Hot answers tagged

66 votes
Accepted

Is having a hidden directory under /etc safe?

Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
61 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
43 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

In addition to the different permissions needed for a process' command line vs its pipes, consider: Command lines often show up in audit logs, shell history, or similar; data passed to stdin does not. ...
  • 41.2k
21 votes

Is having a hidden directory under /etc safe?

It is safe in the sense that no, it will not make the system unstable, nor will it make it vulnerable from a security standpoint. That said, as MechMK1 points out, the only reason to use hidden ...
  • 2,085
19 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

The important part is not about an attacker compromising exactly your account. Any account on a typical Linux system can run ps and see what others are running. Even if your particular machine is ...
  • 3,460
9 votes
Accepted

Security of decompression tools

How safe is it to decompress untrusted files Just looking at the CVE's for unzip you will find several possible code executions, modifying the permissions of existing files, overwriting arbitrary ...
9 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

I think the title to your question and the body of your question are contradicting each other a bit and I think that may be leading to some of the confusion with the other correct answers. Your title ...
  • 91
8 votes
Accepted

SSL warnings while using Origin Certificate on my VPS

CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not ...
7 votes

Debian 9 opted out of data collection, doing it anyway?

You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading. Upgrades do not upload anything. The only data that's sent from your ...
6 votes

Is the Linux / Debian software and package-management ecosystem secure?

It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they ...
  • 133k
6 votes
Accepted

Hardening SSH security on a Debian 9 server

There are a number of things you can do: Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase. Configure AllowUsers in sshd so only named accounts can ...
5 votes

Unauthenticated packages in debian

You can check it at /var/log/apt/history.log . There you'll find info about what packages were installed by users in the system. I think there is no info about the repository from they were installed. ...
5 votes
Accepted

Is binding all private services to the 127.0.0.1 address and then accessing them via SSH using an RSA key pair of 4096 bits secure?

You description of local services which you only access through secure SSH forwarding is to vague to evaluate the security of your setup. What this setup is doing is restricting the access to the ...
5 votes
Accepted

Server get flooded by Avast Secure DNS

It's unlikely that this is coming from avast secure DNS. More likely, you're running an open DNS resolver and an attacker with a botnet is trying to DDoS Avast SecureDNS by using open resolvers to ...
  • 15.9k
5 votes
Accepted

Sharing the UUIDs of my Linux partitions

I am assuming you are asking whether or not a partition UUID is sensitive information. A UUID is a random value assigned to the partition of a drive. It is used to reference the drive without needing ...
  • 65k
4 votes

How to know if a host has been compromised and re-secure it again? (particular case of a raspberry)

It is impossible to prove that an attacker has not compromised your server. It is always possible that an attacker accessed and installed malware that would be left behind. The safest thing to do is ...
4 votes
Accepted

How to prevent the latest ImageMagick vulnerability?

As per the page you linked, there's a workaround. Add the following to your policy.xml: <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" ...
  • 133k
4 votes
Accepted

How to sandbox Firefox ESR for normal browsing?

You have several ways to sandbox Firefox (or any similar application), depending on your exact requirements. From the lighter to the heavier solution, you mainly have: Firejail is a software ...
4 votes

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

No. Nothing you do with a computer is 100% safe, and nothing in life is 100% safe. That's the wrong way to look at it. The question you should be asking is, which option offers more safety? When ...
  • 161
3 votes

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

The issue with SHA-1 is not an issue unless you are trying to generate two pieces of data who's SHA-1 collide. This is a lot different than generating one SHA-1 that collides with an existing SHA-1 ...
  • 2,291
3 votes

protect c ++ application via an automatic hardware binding

Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
3 votes

How to prevent the latest ImageMagick vulnerability?

Here is a reference for you: https://imagetragick.com According to that page, you should verify magic bytes for the file you are processing, and you should use a policy file to disable the vulnerable ...
3 votes
Accepted

Hacked debian server alternative boot

From the post and ensuing dialogue: The machine is a Debian wheezy / 7.0 that aparently has not seen updates for around two years. There are logs lacking, that indicate the attackers cleaned up ...
3 votes

Prevent ARP spoofing with dynamic static entry on Linux

I did not analyse your script. However, it looks complex. Why don't you use ARPtables? It's like IPtables, but for ARP. Block ARP traffic from all machines (default: DENY) arptables -P INPUT DROP ...
  • 411
3 votes
Accepted

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

The "Apache naming" is actually the syntax used by OpenSSL. According to https://testssl.sh/openssl-rfc.mappping.html the OpenSSL name for TLS_RSA_WITH_3DES_EDE_CBC_SHA is DES-CBC3-SHA.
3 votes
Accepted

Is this version of openssl vulnerable?

Probably vulnerable. CVEDetails has a list of 49 vulnerabilities for that version. Take your pick. Also: Debian 3.1 has had no security updates for nine years.
3 votes
Accepted

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

What is the relation of Peer signing digest with Signature hash algorithm (Certificate)? Peer signing digest is the algorithm used by the peer when signing things during the TLS handshake - see ...
3 votes
Accepted

Transfer requests for localhost zone on my bind DNS server

This is your guy: https://www.alphastrike.io/ In their own words: Alpha Strike Labs are a security consulting company specialized in industrial security and advanced security assessments. Based ...
  • 7,042
3 votes

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

There are two types of cryptographic validation here: Apt supports that each developer signs the package with its own key, and to validate that on package install. This is what this file refers to ...
  • 17.9k
2 votes
Accepted

How can I check whether file modified time has been spoofed on ext4?

Host Intrusion Detection Systems (HIDS) can offer this feature : File integrity checking. I don't try it personnaly but according to the documentation AIDE can do this. The idea is to create hash ...

Only top scored, non community-wiki answers of a minimum length are eligible