The UNIX and Linux Forums  
Hello and Welcome from United States to the UNIX and Linux Forums! Thank You for Visiting and Joining Our Global Community.

Go Back   The UNIX and Linux Forums > Special Forums > Security
.
google unix.com



Security Discuss UNIX and Linux computer and network security, cybersecurity, cyberattacks, IT security, CISSP, OWASP and more.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Pseudo-terminal will not be allocated because stdin is not a terminal. Shivdatta UNIX for Advanced & Expert Users 1 08-04-2008 10:29 AM
Don't show keyboard input on terminal marianor31 Shell Programming and Scripting 1 03-23-2007 06:54 PM
Secure FTP Problem using Sun SSH on Client system F-Secure on Server system ftpguy SUN Solaris 2 01-11-2007 12:19 PM
connecting to unix through hyper terminal - as a dumb terminal michelle UNIX for Advanced & Expert Users 2 11-05-2001 03:32 PM
How to suppress input keying from displaying on terminal. liteyear18 UNIX for Dummies Questions & Answers 2 07-19-2001 09:13 AM

Closed Thread
English Japanese Spanish French German Portuguese Italian Dutch Swedish Russian Norwegian Hungarian Hebrew Danish Powered by Powered by Google
 
LinkBack Thread Tools Search this Thread Rate Thread Display Modes
  #1 (permalink)  
Old 08-14-2008
pnp pnp is offline
Registered User
  
 

Join Date: Aug 2008
Posts: 1
Is my terminal input secure?

My knowledge of Unix input/output/devices is very hazy so could someone please tell me if the following is secure?

I log on to an account on a shared Unix server (Linux 2.6.18-6-686) using ssh (PuTTY). I start a python program and then type into it (python raw_input command) the username/password of an account on a web site it should log on to using SSL. The python executable is one I downloaded and built myself. Is it possible for someone with root privilege to see the username/password I type into the python program?

Thanks very much in advance.
  #2 (permalink)  
Old 08-14-2008
era era is offline Forum Advisor  
Herder of Useless Cats (On Sabbatical)
  
 

Join Date: Mar 2008
Location: /there/is/only/bin/sh
Posts: 3,652
Root can do anything. Don't run it on a box where you do not trust root.

(The question is not well stated, though. The problem is not in the security of your terminal input, it's in the security of where that input ends up in the memory of a remote computer whose administrator you do not trust.)
  #3 (permalink)  
Old 08-14-2008
redoubtable redoubtable is offline
Registered User
  
 

Join Date: Aug 2008
Location: Portugal
Posts: 242
era is right. On Linux, root can do anything. Just think about /dev/mem and /dev/kmem or LKM.
1. Root could create a program that would have access to all iomem and ioports.
2. Root could alter the kernel in any way so it would do anything (get out of the virtual memory and go straight to physical memory which only the kernel can touch)
3. Root could just ptrace() your terminal and see whatever you're typing.
Closed Thread

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT -4. The time now is 05:45 AM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited. Language Translations Powered by .
vBCredits v1.4 Copyright ©2007 - 2008, PixelFX Studios
The UNIX and Linux Forums Content Copyright ©1993-2009. All Rights Reserved.Ad Management by RedTyger

Content Relevant URLs by vBSEO 3.2.0