66
votes
Accepted
Is having a hidden directory under /etc safe?
Yes, that's safe. There's nothing inherently insecure about having a hidden directory under /etc. The only reason rkhunter flags it is that it's uncommon for legitimate programs to do it, and when ...
61
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.
43
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
In addition to the different permissions needed for a process' command line vs its pipes, consider:
Command lines often show up in audit logs, shell history, or similar; data passed to stdin does not.
...
- 42.1k
21
votes
Is having a hidden directory under /etc safe?
It is safe in the sense that no, it will not make the system unstable, nor will it make it vulnerable from a security standpoint.
That said, as MechMK1 points out, the only reason to use hidden ...
- 2,085
19
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
The important part is not about an attacker compromising exactly your account.
Any account on a typical Linux system can run ps and see what others are running.
Even if your particular machine is ...
- 3,458
9
votes
Accepted
Security of decompression tools
How safe is it to decompress untrusted files
Just looking at the CVE's for unzip you will find several possible code executions, modifying the permissions of existing files, overwriting arbitrary ...
- 189k
9
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
I think the title to your question and the body of your question are contradicting each other a bit and I think that may be leading to some of the confusion with the other correct answers.
Your title ...
- 91
8
votes
Accepted
SSL warnings while using Origin Certificate on my VPS
CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not ...
- 3,448
7
votes
Debian 9 opted out of data collection, doing it anyway?
You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading.
Upgrades do not upload anything. The only data that's sent from your ...
6
votes
Is the Linux / Debian software and package-management ecosystem secure?
It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they ...
- 134k
6
votes
Accepted
Hardening SSH security on a Debian 9 server
There are a number of things you can do:
Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
Configure AllowUsers in sshd so only named accounts can ...
- 9,392
5
votes
Unauthenticated packages in debian
You can check it at /var/log/apt/history.log . There you'll find info about what packages were installed by users in the system. I think there is no info about the repository from they were installed. ...
- 5,225
5
votes
Accepted
Is binding all private services to the 127.0.0.1 address and then accessing them via SSH using an RSA key pair of 4096 bits secure?
You description of local services which you only access through secure SSH forwarding is to vague to evaluate the security of your setup. What this setup is doing is restricting the access to the ...
- 189k
5
votes
Accepted
Server get flooded by Avast Secure DNS
It's unlikely that this is coming from avast secure DNS. More likely, you're running an open DNS resolver and an attacker with a botnet is trying to DDoS Avast SecureDNS by using open resolvers to ...
- 15.9k
5
votes
Accepted
Sharing the UUIDs of my Linux partitions
I am assuming you are asking whether or not a partition UUID is sensitive information.
A UUID is a random value assigned to the partition of a drive. It is used to reference the drive without needing ...
- 65.5k
4
votes
How to know if a host has been compromised and re-secure it again? (particular case of a raspberry)
It is impossible to prove that an attacker has not compromised your server. It is always possible that an attacker accessed and installed malware that would be left behind.
The safest thing to do is ...
- 705
4
votes
Accepted
How to prevent the latest ImageMagick vulnerability?
As per the page you linked, there's a workaround.
Add the following to your policy.xml:
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" ...
- 134k
4
votes
Accepted
How to sandbox Firefox ESR for normal browsing?
You have several ways to sandbox Firefox (or any similar application), depending on your exact requirements.
From the lighter to the heavier solution, you mainly have:
Firejail is a software ...
- 19.1k
4
votes
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
No. Nothing you do with a computer is 100% safe, and nothing in life is 100% safe. That's the wrong way to look at it. The question you should be asking is, which option offers more safety? When ...
- 161
3
votes
How can we retire SHA1 in prefernce to SHA256 or SHA-3?
The issue with SHA-1 is not an issue unless you are trying to generate two pieces of data who's SHA-1 collide. This is a lot different than generating one SHA-1 that collides with an existing SHA-1 ...
- 2,301
3
votes
protect c ++ application via an automatic hardware binding
Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
- 5,863
3
votes
How to prevent the latest ImageMagick vulnerability?
Here is a reference for you: https://imagetragick.com
According to that page, you should verify magic bytes for the file you are processing, and you should use a policy file to disable the vulnerable ...
3
votes
Accepted
Hacked debian server alternative boot
From the post and ensuing dialogue:
The machine is a Debian wheezy / 7.0 that aparently has not seen updates for around two years.
There are logs lacking, that indicate the attackers cleaned up ...
- 1,736
3
votes
Prevent ARP spoofing with dynamic static entry on Linux
I did not analyse your script. However, it looks complex.
Why don't you use ARPtables? It's like IPtables, but for ARP.
Block ARP traffic from all machines (default: DENY)
arptables -P INPUT DROP
...
- 409
3
votes
Accepted
Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA
The "Apache naming" is actually the syntax used by OpenSSL. According to https://testssl.sh/openssl-rfc.mappping.html the OpenSSL name for TLS_RSA_WITH_3DES_EDE_CBC_SHA
is DES-CBC3-SHA.
- 189k
3
votes
Accepted
Is this version of openssl vulnerable?
Probably vulnerable.
CVEDetails has a list of 49 vulnerabilities for that version.
Take your pick.
Also: Debian 3.1 has had no security updates for nine years.
- 17.9k
3
votes
Accepted
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
What is the relation of Peer signing digest with Signature hash
algorithm (Certificate)?
Peer signing digest is the algorithm used by the peer when signing things during the TLS handshake - see ...
- 189k
3
votes
Accepted
Transfer requests for localhost zone on my bind DNS server
This is your guy: https://www.alphastrike.io/
In their own words:
Alpha Strike Labs are a security consulting company specialized in
industrial security and advanced security assessments. Based ...
- 7,092
3
votes
Accepted
Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
There are two types of cryptographic validation here:
Apt supports that each developer signs the package with its own key, and to validate that on package install. This is what this file refers to ...
- 18.2k
3
votes
What can a virus hidden in a video do and will the video be playable?
Technically, it's not the virus(1) per se that hides in the video but specially crafted media data. The data can exploit either a vulnerability that will cause the media player to misbehave (e.g. for ...
- 1,421
Only top scored, non community-wiki answers of a minimum length are eligible