Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Unix is a family of multiuser, multitasking operating systems found on many servers, workstations, network equipment and other embedded devices. Unix variants include , , , , and more. Use the tag for questions that are about Unix-like systems in general; if your question is about a specific operating system (Linux, OpenBSD, …), use the tag for that system. For functional questions (“How do I use this tool which is not specifically a security tool?”), try asking on our sister site Unix & Linux.

In the core Unix security model, roles are described in terms of users (who are typically either physical users or system services) and groups. The permissions of an application are those of the user executing it. Some programs run with elevated privileges through the setuid/setgid mechanism.

Resources such as data files, programs and devices are accessed through files. In the traditional Unix model, each file has an owner and group, and the owner, group and others are granted separate permissions (read/write/execute). Many modern Unix systems provide access control lists and other extensions to the basic model.

151 questions
1
vote
3 answers

Grep Commands with User Input

I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string. I could accomplish this solely with PHP but grep should be…
FamousAv8er
  • 299
  • 1
  • 8
1
vote
1 answer

Feeding entropy pool with my own data

Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my system. Questions: How could I feed this file to the OS…
Algiz
  • 111
  • 2
1
vote
1 answer

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-execute permissions to deployer user for directory…
1
vote
0 answers

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret passphrase1 that most regular users of the applications…
kjo
  • 1,043
  • 2
  • 9
  • 15
1
vote
3 answers

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the policy and, for example, grant access to files that…
user134167
  • 141
  • 1
  • 3
  • 8
1
vote
1 answer

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user :…
user192382
1
vote
1 answer

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such that the malicious ls executes instead of the one…
Gian
  • 25
  • 4
1
vote
2 answers

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL certificates, malware detection (using a range of…
Lewis Browne
  • 111
  • 3
1
vote
1 answer

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a group called dba, and added the user to that…
KItis
  • 111
  • 3
1
vote
1 answer

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it production ready as standard? By that I mean can I…
BugHunterUK
  • 287
  • 2
  • 11
1
vote
1 answer

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size, etc). Create a micro server that will only…
Ronen Ness
  • 125
  • 5
1
vote
1 answer

Gaining shell access on a Unix Webserver

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now. I have access to the web admin console but have not been able to find any RFI vulnerabilities.…
Neel
  • 143
  • 1
  • 4
1
vote
1 answer

What is the rationale for calling setgroups on a list of length one?

The Secure Programming Cookbook for C and C++ says that: "Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. Therefore, if a process with superuser privileges is…
Kaz
  • 2,303
  • 16
  • 17
0
votes
1 answer

SSL certificate appending

On my Linux server I have a keystore which contains SSL certificates and these certs are going to expire in 20 days. Before expiry of old certs, I have installed new SSL certificates to avoid any impact after expiry of old certs. I have below…
shinek
  • 187
  • 1
  • 1
  • 4
0
votes
2 answers

"Shell shock" - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if binary does not execute bash directly, and does not…