New answers tagged linux
1
/dev/urandom uses a CSPRNG (Chacha20 last time I checked) to generate a stream of random data from an initial seed and allows the user to read an arbitrary number of bits from it. /dev/random pulls data out of a random pool that needs to be replenished.
It is possible to read from /dev/urandom before the system has enough entropy to provide a secure stream ...
0
It depends on how it's deployed. Usually you'll have to whitelist specific calls from your application, but at system level you can apply policies that only a subset of the system is confined.
As perfectly stated by Wiki's FAQ:
Is AppArmor policy Default Deny (White listing)
Yes, and no. AppArmor profiles are based on default deny, that is the
...
0
enter preformatted text hereRet2Lib is a type of Attack that over writes the Return address of a vulnerable function with a different address, usually of a function that already exists in the process executable memory. This feature is used to bypass the non executable stack that prevents attackers from writing code.
It is generally started with a BOF of a ...
0
Unless /dev/sdd is exactly the same size of the ISO file (which is unlikely), then /dev/sdd will contain unallocated empty spaces which contains either old deleted data or zeros. Even if they contain zeros, they will still affect the checksum.
You may have to use head -c <number of bytes> /dev/sdd when reading from /dev/sdd to remove the padding at ...
0
DD copies the image byte by byte onto the USB drive, It creates an exact clone.It creates one partition that holds the image, that's why only the partition that contains the image file has a matching checksum. I'm not entirely sure about the particulars of Fedora but, In typical Linux Distributions when DD command is used to create a bootable USB drive, the ...
0
It's not clear to me what you are trying to accomplish.
You appear to be writing a file to a raw device. Unless the file is a disk image appropriate for that kind of device, this makes no sense to me.
The Fedora-Live ISO is a SquashFS file system, not a binary or raw image suitable for dumping to a raw device.
Since this is a Fedora-Live ISO, I'm ...
1
Let's say we're exploiting buffer overflow in some foo function. Consider the following stack after overflowing the buffer, stopping at ret instruction in foo function:
....
------------------------
"system" fn address <-- stack pointer
------------------------
4 bytes of garbage
------------------------
"bin/sh" address
-----------------------...
0
It's likely the intended return address, garbage will cause a segfault. For a more detailed explanation see my answer to Why must a ret2libc attack follow the order "system(),exit(),command?
0
To connect from Linux to SQL Server you pretty much have to have a password (unless this has changed recently).
I would put the password in a file, configure the ownership and permissions so that only the authorised user can access it, and have the script read the password from the file.
If this was Windows you could use Integrated Windows Authentication, ...
0
You could create stored procedures that ONLY do what your script needs to do and then limit GenericTaskRunner's permissions on the database to allow it to execute those stored procedures ONLY. This way, even if the rest of users have the database credentials, they can only do what the script can do.
If this was not enough, then you should consider executing ...
1
This question continues to receive occasional visits and upvotes, and I see that a few of the answers contain parts of the true answer, so I am creating a wiki answer that stitches it all together. A similar question has since been asked and answered at Unix.SE.
According to RH# 1225788, this is intended behavior:
It's by design that admin users (in the ...
1
Once the process is started, this is not possible. As mentioned the only way to do this is via redirection however that happens inside bash (as you've noted in the comments) not inside the process and thus does not fit as a solution for your question.
3
I'm wondering whether to make most of these files readable/executable
PHP files do not need to be executable. That could be worse than having the write permission.
Furthermore, in the specific directories mentioned (e.g., var generated vendor pub/static pub/media app/etc) write permissions are probably required (at least for some file types). I have not ...
1
Basically, you will depend on the expert(s) assessing the program security having a deep knowledge of what the programs that are allowed elevated rights can do.
The above sentence includes knowledge of the libraries used by the program and the system you are using (Linux? *BSD?).
Going down to a full source-code audit may not be needed. For a well-...
1
In general what you can think, instead of binaries is on syscalls. For example cat, more and less probably they will execute the syscalls, open, read, write, close and so on. On the other hand, if the binary (for example find) can execute other binaries, with the use of -exec parameter, the syscalls implied on this process are fork, exec, mmap, etc.. that ...
0
With multithr3at3d's help I finally figured out how to do this. Here are two mistakes I made above:
The DNAT rule in the NAT configuration changed the receiver to my laptop. This rule was misleading and should be removed. That's what the configuration should look like:
sudo iptables -A FORWARD --in-interface at0 -j ACCEPT
sudo iptables -P ...
6
In general, it's impossible to know for sure - even a seemlingly-perfectly-safe program could have vulnerabilities that mean it can be used for arbitrary actions - but here are some things to check for:
Does the program do any of the following?
Reveal the contents of arbitrary files or devices.
Copy, move, write, or delete arbitrary files.
Set / modify ...
3
Doing 'the inverse' seems like the more secure solution.
If:
the backup function is the only function that the backup server
performs
all incoming connections to the backup server are blocked
all outgoing connections (except the connection to the server being
backed-up) are blocked
the only process that the backup server performs is the backup process
(...
5
It essentially boils down to the halting problem, you can audit the code or reverse engineer the binary, however even if there are no "features" that let you execute arbitrary commands there could still be vulnerabilities in the binary or sudo itself that could lead to arbitrary command execution as root for the enabled users.
-2
Things are not only binaries!
How can one tell if a binary is safe to give sudo permissions for to an untrusted user?
Depending on who (is to be protected, and who is able to connect), what (files, directories, file systems, sockets, etc).
I think the correct answer is to recommand to search another approach.
Nota: Last paragraph of SO question was ...
1
A reverse proxy is just an efficient tool, but not a magic bullet. When it is properly configured, it can ensure that only legal urls can be reached. But if you let anything pass through it will not protect much.
Security is hard because it is not only a matter of tools: any defect in the configuration of the security tools will open a breach. So the actual ...
0
Yes, one case: if suppose your main site has some config files named connection.*, config.*, password,* or whatever which is accessible to internet via reverse proxy server anyone can go and view whats written inside them until you've explicitly put up a blockade or something on it.
2
Using groups for sudoers entries allows you to manage filesystem permissions (which by default are user- and group-based) in the same place as sudo rules. Using User_Alias instead of groups means all aspects of sudo rules are in the same place but makes it more difficult to manage sudo rules in the same space as filesystem permissions. So it's basically a ...
1
It takes only a few lines to test and the answer is clear: if the user knows the name of the file he can still read its meta data and content as long the permissions of the file itself allow it:
$ mkdir x
$ echo foo > x/y
$ ls -l x
total 4
-rw-rw-r-- 1 user user 4 Nov 21 18:44 y
$ chmod 0100 x
$ ls -l x
ls: cannot open directory 'x': Permission denied
$ ...
Top 50 recent answers are included
