Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
63 votes

Why does one need a strong password on Unix?

You seem to have a pretty clear understanding of the risks. As others have stated it highly encouraged to use a strong password, so if you are running a sensitive service, then by all means, please ...
700 Software's user avatar
26 votes
Accepted

Unix command to generate cryptographically secure random string

No, it's not entirely secure. Let's look at each of the commands: dd if=/dev/urandom bs=256 count=1 2> /dev/null This will read a single 256 byte block from /dev/urandom, a cryptographically ...
forest's user avatar
  • 66.8k
24 votes
Accepted

Why should one use sudo?

There are valid convenience uses for sudo, but because they are already adequately explained in other posts, I won't elaborate on them much here. I will however point you to sudoers(5), which is the ...
forest's user avatar
  • 66.8k
18 votes

Why should one use sudo?

Aside what's mentioned by the other users, sudo also keeps the original identity of the user that's executing the command. Meaning that you can track what userid performed the command. If you are ...
Lucas Kauffman's user avatar
15 votes

How can utilities with setuid set to root be secure if they are debuggable?

Normally, when su runs, it runs setuid (as root). When you start it with gdb, the setuid bit doesn't take effect (because it's being ptraced), so even if you convince it that you entered the right ...
Joseph Sible-Reinstate Monica's user avatar
13 votes

Why does one need a strong password on Unix?

You do not need a strong password. The advise about password, like so many others, is a safe default that we security professionals give because it is usually a good advise, many people (and ...
Tom's user avatar
  • 10.4k
12 votes

What is the entropy of a password made with pwgen?

An exact answer would require a deeper analyzis of the pwgen source code, or a more exact measurement. But I think we can use a strong compressor to approximate the entropy. The command pwgen 1048576|...
peterh's user avatar
  • 3,030
10 votes

Why is linux filesystem considered DAC and not MAC

I don't think the granularity of permissions that can be achieved is relevant here. It doesn't matter if permission can be assigned to specific users, it matters which users can change permissions. ...
AndrolGenhald's user avatar
10 votes
Accepted

Why is linux filesystem considered DAC and not MAC

In a discretionary access control system the owner of the source decides who can access data. In a mandatory access control system an admin decides who can access data, which is then typically ...
Swashbuckler's user avatar
  • 2,205
9 votes
Accepted

Is `arc4random` secure enough?

Both arc4random and /dev/urandom have histories of problems. Some systems have reimplemented arc4random without RC4, but some systems kept RC4. I prefer arc4random over /dev/urandom, but if your ...
George Koehler's user avatar
9 votes
Accepted

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

The | is anonymous. The pipe will usually not be accessible to anyone who isn't root or the owner of one of the processes. As soon as you read the standard input and close it, the cat process will ...
Ed Grimm's user avatar
  • 258
7 votes

Why does one need a strong password on Unix?

On the one hand, the fact is that you don't know. A strong password is defense in depth. Say that you (or someone else) installs an additional service that also uses Unix authentication; for example ...
LSerni's user avatar
  • 22.8k
6 votes

Should I compile as root?

There are two different situations: 1. You are going to run the software as root In this case you should really trust the source code before using it. Either by auditing it, or by trusting the ...
joeytwiddle's user avatar
6 votes
Accepted

Why is `cd` restricted in rbash/restricted bash?

By itself, this measure most probably doesn't make a lot of sense, however you have to put it aside the other limitation to understand its role, in particular (quoting the page you linked): ...
WhiteWinterWolf's user avatar
6 votes

Why does one need a strong password on Unix?

I think the question should be "Why NOT use a strong password". In my opinion, a strong password is the foundation of any secure system. You mentioned some safeguards, but you forgot some other ...
Ricardo Reimao's user avatar
6 votes
Accepted

Way to properly escape user input which gets run by shell_exec() in PHP?

The function escapeshellarg safely quotes a value (including escaping quotes in the name, etc) so that it can be used as an argument in a command string passed to a shell. $user_input = $_POST['...
Macil's user avatar
  • 1,491
5 votes
Accepted

Security of o=rwx with classical Unix permissions

This is not directly insecure, as long as these files and directories have the same owner than the parent directory, that there is no hard-link allowing to bypass the parent directory permissions and ...
WhiteWinterWolf's user avatar
5 votes

Always setgroups before setuid?

This almost entirely depends on whether you're temporarily or permanently dropping privileges. In the case of temporarily dropping privileges, it's actually ill-advised to call setgroups with a ...
Polynomial's user avatar
  • 135k
5 votes

Why should one use sudo?

To me, one of the biggest reasons to use sudo (as opposed to su) is to avoid the need to keep track of "the root password" for every server I administer, and change it every time someone who knows it ...
Monty Harder's user avatar
5 votes

Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"

what's to stop an attacker from compiling their own custom sudo binary that allows it to execute with any uid? There's a basic misunderstanding going on here. The program does execute, it just stops ...
Steve Sether's user avatar
  • 21.6k
4 votes

Is mosh now recommended by the security experts? (2014)

Something to keep in mind while using MOSH... Although most of us use SSH to initiate the connection, MOSH doesn't require that to make it work (SSH only kicks off a new mosh-server on the server side ...
Marcos's user avatar
  • 151
4 votes

`rsync -K`-based exploit

You are correct on the use of the -K option. But the exploit is about having different users performing the link creation and running rsync. Let's first see some rsync -K in action. Make some test ...
grochmal's user avatar
  • 5,877
4 votes

`rsync -K`-based exploit

Here's a possible attack. Start with this on sender: sender:/path/to/sourcedir └── foo@ -> /etc/ Run the rsync once and get this: receiver:/path/to/targetdir └── foo@ -> /etc/ Now change ...
Joseph Sible-Reinstate Monica's user avatar
4 votes

What is the easiest way to sandbox an application in a *NIX environment?

There is no secure, easy-to-use command line sandbox utility. Popular utilities such as Firejail can often be a cure worse than the disease, and many sandbox bypasses and privilege escalation ...
forest's user avatar
  • 66.8k
3 votes

Security of o=rwx with classical Unix permissions

Linux honors file permission on domain sockets, but there are Unix implementations that ignore permissions on the socket file (e.g. BSD, HP-UX). A portable program that depends on filesystem ...
Lie Ryan's user avatar
  • 31.4k
3 votes

Why should one use sudo?

The reason not to run as root is that by using sudo you're making a conscious decision to run one particular command as root. Running as root allows for a careless typo to ruin your day.
just some user's user avatar
3 votes

How can I protect myself from this kind of clipboard abuse?

What I do to protect against this is use bracketed paste mode. Like Stéphane said, zsh and urxvt support it by default. If you limit yourself to only pasting when in a zsh prompt in urxvt, the only ...
JoL's user avatar
  • 252
3 votes

How can I protect myself from this kind of clipboard abuse?

It goes a lot deeper than embedded line edits where you would at least see what ended up happening; or at least see that something was being hidden. I could post a benign-looking code fragment like ...
sh1's user avatar
  • 133
3 votes

How to view all SSH authorized_keys for a unix server

IMO it's a good idea to also check the ~/.ssh/authorized_keys2 file. From https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2: For backward compatibility ~/.ssh/authorized_keys2 ...
coffeemakr's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible