Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Unix is a family of multiuser, multitasking operating systems found on many servers, workstations, network equipment and other embedded devices. Unix variants include , , , , and more. Use the tag for questions that are about Unix-like systems in general; if your question is about a specific operating system (Linux, OpenBSD, …), use the tag for that system. For functional questions (“How do I use this tool which is not specifically a security tool?”), try asking on our sister site Unix & Linux.

In the core Unix security model, roles are described in terms of users (who are typically either physical users or system services) and groups. The permissions of an application are those of the user executing it. Some programs run with elevated privileges through the setuid/setgid mechanism.

Resources such as data files, programs and devices are accessed through files. In the traditional Unix model, each file has an owner and group, and the owner, group and others are granted separate permissions (read/write/execute). Many modern Unix systems provide access control lists and other extensions to the basic model.

151 questions
4
votes
4 answers

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process from causing too much harm. But what mechanism…
Nathan Long
  • 2,624
  • 4
  • 21
  • 28
4
votes
1 answer

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it should be the rwx, right? For example: > touch…
rj487
  • 143
  • 5
4
votes
1 answer

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of applications applications using a localhost port to…
4
votes
2 answers

Security issues with an append-only log in UNIX

I'm going over past exam papers for a security module I'm taking at university and there is a question which I can't give a great answer for. As a security manager in a bank you are asked to implemented an "append-only" log system in Unix for all…
Peanut
  • 1,019
  • 1
  • 8
  • 22
4
votes
1 answer

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor Joe's WordPress based site and has dropped a…
JBirch
  • 151
  • 3
4
votes
2 answers

Is it safe to expose a logging socket endpoint in a chrooted environment?

I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head. Using match I can select which users can use the…
azzid
  • 143
  • 4
3
votes
2 answers

How to track down and remove Mac malware that is calling out?

Little Snitch periodically brings up a dialog that says: Terminal via node wants to accept an incoming connection from X on port 3000 (remoteware-cl). X are different IPs in eastern europe. A full Sophos system scan did not find the malware. I can…
John
  • 31
  • 2
3
votes
1 answer

Unauthorized file writes on Linux

Suppose my web browser or any other web-connected app has a minor security hole that won't allow an attacker to run code but will allow them to write a piece of text into a text file I own. On a typical Linux distro however, certain text files, such…
PSkocik
  • 270
  • 1
  • 8
3
votes
3 answers

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting Nmap 6.00 ( http://nmap.org ) at 2015-06-04 22:43…
Toni
  • 207
  • 1
  • 2
  • 8
3
votes
2 answers

What's there to harden for a home Unix-box behind Comcast cable modem?

I'm learning that much of the security advice I come across under the "hardening" heading simply does not apply to a single-user home desktop box sitting in a private wireless IPv4 LAN behind a Comcast cable modem. Furthermore, FWIW, this system is…
kjo
  • 1,043
  • 2
  • 9
  • 15
3
votes
4 answers

What RHSA, RHEA and RHBA stands for in the RedHat Erratas?

Do you know what does RHSA, RHEA and RHBA stands for in RedHat Errata ?
Vladimir Leiv
  • 897
  • 3
  • 8
  • 14
3
votes
5 answers

Why can't just any program use his own file-system-access-system?

This may sound stupid for everyone who knows more than me about the UNIX-System and security in software: Imagine you have a program trying to cause harm by deleting files. You just do something like "rm -rf /home/" and get an error message, because…
kono
  • 31
  • 2
3
votes
0 answers

BSD encryption advantages

If someone who knows about the BSD project has a moment to answer this, I'm wondering a few things about the encryption used. It's more than what I'm finding in the docs and on Wiki/Google (even the OpenBSD crypto page didn't seem to cover…
stackuser
  • 421
  • 1
  • 3
  • 7
3
votes
1 answer

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password system? Or is there another better alternative?…
3
votes
3 answers

Create netcat listener and execute reverse shell in the same script

I'm coding an exploit in python that exploits a command injection vulnerability for a CTF and I'm wondering how could I start a netcat listener and then send the payload to the remote host and once the connection is stablished the script execution…
Nucklear
  • 429
  • 3
  • 6
  • 11