343
votes
Accepted
User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?
Do I need to verify the user for every single page?
Absolutely. Not only every page, but every request to a privileged resource, e.g POST request to update data, delete, view, etc, etc. It is not ...
- 2,829
124
votes
Accepted
Why don't video conferencing web applications ask permission for screen sharing?
Either way, the user agent responds by presenting a user interface that prompts the user to choose the screen area to share. Both of these implementations of startCapture() return the MediaStream ...
- 15.2k
109
votes
Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?
There's a number of reasons:
If it has happened to one person, it might have happened to more. These other people might not be as kind.
Who knows, this person might change their mind. When they made ...
- 65.1k
104
votes
Accepted
What is the point of encrypting the home directory?
The point is to protect against your disk being accessed outside of the OS.
Encryption is useful against attackers who have physical access to your computer. Without it, it would be trivial to read ...
- 29.2k
101
votes
Accepted
Why is root security enforced but $HOME typically unprotected?
I'm going to disagree with the answers that say the age of the Unix security model or the environment in which it was developed are at fault. I don't think that's the case because there are ...
- 1,628
98
votes
Accepted
Reason to not use chmod -R 777 on internal server for project source code?
However, after putting some thought into it I can't come up with a
reason why shared executable code on an internal server shouldn't have
777 permissions.
Because you're not only trusting every ...
- 72.5k
67
votes
Accepted
What are the potential vulnerabilities of allowing non-root users to run apt-get?
apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
From GTFOBins
This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
- 845
60
votes
Accepted
How can I prevent a user from copying files to another hard drive?
You can disable USB storage on Linux by blacklisting the module.
modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf
echo blacklist uas >> /...
- 15.2k
59
votes
Why is it considered safe to install something as a non-root user in Linux environments?
We always hear...
Do we? I don't.
Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can ...
- 193k
58
votes
Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?
While it's impossible to read the minds of the people at play - I'd think that the independent programmer
A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if ...
55
votes
Why is root security enforced but $HOME typically unprotected?
Because the UNIX-based security model is 50 years old.
UNIX underlies most widespread OSs, and even the big exception Windows has been influenced by it more than is apparent. It stems from a time ...
- 907
52
votes
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
- 31.3k
46
votes
What are the potential vulnerabilities of allowing non-root users to run apt-get?
You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
- 44.1k
38
votes
User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?
The quick answer is yes, as you gathered. But it doesn't need to be the huge job you're thinking of. (The whole security thing might be big, but this is only one part of it). You have far more ...
- 1,674
36
votes
Accepted
Why is it considered safe to install something as a non-root user in Linux environments?
In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe.
TL;DR: ...
- 58.3k
31
votes
Why is root security enforced but $HOME typically unprotected?
This is a highly astute observation. Yes, malware running as your user can damage/destroy/modify data in your home directory. Yes, user separation on single user systems is less useful than on ...
- 16k
30
votes
What is the point of encrypting the home directory?
The Linux permissions only work on your own system. If you take the disk and put it in another computer, or just boot another OS on the same computer that can read your Linux partition you will ...
- 615
29
votes
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
SMS 2FA is not only a bad idea; it's worse than not having 2FA at all (password only). This is because virtually all services offering "SMS 2FA" are actually delivering SMS 1FA! That is, they allow ...
28
votes
User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?
You need to check the user permission level for every request (GET, POST, PUT, DELETE). Browsing to a page, like in your case is a GET request. A user shouldn't be able to post a request without ...
- 380
25
votes
Why is root security enforced but $HOME typically unprotected?
The original design of Unix/Linux security was to protect a user from other users, and system files from users. Remember that 30-40 years ago, most Unix systems were multi-user setups with many ...
- 21.6k
25
votes
Reason to not use chmod -R 777 on internal server for project source code?
I'm gonna second @gowenfawr and say that breeding better chimpanzees is a goal unto itself here. (now I will extrapolate wildly about your corporate culture)
At my software development company, we've ...
- 58.3k
21
votes
How can I prevent a user from copying files to another hard drive?
Client-server architecture
This is another approach that could make copying files much harder, but it requires investing more effort from your side.
Access to the information could be setup on a ...
- 1,234
19
votes
Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?
One thing to note is that giving an additional user access to a repository opens up a whole new possible attack vector. If someone else with malicious intentions has access to the account which has ...
- 7,383
19
votes
How can I prevent a user from copying files to another hard drive?
In addition to blocking USB (see other answers above):
Disable networking, because...
... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine....
- 12.1k
15
votes
Claim that Skype is an unconfined application able to access all one's own personal files and system resources
It’s like this comic:
Generally, any program that runs under your account
can access any resources that your account can access.
Can Skype really scan anything I have in my home directory
...
14
votes
What is the point of encrypting the home directory?
In addition to answers, there are a few minor caveats that one must keep in mind about these encrypted configurations.
When you are not logged into your system, data in your home directory is not ...
- 299
13
votes
Custom socket server on the internet running as root
That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. ...
- 171k
13
votes
How can I prevent a user from copying files to another hard drive?
OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but...
If you can secure the box physically (otherwise all bets are off), then maybe ...
- 1,018
13
votes
Accepted
How is MAC useful?
And with this, the permissions of something is mandatory, and are enforced so that even the owner cannot change them.
Imagine mysql running as a certain user. It has to read and write the database, ...
- 15.2k
Only top scored, non community-wiki answers of a minimum length are eligible