Hot answers tagged

39

Your question is a bit vague, but you seem to be asking about the principle of least privilege, which basically says that a system is most secure when each piece only has the permissions necessary to do its own tasks. This limits the possibility of damage from mistakes or malicious actions. An ordinary user typically does not need to be modifying ...


18

The technical concept you're looking for is known as Privilege Separation. With this concept, each program uses the privileges granted to the user running the application, which is enforced by the operating system's security modules. When a user needs to do something that's outside of their normal privileges, the system challenges the user in order to grant ...


14

You can configure PAM to do this for you. Just open /etc/pam.d/common-password and append use_authtok to the first password line (the one which calls the pam_unix module) so that it looks somewhat like this: password [success=1 default=ignore] pam_unix.so obscure sha512 use_authtok Now add this line above the previously modified line: password ...


10

What is BadLock Badlock is a bug that affects Windows and Samba. What Can hackers do with this security bug? Two things: Man-in-the-middle (MITM) attacks: Denial-of-Service (DoS) attacks: The Badlock CVE is: CVE-2016-2118. There are additional CVEs related to Badlock. Those are: CVE-2015-5370 (Multiple errors in DCE-RPC code) CVE-2016-2110 (Man ...


9

That is interesting that the / actually allows 777 permissions to be set on it. The / folder should not have 777 permissions, as this means that any user logged into the system can create files and folders at the / root level. I have tested this in a VM and you CANNOT delete any of the folders or files that are not 777 without being sudo, root or the ...


7

No, the password is only stored in /etc/shadow and, even there, it is stored salted hash. This means that even if they have the original password hash, it is very very hard to get the actual password from it. You would have to brute force it and, if it is even possible, it would take a long time and far more resources than anyone would be willing to expend ...


6

Given you have sufficient permissions, the find commands will recursively change the permission bits of all files to 660 and all directories to 770 starting from the directory where it is run. As you were in /root (root's home directory) and assuming you were running as root and the owner user:group is root:root, this should not be a major problem except ...


6

No. It's not safe for / (the root directory) to have 777 permissions. That means rwxrwxrwx, i.e., every user has write permission to the root directory. With that permission, every user will be able to create new subdirectories, delete existing subdirectories, and replace existing subdirectories. For instance, a malicious user could delete /bin (by ...


6

/ should not be world-writeable / being world-writeable can be a huge problem. Having write permissions on /, any user can move/rename any file or directory in /. This means that any user can replace /etc, /usr or any of the other directories in / with directories of their choosing. Denial of Service: Trivial Any user can trivially DoS your system, by ...


5

You are better off creating a fresh VM, recreating the bug, then send that fresh copy to the developers, with nothing of value to you in what you send them. If you consider all the possible places you can get random text strings saved (shell history, auth.log, compressed logs, etc.), you will still have doubts that you thought of them all, or checked ...


3

Unfortunately, no; last access time is the only thing that can help you and it's not recorded by default on FAT filesystems (if you try with stat, you'll find a semi-fake number, based on last mount I think): θ64° [romano:/media/romano/PEN8G] % stat present.pdf File: ‘present.pdf’ Size: 291235 Blocks: 576 IO Block: 4096 regular file ...


3

As I understand it, it only means that as long as you use X11 Snap doesn't provide any additional security over using e.g. apt packages. So you will need to remain just as careful about your software sources as before. When running on Mir, supposedly Snap provides much better isolation between applications (sandboxing), which could provide more security ...


3

First and foremost, I believe there isn't any encryption which can be deemed 100% secure. The reason for that is, it is human made. Despite that the evolution of hardware in the past 20 years has prooven that nothing is secure forever. Best example is here the long time deemed secure md5 one way encryption. But back to your question, your best security is ...


2

Xenial Xerus now has a newer version of irssi: andrew@athens:~$ irssi --version irssi 0.8.19 (20160323 0008) This version has built-in support for SASL and has been set to reject the cap_sasl.pl script with the error message in the question. Easy enough to fix by closing irssi and removing the script and links to it: mv -v ...


2

The easiest and most fail safe way will be to save your files in password protected archive files, 'zip' being the most popular archive file format supporting such protection. This format is supported directly in most OS's including Ubuntu and Windows, without installing any other applications. If you want complete drive encryption you'll have to install a ...


2

It depends on your privacy concerns... Your username and hostname could be used by someone who cracked your wifi as a "hint" to access your samba/netatalk shares. It can reveal some info about you depending on how you named the host and your username... But these are not a system vulnerability, but a privacy concern. I, personally, change my hostname and ...


2

In normal cases where you want a stable deployment of lets say LAMP and all what comes with it in production environment security updates are sufficient. You need to change the /etc/apt/apt.conf.d/10periodic file to this: # switches on the apt get update run 0 for off APT::Periodic::Update-Package-Lists "1"; # lets the server pre download available ...


2

See here for the Ubuntu security update packages: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1569497 Took a little while to get published, but a hell of a lot easier than patching 3.6.3 up to 3.6.25 and applying the official patches on top of that. NB: I tried to build 3.6.25 from source on precise and failed. YMMV.


2

Ubuntu is affected the same way as the other vulnerable OSs: Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. In other words, Ubuntu is as exploitable as the the rest of the systems running the vulnerable Flash plugin. Flash for Linux has ...


2

I would personally suggest a piece of software called OSSEC HIDS (Host Intrusion Detection System) which if configured properly (which is reasonably easy to do so, just follow the installer) will regularly send you system and security related information such as what is listening on which port, if the hashsums of any important files have been changed, when ...


2

That command locates all of the directories from within the directory that you ran the command and modifies its permissions. It then does the same but with files. In this case, the command changes the permissions of the directories so that you have full access but other users will not have any access. If you are the only user of the system, then this should ...



Only top voted, non community-wiki answers of a minimum length are eligible