Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Filter by
Sorted by
Tagged with
29
votes
5answers
9k views

Why should one use sudo? [duplicate]

Most modern Linux articles advice using sudo rather than logging into root. This advice is so ingrained, some distros don't automatically allow root login. Indeed they come pre-configured with sudo ...
2
votes
4answers
8k views

Why are people saying that the X Window System is not secure?

Why are people saying that the X Window System is not secure? The OpenBSD team succeeded with privilege separation in 2003; why didn't the "Linux developers" do this? To be clear: What security ...
2
votes
1answer
99 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
7
votes
2answers
10k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
44
votes
2answers
11k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
2
votes
2answers
131 views

On a single user laptop does it make sense to have a separte password for root and the user?

I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is: The change of ...
3
votes
1answer
287 views

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
1
vote
3answers
114 views

Grep Commands with User Input

I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string. I could ...
1
vote
1answer
197 views

Pass the Hash & Unix

Purpose: test if PtH (Pass the hash) is feasible against Unix box Scenario: Windows host (Windows Server 2008) vulnerable to eternalblue got Administration hash as part of the post-exploitation ...
1
vote
1answer
112 views

Feeding entropy pool with my own data [duplicate]

Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
1
vote
0answers
289 views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working up to a point. I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but the ...
1
vote
3answers
3k views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
5
votes
4answers
2k views

Should I compile as root?

When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account? ./configure ...
3
votes
2answers
1k views

What is the entropy of a password made with pwgen?

pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
43
votes
3answers
5k views

Is passing sensitive data through the process environment secure?

Recently, I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
0
votes
0answers
61 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
0
votes
0answers
200 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
1
vote
1answer
148 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
2
votes
1answer
62 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
2
votes
1answer
219 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
3
votes
2answers
6k views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
21
votes
5answers
5k views

Is it possible for a file that is non-executable and read-only to run malicious code?

On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine? If so, can you explain how it would do so?
1
vote
0answers
73 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
2
votes
1answer
3k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
185
votes
7answers
14k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
4
votes
1answer
186 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
1
vote
1answer
134 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
8
votes
1answer
2k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
8
votes
1answer
771 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
0
votes
1answer
57 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
5
votes
5answers
287 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
4
votes
1answer
1k views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
2
votes
1answer
268 views

In-memory encrypted Linux/unix kernel

Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
6
votes
2answers
20k views

what does it mean to be setuid root?

I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is SETUID root in UNIX (or has Administrator power in Windows). The [...
5
votes
3answers
345 views

Can a self-build router minimize the potential risk of intels management engine (ME)?

I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
2
votes
1answer
718 views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
4
votes
4answers
8k views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 /usr/lib/postfix/...
1
vote
1answer
323 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
4
votes
1answer
120 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
9
votes
1answer
2k views

Unix command to generate cryptographically secure random string

Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)? dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20 ...
2
votes
1answer
206 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
1
vote
2answers
331 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
2
votes
2answers
1k views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
2
votes
3answers
32k views

Netcat IP Spoofing

I am connecting to a server nc -v 192.168.0.1 1111 But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my ...
4
votes
3answers
3k views

Is `arc4random` secure enough?

I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
0
votes
1answer
254 views

Security of Linux/Unix user information

Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
14
votes
4answers
42k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
1
vote
1answer
130 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
2
votes
2answers
165 views

Sniff plaintext password written in /tmp directory

I was recently reading about Ansible and the way it manages the sudo passwords. More specifically: When using become_user to a user other than root, the module arguments are briefly written into a ...
3
votes
3answers
9k views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...