60
votes
Accepted
Does adding a password to BIOS prevent malware from infecting it?
Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the ...
- 506
30
votes
Accepted
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH
On modern OpenSSH they recommend:
KexAlgorithms [email protected],ecdh-sha2-nistp521,ecdh-sha2-...
- 1,873
26
votes
Accepted
Best practices for hardening sudo?
Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question.
Is it enough to forbid su and allow sudo in ...
- 14k
26
votes
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
To be honest, I don't understand these things too much, I just want strong encryption and everything
I don't know what you mean by "everything" but if you just want strong encryption then don't mess ...
- 18.7k
15
votes
Accepted
Why does checksec.sh highlight rpath and runpath as security issues?
TL;DR: R*PATH has an unfortunate history of introducing new ways of
running untrusted (attacker-controlled) libraries. RPATH/RUNPATH
is usually avoidable and should be avoided.
Firstly, it might be ...
- 166
11
votes
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity.
WARNING: The following configuration is not compatible with all ...
- 436
11
votes
Accepted
Securing a Laptop from a Foreign Intelligence Agency
I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in ...
- 67.1k
11
votes
Accepted
Hardening NFC tags for authentication
First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the ...
- 382
10
votes
Filter TLS in Wireshark or other monitoring tool
Try filtering by tls.record.version
For example, if you wanted to only display TLS v1.2 traffic then you could run tls.record.version == 0x0303
You can choose from the hex values below for the version ...
- 1,054
9
votes
Accepted
Hardening/reducing attack surface for a Docker container
I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer ...
- 5,185
8
votes
Accepted
Security essentials for a embedded Linux device
Your considerations
Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently ...
- 67.1k
8
votes
Where to find the security hardened docker images
I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening.
I'd caution against a pre-hardened image and instead recommend that you harden it yourself ...
- 5,185
7
votes
Why block outgoing network traffic with a firewall?
Blocking outgoing DNS queries so that DNS can only be routed through your preferred DNS server (enterprise DNS server, OpenDNS, Quad9, Google Public DNS, etc) is fairly commonplace on a network that ...
7
votes
What are some examples of viruses/exploits with benevolent purposes?
I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of ...
- 67.1k
6
votes
Accepted
Hardening SSH security on a Debian 9 server
There are a number of things you can do:
Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
Configure AllowUsers in sshd so only named accounts can ...
- 9,452
6
votes
Difference between Lynis and Nessus and yet another hardening tool
Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery.
I'm curious why you want to start a new project. So let me answer by ...
- 126
6
votes
Accepted
Is zeroing out values on the stack and arguments overkill?
The C standard specifies the behavior of code in terms of an abstract machine. This specification does not know about concepts such as "the stack". It knows variables with "automatic ...
- 196
5
votes
Accepted
Node.js REST server running as root
I would recommend splitting your app into multiple components communicating through standardized REST APIs.
In this case you'd have a storage manager app which runs as a user with enough privileges ...
- 12.9k
5
votes
Accepted
Does Linux support the NX-bit on ARM processors?
The NX-bit implementation its supported since ARMv6, and yes, linux also has support for it. (NX implementations needs both OS support and CPU support)
Now if you want to check the nx bit, you can do ...
- 884
5
votes
Does adding a password to BIOS prevent malware from infecting it?
BIOS passwords offer absolutely no protection against viruses. Its just there to slow people down who are trying to use your computer without your permission. Most computers have a "bios password ...
- 51
5
votes
WIN 10 hardening: Importance of "Allow system to be shut down without having to log on" policy
That policy may source from the CIS Benchmarks, but is intended for servers, not for user workstations. To quote §2.3.13.1 (and note the Profile Applicability and Impact sections):
2.3.13.1 (...
- 73.2k
5
votes
Is it a security risk to run master process of nginx as root?
It depends.
One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make ...
- 206k
5
votes
Why is autofs insecure?
Many filesystem drivers are insecure.
There's nothing wrong with automounting in theory, given that dangerous filesystem options are disabled for automounted filesystems, but the reality is that ...
- 67.1k
5
votes
Accepted
Is it possible to run commands that exist only on the host on a docker container?
Yes this is possible using nsenter or similar tools, depending on what you want to do you can also use Docker tooling.
A Docker container is just a namespaced Linux process, so using namespace aware ...
- 62.5k
4
votes
Accepted
Removing execute permissions on `/tmp` or mounting it with `noexec` flag?
You are actually discussing three separate hardening techniques.
Separate Partitions
Separate partitions does two things for you. It first isolates systems. This can be beneficial in many ways not ...
- 3,850
4
votes
Accepted
Storing UK bank account and sort code in MongoDB database
HTTPS is mandatory of course. But there are a lot more of security options. I can provide you some basics:
Server technologies
You should implement HSTS (Http Strict Transport Security) to force ...
- 5,335
4
votes
Accepted
How to secure a fresh Ubuntu 16.04 install
The CIS benchmarks provide very clear instructions on what should be made to secure most known systems.
- 156
4
votes
Accepted
what are the disadvantages of running SSH daemon without root?
The sshd is commonly installed on a system to let users log into this system from remote. To be able to do this at least parts of it would need to run with elevated permissions because otherwise it ...
- 206k
4
votes
Accepted
How to make it harder for a VPS provider to access my data?
Buy a VPS (the StorageVPS), create a 50GB file full of zeroes, export this file using SSHFS.
Buy another VPS (the ApplicationVPS) on another jurisdiction, mount that file, use LUKS to create an ...
- 55.1k
4
votes
Accepted
Why should I re-generate a server's SSH host keys?
Who created the original keys?
If they were created by the post-inst when you installed the openssh package (or you first booted the server), that should be fine.
On the other hand, if this is a ...
- 19k
Only top scored, non community-wiki answers of a minimum length are eligible