65
votes
Accepted
Is having a hidden directory under /etc safe?
Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
63
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
43
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
In addition to the different permissions needed for a process' command line vs its pipes, consider:
Command lines often show up in audit logs, shell history, or similar; data passed to stdin does not.
...
- 50.3k
21
votes
Is having a hidden directory under /etc safe?
It is safe in the sense that no, it will not make the system unstable, nor will it make it vulnerable from a security standpoint.
That said, as MechMK1 points out, the only reason to use hidden ...
- 2,135
19
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
The important part is not about an attacker compromising exactly your account.
Any account on a typical Linux system can run ps and see what others are running.
Even if your particular machine is ...
- 3,568
10
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
I think the title to your question and the body of your question are contradicting each other a bit and I think that may be leading to some of the confusion with the other correct answers.
Your title ...
- 101
7
votes
Debian 9 opted out of data collection, doing it anyway?
You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading.
Upgrades do not upload anything. The only data that's sent from your ...
7
votes
Accepted
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
If the load balancer terminates TLS (like in Layer 7 load balancing) then this will mitigate these bugs in your application since there will be (depending on the configuration) no TLS spoken between ...
- 206k
6
votes
Accepted
Hardening SSH security on a Debian 9 server
There are a number of things you can do:
Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
Configure AllowUsers in sshd so only named accounts can ...
- 9,452
5
votes
Accepted
Sharing the UUIDs of my Linux partitions
I am assuming you are asking whether or not a partition UUID is sensitive information.
A UUID is a random value assigned to the partition of a drive. It is used to reference the drive without needing ...
- 67.1k
5
votes
Accepted
Server get flooded by Avast Secure DNS
It's unlikely that this is coming from avast secure DNS. More likely, you're running an open DNS resolver and an attacker with a botnet is trying to DDoS Avast SecureDNS by using open resolvers to ...
- 16.1k
5
votes
Unauthenticated packages in debian
You can check it at /var/log/apt/history.log . There you'll find info about what packages were installed by users in the system. I think there is no info about the repository from they were installed. ...
- 5,335
5
votes
Accepted
fail2ban - syntax for setting bantime in a unit other than seconds?
Version 0.10.0-alpha-1 (from 2016/07/14) introduced this feature. From the changelog:
Enhancements:
introduced string to seconds (str2seconds) for configuration entries with time, use 1h instead of ...
- 19.2k
4
votes
Accepted
How to sandbox Firefox ESR for normal browsing?
You have several ways to sandbox Firefox (or any similar application), depending on your exact requirements.
From the lighter to the heavier solution, you mainly have:
Firejail is a software ...
- 19.3k
4
votes
Accepted
Transfer requests for localhost zone on my bind DNS server
This is your guy: https://www.alphastrike.io/
In their own words:
Alpha Strike Labs are a security consulting company specialized in
industrial security and advanced security assessments. Based ...
- 8,445
4
votes
Accepted
Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
There are two types of cryptographic validation here:
Apt supports that each developer signs the package with its own key, and to validate that on package install. This is what this file refers to ...
- 19k
4
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
No. Nothing you do with a computer is 100% safe, and nothing in life is 100% safe. That's the wrong way to look at it. The question you should be asking is, which option offers more safety? When ...
- 161
3
votes
Accepted
Suspicious SSH connection
An "ESTABLISHED" connection seen in the output of a netstat command reffers only to the TCP connection. If the port was accepting connections from any remote IP, anybody could stablish a TCP session, ...
- 713
3
votes
Accepted
Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA
The "Apache naming" is actually the syntax used by OpenSSL. According to https://testssl.sh/openssl-rfc.mappping.html the OpenSSL name for TLS_RSA_WITH_3DES_EDE_CBC_SHA
is DES-CBC3-SHA.
- 206k
3
votes
Accepted
Is this version of openssl vulnerable?
Probably vulnerable.
CVEDetails has a list of 49 vulnerabilities for that version.
Take your pick.
Also: Debian 3.1 has had no security updates for nine years.
- 18.2k
3
votes
How can we retire SHA1 in prefernce to SHA256 or SHA-3?
The issue with SHA-1 is not an issue unless you are trying to generate two pieces of data who's SHA-1 collide. This is a lot different than generating one SHA-1 that collides with an existing SHA-1 ...
- 2,351
3
votes
protect c ++ application via an automatic hardware binding
Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
- 6,274
3
votes
Accepted
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
What is the relation of Peer signing digest with Signature hash
algorithm (Certificate)?
Peer signing digest is the algorithm used by the peer when signing things during the TLS handshake - see ...
- 206k
3
votes
Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers
Specifically, AWS Application Load Balancer does run at the level of Layer 7 (HTTP/HTTPS).
Application Load Balancer operates at the request level (layer 7), routing traffic to targets (EC2 instances,...
- 3,299
2
votes
Accepted
All weak Debian openssl DSA keys
If so, are they due to host architecture ...
Yup.
From the talk: "times three, because there are three combinations between endianness and bitness".
From the Debian wiki (archived here): (text ...
- 18.2k
2
votes
Accepted
Is Node.js on Debian Jessie really insecure?
This is because a stable release of Debian must stick with the feature version of the time when it turns stable.
Debian team clearly states it in their Q&A:
2.2 Are there package upgrades in `...
- 38
2
votes
Is wiping LUKS header needed?
The only way to make "sure" data cannot be regenerated is to use the writing "random data to entire disk" method. The LUKS header is just a "road map" to the data's encryption, loss of it makes it ...
2
votes
SSL warnings while using Origin Certificate on my VPS
The SSL warnings should go away if you turn on Cloudflare's reverse proxy ("orange-cloud" the DNS record that points to your Debian VPS). You will be presented Cloudflare's browser-trusted Edge ...
- 21
2
votes
How fix warnings from Debsecan
All known vulnerabilities in existing software almost certainly have patches and upgrades issued within hours of disclosure. The vulnerabilities can be fixed by updating to the newest versions ...
- 220
Only top scored, non community-wiki answers of a minimum length are eligible