Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

Linux is a free software operating system kernel similar to Unix kernels. It provides standard Unix-style discretionary access control, with the ability to use mandatory access control. The name “Linux” more often than not means a Unix-like operating system based on the Linux kernel: a Linux distribution. Although Android is based on a Linux kernel, the rest of the system is very different.

The basic resource model is 'everything is a file' with support for the usual Unix filesystem permissions, and some support for more flexible access control lists. The roles are described in terms of users (who are typically either physical users or system services) and groups. The permissions of an application are those of the user executing it. There are more advanced security frameworks for Linux, including AppArmor , grsecurity , SELinux , Smack , Tomoyo .

The basic firewall manipulation tool is iptables. The common methods of privilege elevation are su and sudo.

BackTrack is a Linux distribution tailored for penetration testing .

For functional questions (“How do I use this tool which is not specifically a security tool?”), try asking on our sister site Unix & Linux.

2131 questions
36
votes
2 answers

What does ENV (“_”) do for anti-debugging?

I'm reading some PPT and it says ENV("_") can be used for anti-debugging in Linux Does anyone know what it means?
daisy
  • 2,067
  • 7
  • 31
  • 44
32
votes
2 answers

What does enabling kernel.unprivileged_userns_clone do?

This message was sent to my websocket: echo kernel.unprivileged_userns_clone = 1 | sudo tee /etc/sysctl.d/00-local-userns.conf Is it dangerous, and what would it do? Thanks for your feedback everyone, chances are it was someone trying to install…
Baa
  • 423
  • 1
  • 4
  • 6
27
votes
5 answers

Why do I need the root password when mounting an internal drive in Linux?

What is this restriction for in terms of safety? And when connecting external drives via USB, the root password is not required. I can't understand the logic. I use the following rule in the fstab to connect the internal drive at runtime: LABEL=disk…
NewLinux
  • 685
  • 1
  • 6
  • 9
17
votes
3 answers

What are the security implications of systemd compared to systemv init?

I'm just beginning to learn about the init system, so I only know about the high level characteristics of both. I have noticed a lot of fuss over systemd, even some people claiming that systemd was created to purposely introduce vunerabilities! The…
David Sainez
  • 273
  • 2
  • 7
16
votes
8 answers

Why is it possible for the root user to delete the logs?

I always thought the greatest benefit of the logs is to confirm to you that your machine has been hacked. However I see hackers bragging about "rooting" servers all over the Internet. Whats stopping a hacker with root access from deleting the logs…
Ulkoma
  • 8,773
  • 17
  • 68
  • 96
15
votes
2 answers

What are the dangers of using niche Linux distributions?

Ubuntu, openSUSE and Fedora can be considered mainstream. In comparison distributions such as Solus, MX Linux, antiX, Void and others could be classed as niche. Mainstream distributions are typically backed by corporations such as Canonical, IBM or…
fenixleon
  • 301
  • 2
  • 7
14
votes
2 answers

Issues with preserving $HOME on sudo

On Ubuntu, the default behavior with sudo is to preserve the user's $HOME environment variable, which means that sudo will be able to read the dot files in the user's home directory. I enjoy this most notably because, when I need to edit a text…
Sam King
  • 473
  • 4
  • 9
12
votes
1 answer

Store shell history in block chain

Would it be possible to securely store all issued shell commands (.bash_history etc) in a block chain to prevent users from modifying their history? I'd be interested in implementing this for several multi user systems, though I wonder why no one…
Moritz Friedrich
  • 1,495
  • 2
  • 10
  • 10
10
votes
2 answers

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down the security group such that there are no…
Drew Khoury
  • 431
  • 3
  • 10
9
votes
1 answer

Securing restricted shell environments

I've read a few things to indicate that restricted shells can be broken out of if not implemented properly (even wikipedia, for instance). I'm looking for some guidance on what causes security holes in restricted shells and how to solve these…
Demelziraptor
  • 191
  • 1
  • 4
9
votes
2 answers

Why is the mount option "hidepid=2" not used by default, is there a danger in using it?

While searching for an answer to the question "how to hide command arguments from ps/proc etc", I came across the hidepid mount option, which hides a user's own processes from another user (of course also command args launched from another…
NewLinux
  • 685
  • 1
  • 6
  • 9
8
votes
7 answers

is it possible to keep something invisible to the server admin?

Let's considering the following scenario, an investment firm runs a computer cluster(using red hat as os), some computation which involves some company's trading secret will run on it, there is a SA who is responsible for maintaining the cluster,…
user2188453
6
votes
1 answer

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but discoverable with find.
hotips
  • 589
  • 6
  • 13
6
votes
1 answer

Is there any security risk allowing regular Linux users to run arbitrary code?

I'd like to allow untrusted users to run arbitrary Node apps. If I use iptables to block everything except trusted servers, make each user's home folder only visible to them, and use runuser to start their server, is there any risk of them accessing…
5
votes
2 answers

SSH: Security of Pubkey Authentication vs Password

Why is Pubkey Authentication considered more secure than a password, and does this apply to my situation (described in more detail below)? I'm a scientist (no formal IT training), but I built and administer the small network for my research group.…
Mesosphere
  • 53
  • 3
1
2 3 4 5