5 Checksum Verification
I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.
So far we have implemented WAF's (Web Application Firewall), SSL ...
5
votes
3answers
233 views
Can a self-build router minimize the potential risk of intels management engine (ME)?
I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0
votes
1answer
242 views
Security of Linux/Unix user information
Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
1
vote
1answer
120 views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
3
votes
2answers
61 views
Sniff plaintext password written in /tmp directory
I was recently reading about Ansible and the way it manages the sudo passwords. More specifically:
When using become_user to a user other than root, the module arguments are briefly written into a ...
6
votes
2answers
472 views
`rsync -K`-based exploit
In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis):
One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
5
votes
2answers
3k views
Best practices for securing a public facing web server? [closed]
I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
1answer
143 views
Open SFTP on the main server - the safe way?
We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options:
Open SFTP on our main server with restrictions (directory, user, size,...
52
votes
7answers
11k views
Why does one need a strong password on Unix?
SSH Server: I only allow public key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
0
votes
1answer
369 views
Gaining shell access on a Unix Webserver [closed]
I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.
I have access to the web admin console but ...
0
votes
1answer
165 views
it is possible to make a copy of an iPhone?
Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer?
Can I use the dd command to do this? Are any alternative ways to a clone an ...
0
votes
2answers
38 views
Can environment variables created for a unix account be viewable by another account?
If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
2
votes
2answers
117 views
Paste-once or paste-and-clear [closed]
I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
3
votes
3answers
109 views
Are environment variables entered *directly* before a command visible to other users?
UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
3
votes
1answer
126 views
Audio Streaming Server associated vulnerabilities
What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff.
The first thing made me think of ...
5
votes
1answer
3k views
Why is `cd` restricted in rbash/restricted bash?
The bash manual says:
A restricted shell behaves identically to bash with the exception that
the following are disallowed or not performed:
Changing directories with the cd builtin.
Why is ...
0
votes
2answers
246 views
How secure is it to use secret directory names to share files on unix?
There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users.
mkdir share
chmod 711 share #others can traverse share, but can't list its ...
7
votes
2answers
370 views
Security of o=rwx with classical Unix permissions
Is it in anyway insecure to go o=rw or o=rwx on files and directories
confined to directories that are marked o=?
In other words, given private (g=,o=) home directory, is it perfectly safe to write ...
0
votes
1answer
120 views
Are path traversals attacks possible with invalid directories between?
Let's say I can control the variable $path and the full path is generated as follows:
$full_path = "./valid_dir/docs/" . trim($path) ;
readfile($full_path) ;
where docs a non existent dir in the ...
1
vote
1answer
96 views
What is the rationale for calling setgroups on a list of length one?
The Secure Programming Cookbook for C and C++ says that:
"Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
5
votes
1answer
668 views
Always setgroups before setuid?
On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid.
The idea is that before dropping privileges, a process ...
1
vote
1answer
3k views
Default accounts shutdown, halt, and sync - still shipping?
I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document),
sync:x:5:0:sync:/sbin:/bin/...
27
votes
5answers
7k views
Why should one use sudo? [duplicate]
Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
3
votes
2answers
916 views
sharing private key sTunnel
All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
21
votes
5answers
4k views
Is it possible for a file that is non-executable and read-only to run malicious code?
On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine?
If so, can you explain how it would do so?
2
votes
1answer
707 views
Should I compile as root?
When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account?
./configure
...
3
votes
1answer
484 views
How to recover/log attempted passwords from a failed login [closed]
I saw the following question before:
Is it legal to log passwords from failed logins?
I think it raises another question:
How do I log failed attempted passwords?
That seems very useful when I need ...
0
votes
1answer
560 views
Pentesting - is there a way to check file permissions on linux remotely - KALI
I'm trying to modify a PHP file through a plugin on wordpress. Everything goes well, but I had to modify the permissions to 666 manually via terminal on the victim's machine, cause even when I'm ...
3
votes
2answers
862 views
What is the entropy of a password made with pwgen?
pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
4
votes
2answers
147 views
Is it safe to expose a logging socket endpoint in a chrooted environment?
I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head.
Using ...
3
votes
2answers
578 views
How to track down and remove Mac malware that is calling out? [duplicate]
Little Snitch periodically brings up a dialog that says:
Terminal via node wants to accept an incoming connection from X on port 3000 (remoteware-cl).
X are different IPs in eastern europe. A full ...
