Questions tagged [unix]
Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.
141
questions
0
votes
0answers
51 views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
1
vote
1answer
56 views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
1
vote
1answer
145 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
2
votes
1answer
54 views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
1answer
108 views
Unix/Linux shells which use effective UID instead of real UID
My question is build on top of the answer of the question about SUID exploitation:
SUID not used after exploit
The person (official answer) is stating that:
Many popular implementations of sh ...
0
votes
0answers
90 views
set-guid exploit of a program with relative path
I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c):
#include <stdio.h>
#include <stdlib.h>
#include <unistd....
1
vote
0answers
72 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
1answer
2k views
Advice to help crack MD5crypt hash
I've been given a homework task to crack a particularly difficult password on a Unix system.
I have found users and hashes in the etc/shadow file and cracked all but this one:
$1$TyPfW4pp$...
4
votes
1answer
107 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
1
vote
2answers
1k views
Why is linux filesystem considered DAC and not MAC
Citing wikipedia's MAC article:
With mandatory access control, this security policy is centrally
controlled by a security policy administrator; users do not have the
ability to override the ...
1
vote
1answer
82 views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
6
votes
1answer
767 views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
7
votes
1answer
667 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
3
votes
1answer
742 views
Default value of ACLs mask
This is the question I faced in an interview as a system administrator.
If we didn't set the mask value, what is the default value of mask?
I was thinking that if we didn't set the mask, it ...
5
votes
5answers
249 views
Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
2
votes
1answer
222 views
In-memory encrypted Linux/unix kernel
Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
1answer
55 views
Block external http calls
I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2
votes
1answer
374 views
Way to properly escape user input which gets run by shell_exec() in PHP?
I have the following script:
$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");
Is there a way to properly escape the ...
1
vote
1answer
220 views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
81 views
Local server applications using a web frontend on multi-user desktop environments
Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.
But I'm a bit concerned about the increasing popularity of ...
3
votes
1answer
6k views
What is the easiest way to sandbox an application in a *NIX environment?
I have a significant number of untrusted binary applications that need to be executed on a *nix box.
I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
8
votes
1answer
1k views
Unix command to generate cryptographically secure random string
Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)?
dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20
...
2
votes
1answer
128 views
Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?
Scenario/question:
A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere
In such a ...
2
votes
2answers
800 views
Permissions for configuration file for program run as root that must be modifiable by SFTP
A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections.
myscript uses a regexp (...
1
vote
2answers
302 views
Unix - Automated MD5 Checksum Verification
I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.
So far we have implemented WAF's (Web Application Firewall), SSL ...
5
votes
3answers
253 views
Can a self-build router minimize the potential risk of intels management engine (ME)?
I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0
votes
1answer
251 views
Security of Linux/Unix user information
Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
1
vote
1answer
125 views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
2
votes
2answers
101 views
Sniff plaintext password written in /tmp directory
I was recently reading about Ansible and the way it manages the sudo passwords. More specifically:
When using become_user to a user other than root, the module arguments are briefly written into a ...
6
votes
2answers
591 views
`rsync -K`-based exploit
In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis):
One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
5
votes
2answers
4k views
Best practices for securing a public facing web server? [closed]
I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
1answer
149 views
Open SFTP on the main server - the safe way?
We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options:
Open SFTP on our main server with restrictions (directory, user, size,...
51
votes
7answers
11k views
Why does one need a strong password on Unix?
SSH Server: I only allow public key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
1answer
428 views
Gaining shell access on a Unix Webserver [closed]
I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.
I have access to the web admin console but ...
0
votes
1answer
192 views
it is possible to make a copy of an iPhone?
Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer?
Can I use the dd command to do this? Are any alternative ways to a clone an ...
0
votes
2answers
43 views
Can environment variables created for a unix account be viewable by another account?
If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
2
votes
2answers
157 views
Paste-once or paste-and-clear [closed]
I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
3
votes
3answers
112 views
Are environment variables entered *directly* before a command visible to other users?
UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
3
votes
1answer
146 views
Audio Streaming Server associated vulnerabilities
What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff.
The first thing made me think of ...
5
votes
1answer
4k views
Why is `cd` restricted in rbash/restricted bash?
The bash manual says:
A restricted shell behaves identically to bash with the exception that
the following are disallowed or not performed:
Changing directories with the cd builtin.
Why is ...
0
votes
2answers
323 views
How secure is it to use secret directory names to share files on unix?
There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users.
mkdir share
chmod 711 share #others can traverse share, but can't list its ...
7
votes
2answers
386 views
Security of o=rwx with classical Unix permissions
Is it in anyway insecure to go o=rw or o=rwx on files and directories
confined to directories that are marked o=?
In other words, given private (g=,o=) home directory, is it perfectly safe to write ...
0
votes
1answer
143 views
Are path traversals attacks possible with invalid directories between?
Let's say I can control the variable $path and the full path is generated as follows:
$full_path = "./valid_dir/docs/" . trim($path) ;
readfile($full_path) ;
where docs a non existent dir in the ...
1
vote
1answer
114 views
What is the rationale for calling setgroups on a list of length one?
The Secure Programming Cookbook for C and C++ says that:
"Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
5
votes
1answer
889 views
Always setgroups before setuid?
On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid.
The idea is that before dropping privileges, a process ...
3
votes
2answers
4k views
Default accounts shutdown, halt, and sync - still shipping?
I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document),
sync:x:5:0:sync:/sbin:/bin/...
28
votes
5answers
8k views
Why should one use sudo? [duplicate]
Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
3
votes
2answers
1k views
sharing private key sTunnel
All of the sTunnel guides and implementations at work do the same thing, they say once the private key and the public cert are created on the server, you need to cat them together and then share with ...
21
votes
5answers
5k views
Is it possible for a file that is non-executable and read-only to run malicious code?
On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine?
If so, can you explain how it would do so?
2
votes
1answer
980 views
Should I compile as root?
When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account?
./configure
...
