Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
This may already be implemented in mandatory access control addons , i just have not looked.
Whenever a normal user logs in, does it have to tell them that they have logged in ttyX ?
also running top shows what root is running, is it possible to disable that so only the users processors are shown when running top?
and lastly is it possible to hide / from them, so if they try cd /, it will just return them to the current/workind directory?
i don't see any benefit at all in hiding their tty or other users processes, that's not security, that's obscurity. as for /, well you would probably be interested in looking into chroot to provide a jail for certain users in terms of the filesystem they can access.
The single biggest risk in seeing other users processes is that there
might be a password on the commandline (which is bad practice as such)
which you could then see via ps.
i don't see any benefit at all in hiding their tty or other users processes, that's not security, that's obscurity. as for /, well you would probably be interested in looking into chroot to provide a jail for certain users in terms of the filesystem they can access.
Its obscurity for the user entering the system, which is the idea , if a bad guy can see nothing, then what is he going to look for as far as running apps that may have vunerabilies?
I will look into chroot, thanks for that
The single biggest risk in seeing other users processes is that there
might be a password on the commandline (which is bad practice as such)
which you could then see via ps.
Cheers,
Tink
thats a possibility, i was not actually thinking of that.
also running top shows what root is running, is it possible to disable that so only the users processors are shown when running top?
The GRSecurity patch can confine their process view. Note you can't run GRSecurity and SELinux in the same kernel, they're incompatible.
and lastly is it possible to hide / from them, so if they try cd /, it will just return them to the current/workind directory?
Next to chroot both GRSecurity and SELinux provide finegrained ways to restrict users access.
if a bad guy can see nothing, then what is he going to look for as far as running apps that may have vunerabilies?
I guess whatever you can get exploits for, besides the kernel is always up and running...
Then again sometimes you can get lucky by just looking, like finding a copy of shadow ;-p
also running top shows what root is running, is it possible to disable that so only the users processors are shown when running top?
The GRSecurity patch can confine their process view. Note you can't run GRSecurity and SELinux in the same kernel, they're incompatible.
and lastly is it possible to hide / from them, so if they try cd /, it will just return them to the current/workind directory?
Next to chroot both GRSecurity and SELinux provide finegrained ways to restrict users access.
if a bad guy can see nothing, then what is he going to look for as far as running apps that may have vunerabilies?
I guess whatever you can get exploits for, besides the kernel is always up and running...
Then again sometimes you can get lucky by just looking, like finding a copy of shadow ;-p
thank you, i thought grsecurity or selinux would support that, now that solaris trusted extensions are open source, it would be interesting to make a port to linux and bsd.
Their label range system is very secure and proven way of working with differnt security levels, so for instance you cannot copy and paste something if the destination is lower than the source. http://blogs.sun.com/roller/page/Stephen/20060331 http://www.opensolaris.org/os/commun...y/projects/tx/
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.