IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [root]

76 questions
1
vote
1 answer

Does it make sense to check command integrity after running it as root?

The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied the command on the webpage, pasted it into the…
tonychow0929
  • 2,247
  • 3
  • 13
  • 14
1
vote
2 answers

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and there are entries where an attacker could easily read…
Terrible Stomper
  • 13
  • 3
1
vote
2 answers

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code on my server trough the application will this…
krionz
  • 111
  • 2
1
vote
0 answers

SUID not executing as root

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as follows: -rwsr-xr-x 1 root root 1064592 11月 25 2016…
SlimeyToad
  • 11
  • 2
1
vote
0 answers

Are unique root certificates required to have different subjects?

I've heard that in the X.509 world, the certificate subject attribute is supposed to be unique... and that if someone has multiple trusted roots with the same subject (but still different in other ways) that it is an unusual use case that needs to…
Mike B
  • 3,336
  • 4
  • 29
  • 39
0
votes
0 answers

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly access RAM chip content and inject code into the…
userdatagram
  • 1
  • 1
0
votes
1 answer

Read files protected with System Integrity Protection with sudo

I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from root users. My friend claimed that it's secure by…
Paul
  • 583
  • 5
  • 8
0
votes
2 answers

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ports but those necessary for the node to operate. I…
user267912
  • 1
0
votes
1 answer

Do I need root access to install a certificate?

I need to have security certificates renewed soon on several RedHat servers. Will I need root access to install them?
DenverGeezer
  • 1
0
votes
1 answer

Can I use root account if every server only runs one service [Debian/Ubuntu Server]

Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine instances. In this scenario, is it okay to simply use…
user129187
0
votes
1 answer

Should root certificates have OCSP or CRL for it?

Should root certificates have OCSP or CRL for its own revocation status? So here is what I mean: Intermediate Cert -> http://example.com/root.crl SAN Cert -> https://example.com/intermediate.crl But should you create a crl database for root? Root…
Example person
  • 163
  • 9
0
votes
0 answers

How should an application verify a servers certificate?

Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont really know how to do that. Do i store the full…
StillWaters77
  • 1
0
votes
1 answer

offline root CA workflow

I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question. Firstly it presumably would not be generally assessed as an 'offline' root if its key is in a network connected HSM, no…
r.l.
  • 21
  • 2
0
votes
2 answers

How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?

How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one? Tor is not a viable option because the website does not allow it. Ive…
JJrussel
  • 101
0
votes
0 answers

SOC2 and the CentOS root user

One of our customers has the following requirement: according to SOC2 they need to block access to the CentOS root account. They mean any access, even with su root or sudo su. We have blocked the SSH access, but they claim it is not enough. Do you…
Michael
  • 1,457
  • 1
  • 18
  • 36
1 2 3
4
5 6