Hot answers tagged

65 votes
Accepted

Is having a hidden directory under /etc safe?

Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
Joseph Sible-Reinstate Monica's user avatar
63 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
Joseph Sible-Reinstate Monica's user avatar
43 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

In addition to the different permissions needed for a process' command line vs its pipes, consider: Command lines often show up in audit logs, shell history, or similar; data passed to stdin does not. ...
CBHacking's user avatar
  • 47.5k
21 votes

Is having a hidden directory under /etc safe?

It is safe in the sense that no, it will not make the system unstable, nor will it make it vulnerable from a security standpoint. That said, as MechMK1 points out, the only reason to use hidden ...
undo's user avatar
  • 2,125
19 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

The important part is not about an attacker compromising exactly your account. Any account on a typical Linux system can run ps and see what others are running. Even if your particular machine is ...
fraxinus's user avatar
  • 3,558
9 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

I think the title to your question and the body of your question are contradicting each other a bit and I think that may be leading to some of the confusion with the other correct answers. Your title ...
irwinr's user avatar
  • 91
8 votes
Accepted

SSL warnings while using Origin Certificate on my VPS

CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not ...
Matt Nordhoff's user avatar
7 votes

Is the Linux / Debian software and package-management ecosystem secure?

It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they ...
Polynomial's user avatar
  • 135k
7 votes

Debian 9 opted out of data collection, doing it anyway?

You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading. Upgrades do not upload anything. The only data that's sent from your ...
Gilles 'SO- stop being evil''s user avatar
7 votes
Accepted

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

If the load balancer terminates TLS (like in Layer 7 load balancing) then this will mitigate these bugs in your application since there will be (depending on the configuration) no TLS spoken between ...
Steffen Ullrich's user avatar
6 votes
Accepted

Hardening SSH security on a Debian 9 server

There are a number of things you can do: Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase. Configure AllowUsers in sshd so only named accounts can ...
Xiong Chiamiov's user avatar
5 votes

Unauthenticated packages in debian

You can check it at /var/log/apt/history.log . There you'll find info about what packages were installed by users in the system. I think there is no info about the repository from they were installed. ...
OscarAkaElvis's user avatar
5 votes
Accepted

Server get flooded by Avast Secure DNS

It's unlikely that this is coming from avast secure DNS. More likely, you're running an open DNS resolver and an attacker with a botnet is trying to DDoS Avast SecureDNS by using open resolvers to ...
David's user avatar
  • 16.1k
5 votes
Accepted

Sharing the UUIDs of my Linux partitions

I am assuming you are asking whether or not a partition UUID is sensitive information. A UUID is a random value assigned to the partition of a drive. It is used to reference the drive without needing ...
forest's user avatar
  • 66.6k
5 votes
Accepted

fail2ban - syntax for setting bantime in a unit other than seconds?

Version 0.10.0-alpha-1 (from 2016/07/14) introduced this feature. From the changelog: Enhancements: introduced string to seconds (str2seconds) for configuration entries with time, use 1h instead of ...
Esa Jokinen's user avatar
  • 18.9k
4 votes
Accepted

How to prevent the latest ImageMagick vulnerability?

As per the page you linked, there's a workaround. Add the following to your policy.xml: <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" ...
Polynomial's user avatar
  • 135k
4 votes

How to know if a host has been compromised and re-secure it again? (particular case of a raspberry)

It is impossible to prove that an attacker has not compromised your server. It is always possible that an attacker accessed and installed malware that would be left behind. The safest thing to do is ...
Eric Johnson's user avatar
4 votes
Accepted

How to sandbox Firefox ESR for normal browsing?

You have several ways to sandbox Firefox (or any similar application), depending on your exact requirements. From the lighter to the heavier solution, you mainly have: Firejail is a software ...
WhiteWinterWolf's user avatar
4 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

No. Nothing you do with a computer is 100% safe, and nothing in life is 100% safe. That's the wrong way to look at it. The question you should be asking is, which option offers more safety? When ...
jpaugh's user avatar
  • 161
3 votes
Accepted

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

The "Apache naming" is actually the syntax used by OpenSSL. According to https://testssl.sh/openssl-rfc.mappping.html the OpenSSL name for TLS_RSA_WITH_3DES_EDE_CBC_SHA is DES-CBC3-SHA.
Steffen Ullrich's user avatar
3 votes
Accepted

Is this version of openssl vulnerable?

Probably vulnerable. CVEDetails has a list of 49 vulnerabilities for that version. Take your pick. Also: Debian 3.1 has had no security updates for nine years.
StackzOfZtuff's user avatar
3 votes

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

The issue with SHA-1 is not an issue unless you are trying to generate two pieces of data who's SHA-1 collide. This is a lot different than generating one SHA-1 that collides with an existing SHA-1 ...
MikeSchem's user avatar
  • 2,361
3 votes

protect c ++ application via an automatic hardware binding

Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
Marcus Müller's user avatar
3 votes
Accepted

Hacked debian server alternative boot

From the post and ensuing dialogue: The machine is a Debian wheezy / 7.0 that aparently has not seen updates for around two years. There are logs lacking, that indicate the attackers cleaned up ...
Rui F Ribeiro's user avatar
3 votes

How to prevent the latest ImageMagick vulnerability?

Here is a reference for you: https://imagetragick.com According to that page, you should verify magic bytes for the file you are processing, and you should use a policy file to disable the vulnerable ...
Benjamin Ingmire's user avatar
3 votes
Accepted

Suspicious SSH connection

An "ESTABLISHED" connection seen in the output of a netstat command reffers only to the TCP connection. If the port was accepting connections from any remote IP, anybody could stablish a TCP session, ...
NuTTyX's user avatar
  • 703
3 votes
Accepted

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

What is the relation of Peer signing digest with Signature hash algorithm (Certificate)? Peer signing digest is the algorithm used by the peer when signing things during the TLS handshake - see ...
Steffen Ullrich's user avatar
3 votes
Accepted

Transfer requests for localhost zone on my bind DNS server

This is your guy: https://www.alphastrike.io/ In their own words: Alpha Strike Labs are a security consulting company specialized in industrial security and advanced security assessments. Based ...
Kate's user avatar
  • 7,927
3 votes
Accepted

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

There are two types of cryptographic validation here: Apt supports that each developer signs the package with its own key, and to validate that on package install. This is what this file refers to ...
Ángel's user avatar
  • 18.8k

Only top scored, non community-wiki answers of a minimum length are eligible