Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
60 votes
Accepted

Does adding a password to BIOS prevent malware from infecting it?

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the ...
guest's user avatar
  • 506
30 votes
Accepted

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH On modern OpenSSH they recommend: KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-...
Patrick Mevzek's user avatar
26 votes
Accepted

Best practices for hardening sudo?

Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question. Is it enough to forbid su and allow sudo in ...
700 Software's user avatar
26 votes

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

To be honest, I don't understand these things too much, I just want strong encryption and everything I don't know what you mean by "everything" but if you just want strong encryption then don't mess ...
symcbean's user avatar
  • 18.6k
15 votes
Accepted

Why does checksec.sh highlight rpath and runpath as security issues?

TL;DR: R*PATH has an unfortunate history of introducing new ways of running untrusted (attacker-controlled) libraries. RPATH/RUNPATH is usually avoidable and should be avoided. Firstly, it might be ...
csirac2's user avatar
  • 166
11 votes

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?

Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity. WARNING: The following configuration is not compatible with all ...
Hartman's user avatar
  • 436
11 votes
Accepted

Securing a Laptop from a Foreign Intelligence Agency

I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in ...
forest's user avatar
  • 66.8k
11 votes
Accepted

Hardening NFC tags for authentication

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the ...
Kaz Wolfe's user avatar
  • 382
10 votes

Filter TLS in Wireshark or other monitoring tool

Try filtering by tls.record.version For example, if you wanted to only display TLS v1.2 traffic then you could run tls.record.version == 0x0303 You can choose from the hex values below for the version ...
jonroethke's user avatar
  • 1,044
9 votes
Accepted

Hardening/reducing attack surface for a Docker container

I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer ...
HashHazard's user avatar
  • 5,175
8 votes
Accepted

Security essentials for a embedded Linux device

Your considerations Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently ...
forest's user avatar
  • 66.8k
8 votes

Where to find the security hardened docker images

I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening. I'd caution against a pre-hardened image and instead recommend that you harden it yourself ...
HashHazard's user avatar
  • 5,175
7 votes

Why block outgoing network traffic with a firewall?

Blocking outgoing DNS queries so that DNS can only be routed through your preferred DNS server (enterprise DNS server, OpenDNS, Quad9, Google Public DNS, etc) is fairly commonplace on a network that ...
yourcomputergenius's user avatar
7 votes

What are some examples of viruses/exploits with benevolent purposes?

I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of ...
forest's user avatar
  • 66.8k
6 votes
Accepted

Hardening SSH security on a Debian 9 server

There are a number of things you can do: Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase. Configure AllowUsers in sshd so only named accounts can ...
Xiong Chiamiov's user avatar
6 votes

Difference between Lynis and Nessus and yet another hardening tool

Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery. I'm curious why you want to start a new project. So let me answer by ...
Michael Boelen's user avatar
6 votes
Accepted

Is zeroing out values on the stack and arguments overkill?

The C standard specifies the behavior of code in terms of an abstract machine. This specification does not know about concepts such as "the stack". It knows variables with "automatic ...
Daniel Jour's user avatar
5 votes
Accepted

Node.js REST server running as root

I would recommend splitting your app into multiple components communicating through standardized REST APIs. In this case you'd have a storage manager app which runs as a user with enough privileges ...
André Borie's user avatar
  • 12.8k
5 votes
Accepted

Was my phpMyAdmin hacked?

Those log entries look like normal scanning activity. You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
tim's user avatar
  • 29.6k
5 votes
Accepted

Does Linux support the NX-bit on ARM processors?

The NX-bit implementation its supported since ARMv6, and yes, linux also has support for it. (NX implementations needs both OS support and CPU support) Now if you want to check the nx bit, you can do ...
jmingov's user avatar
  • 874
5 votes

Does adding a password to BIOS prevent malware from infecting it?

BIOS passwords offer absolutely no protection against viruses. Its just there to slow people down who are trying to use your computer without your permission. Most computers have a "bios password ...
DennisH's user avatar
  • 51
5 votes

WIN 10 hardening: Importance of "Allow system to be shut down without having to log on" policy

That policy may source from the CIS Benchmarks, but is intended for servers, not for user workstations. To quote §2.3.13.1 (and note the Profile Applicability and Impact sections): 2.3.13.1 (...
gowenfawr's user avatar
  • 72.8k
5 votes

Is it a security risk to run master process of nginx as root?

It depends. One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make ...
Steffen Ullrich's user avatar
5 votes

Why is autofs insecure?

Many filesystem drivers are insecure. There's nothing wrong with automounting in theory, given that dangerous filesystem options are disabled for automounted filesystems, but the reality is that ...
forest's user avatar
  • 66.8k
5 votes
Accepted

Is it possible to run commands that exist only on the host on a docker container?

Yes this is possible using nsenter or similar tools, depending on what you want to do you can also use Docker tooling. A Docker container is just a namespaced Linux process, so using namespace aware ...
Rory McCune's user avatar
  • 62.3k
4 votes
Accepted

Gentoo Hardened vs other distros

Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure. But is it worth the compile? A big question among the ...
Cameron Does Things's user avatar
4 votes
Accepted

Removing execute permissions on `/tmp` or mounting it with `noexec` flag?

You are actually discussing three separate hardening techniques. Separate Partitions Separate partitions does two things for you. It first isolates systems. This can be beneficial in many ways not ...
Shane Andrie's user avatar
  • 3,840
4 votes
Accepted

Storing UK bank account and sort code in MongoDB database

HTTPS is mandatory of course. But there are a lot more of security options. I can provide you some basics: Server technologies You should implement HSTS (Http Strict Transport Security) to force ...
OscarAkaElvis's user avatar
4 votes
Accepted

How to secure a fresh Ubuntu 16.04 install

The CIS benchmarks provide very clear instructions on what should be made to secure most known systems.
Spack's user avatar
  • 156
4 votes
Accepted

what are the disadvantages of running SSH daemon without root?

The sshd is commonly installed on a system to let users log into this system from remote. To be able to do this at least parts of it would need to run with elevated permissions because otherwise it ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible