60
votes
Accepted
Does adding a password to BIOS prevent malware from infecting it?
Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the ...
- 506
30
votes
Accepted
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH
On modern OpenSSH they recommend:
KexAlgorithms curve25519[email protected],ecdh-sha2-nistp521,ecdh-sha2-...
- 1,843
26
votes
Accepted
Best practices for hardening sudo?
Your question is rather broad, touching on several different subjects. It may be better to take some of the details and put them in a separate question.
Is it enough to forbid su and allow sudo in ...
- 14k
26
votes
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
To be honest, I don't understand these things too much, I just want strong encryption and everything
I don't know what you mean by "everything" but if you just want strong encryption then don't mess ...
- 18.6k
15
votes
Accepted
Why does checksec.sh highlight rpath and runpath as security issues?
TL;DR: R*PATH has an unfortunate history of introducing new ways of
running untrusted (attacker-controlled) libraries. RPATH/RUNPATH
is usually avoidable and should be avoided.
Firstly, it might be ...
- 166
11
votes
What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings?
Following config can provide higher security level while keeping some degree of compatibility and reduce configuration complexity.
WARNING: The following configuration is not compatible with all ...
- 436
11
votes
Accepted
Securing a Laptop from a Foreign Intelligence Agency
I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in ...
- 66.5k
11
votes
Accepted
Hardening NFC tags for authentication
First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the ...
- 382
9
votes
Accepted
Hardening/reducing attack surface for a Docker container
I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer ...
- 5,175
9
votes
Filter TLS in Wireshark or other monitoring tool
Try filtering by tls.record.version
For example, if you wanted to only display TLS v1.2 traffic then you could run tls.record.version == 0x0303
You can choose from the hex values below for the version ...
- 1,034
8
votes
Accepted
Security essentials for a embedded Linux device
Your considerations
Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently ...
- 66.5k
7
votes
Why block outgoing network traffic with a firewall?
Blocking outgoing DNS queries so that DNS can only be routed through your preferred DNS server (enterprise DNS server, OpenDNS, Quad9, Google Public DNS, etc) is fairly commonplace on a network that ...
7
votes
Where to find the security hardened docker images
I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening.
I'd caution against a pre-hardened image and instead recommend that you harden it yourself ...
- 5,175
7
votes
What are some examples of viruses/exploits with benevolent purposes?
I doubt you'll find any virus which is completely benign (even fixing a vulnerability after exploiting it is still malicious behavior, even if it is intended to be beneficial), but there are plenty of ...
- 66.5k
6
votes
SSH ciphers, MAC and key-exchange (and pen-tests thereof)
Unfortunately the standards bodies don't fully agree on a single list of ciphers for SSL/TLS or SSH security. The following document and it's internal references will help a lot and I would think that ...
- 14.2k
6
votes
Accepted
Hardening SSH security on a Debian 9 server
There are a number of things you can do:
Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
Configure AllowUsers in sshd so only named accounts can ...
- 9,432
6
votes
Difference between Lynis and Nessus and yet another hardening tool
Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery.
I'm curious why you want to start a new project. So let me answer by ...
- 116
6
votes
Accepted
Is zeroing out values on the stack and arguments overkill?
The C standard specifies the behavior of code in terms of an abstract machine. This specification does not know about concepts such as "the stack". It knows variables with "automatic ...
- 196
5
votes
Accepted
What's the distinction between a missed hardening opportunity and security flaw?
It is always risk that defines that criteria.
What's the likelihood of the problem being exploited, what are the mitigations in place to prevent or limit the impact, and what are the impacts of a ...
- 128k
5
votes
Secure environment for servers with sensitive private data
Seek professional advice...seriously, if the data is as sensitive as you say and the consequences are truly fatal, it would be negligent to rely on advice from here upon which to base a solution.
...
- 2,963
5
votes
Accepted
Was my phpMyAdmin hacked?
Those log entries look like normal scanning activity.
You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
- 29.5k
5
votes
Accepted
Node.js REST server running as root
I would recommend splitting your app into multiple components communicating through standardized REST APIs.
In this case you'd have a storage manager app which runs as a user with enough privileges ...
- 12.8k
5
votes
Accepted
Does Linux support the NX-bit on ARM processors?
The NX-bit implementation its supported since ARMv6, and yes, linux also has support for it. (NX implementations needs both OS support and CPU support)
Now if you want to check the nx bit, you can do ...
- 864
5
votes
Does adding a password to BIOS prevent malware from infecting it?
BIOS passwords offer absolutely no protection against viruses. Its just there to slow people down who are trying to use your computer without your permission. Most computers have a "bios password ...
- 51
5
votes
WIN 10 hardening: Importance of "Allow system to be shut down without having to log on" policy
That policy may source from the CIS Benchmarks, but is intended for servers, not for user workstations. To quote §2.3.13.1 (and note the Profile Applicability and Impact sections):
2.3.13.1 (...
- 72.7k
5
votes
Is it a security risk to run master process of nginx as root?
It depends.
One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make ...
- 198k
5
votes
Why is autofs insecure?
Many filesystem drivers are insecure.
There's nothing wrong with automounting in theory, given that dangerous filesystem options are disabled for automounted filesystems, but the reality is that ...
- 66.5k
5
votes
Accepted
Is it possible to run commands that exist only on the host on a docker container?
Yes this is possible using nsenter or similar tools, depending on what you want to do you can also use Docker tooling.
A Docker container is just a namespaced Linux process, so using namespace aware ...
- 62.1k
4
votes
Accepted
Gentoo Hardened vs other distros
Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure.
But is it worth the compile? A big question among the ...
4
votes
Accepted
Removing execute permissions on `/tmp` or mounting it with `noexec` flag?
You are actually discussing three separate hardening techniques.
Separate Partitions
Separate partitions does two things for you. It first isolates systems. This can be beneficial in many ways not ...
- 3,820
Only top scored, non community-wiki answers of a minimum length are eligible