08-25-2016
Maybe a security problem involving Linux hosts
Hello,
with the following problem I feel helpless because I do not know where to look for the problem.
Sorry in advance for my poor English.
At some point the interaction with people on Freenode IRC has become mysterious and offending so that I checked my modem/router device. When I tried to make a change the modem gave me the error message that another admin is logged in. It alerted me because all other computers were disconnected. So I called my ISP and they agreed that my device is listed there at "being attacked". They sent me a replacement and they also sent me a new password.
With the new modem I booted a linux livecd that i got from a linux magazine. And from there I downloaded the ISOs and wiped all my machines using DBAN.
With all the people in my social environment telling me to relax, think positive and all that stuff like "its only your false perceiption on things" I stopped paying attention on mysterious errors, etc. Until I needed the Hexchat client to check a local ircd install. And it launched with 1 network added. I am absolutely sure I had 0 networks in that network list when I went on an IRC break. Several months before there was a similar thing where all 18 or 19 networks had their name changed to EF-Net.
Another thing is that I stored all my website passwords in Lastpass and when I went offline for 3 days to install and configure some things my passphrase was changed to the one I used several months ago and all my stored passwords were deleted.
I could provide several more of these stories.
I hope none of you guys reacts now how most people reacted: "this guy is crazy, give him more meds" or something. I know it sounds crazy and it is crazy. But lets say my observations are correct where could the entry point be for an attacker?
friendly Greetings,
SInt
6 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
hey guys, i am on a box named pluto and i need to be able to log into another box named genesis. i need to be able to ssh into genesis as root and not get asked for the password. what file do i need to edit on genesis to make this happen? i searched for the .rhosts file it doesn't seem to exist.... (1 Reply)
Discussion started by: Terrible
1 Replies
2. UNIX for Dummies Questions & Answers
advance happy new year to all,
i am having a script.The purpose of the scripts is as follows.If the current month is march,june,september or december ,inc_flg should be set to '1' otherwise inc_flg should be set to '2'
month= date +"%m"
if || || ||
; then
inc_flg = 1
else
... (6 Replies)
Discussion started by: rajarp
6 Replies
3. Programming
Hello,
I'm working on an application that bridges together several applications involved in creating a video workflow for editing with digital cinema cameras. The main platform is MacOSX.
Because of the nature of some of the utilities for working with this video footage I must spoof filenames... (2 Replies)
Discussion started by: ibloom
2 Replies
4. Shell Programming and Scripting
Hi, I'm having difficulty in making a bash script to get netcat to scan a list of hosts and their ports from another file and could use some help. Here's an example host list, "nc.host":
192.168.2.110 22
And here's the first script I tried to feed "nc.host" into netcat:
"nc1.sh"
... (3 Replies)
Discussion started by: seanovision
3 Replies
5. Shell Programming and Scripting
Hi all,
I have wriiten an expect script that genearates a public private key pair through ssh-keygen and then copies that key to the authorized keys file of the remote system . The problem i am facing is when i get a password for the remote machine containg a trailing backslash , the send command... (4 Replies)
Discussion started by: pradeeptyagi23
4 Replies
6. Solaris
Am trying to copy a tar file onto a series of remote hosts and untar it at the destination. Need to do this without having to do multiple ssh.
Actions to perform within a single ssh session via shell script
- copy a file
- untar at destination (remote host)
OS : Linux RHEL6 (3 Replies)
Discussion started by: sankasu
3 Replies
LEARN ABOUT DEBIAN
pam_selinux
PAM_SELINUX(8) Linux-PAM Manual PAM_SELINUX(8)
NAME
pam_selinux - PAM module to set the default security context
SYNOPSIS
pam_selinux.so [close] [debug] [open] [nottys] [verbose] [select_context] [env_params] [use_current_range]
DESCRIPTION
In a nutshell, pam_selinux sets up the default security context for the next execed shell.
When an application opens a session using pam_selinux, the shell that gets executed will be run in the default security context, or if the
user chooses and the pam file allows the selected security context. Also the controlling tty will have it's security context modified to
match the users.
Adding pam_selinux into a pam file could cause other pam modules to change their behavior if the exec another application. The close and
open option help mitigate this problem. close option will only cause the close portion of the pam_selinux to execute, and open will only
cause the open portion to run. You can add pam_selinux to the config file twice. Add the pam_selinux close as the executes the open pass
through the modules, pam_selinux open_session will happen last. When PAM executes the close pass through the modules pam_selinux
close_session will happen first.
OPTIONS
close
Only execute the close_session portion of the module.
debug
Turns on debugging via syslog(3).
open
Only execute the open_session portion of the module.
nottys
Do not try to setup the ttys security context.
verbose
attempt to inform the user when security context is set.
select_context
Attempt to ask the user for a custom security context role. If MLS is on ask also for sensitivity level.
env_params
Attempt to obtain a custom security context role from PAM environment. If MLS is on obtain also sensitivity level. This option and the
select_context option are mutually exclusive. The respective PAM environment variables are SELINUX_ROLE_REQUESTED,
SELINUX_LEVEL_REQUESTED, and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing and the last one if set to 1 makes
the PAM module behave as if the use_current_range was specified on the command line of the module.
use_current_range
Use the sensitivity level of the current process for the user context instead of the default level. Also suppresses asking of the
sensitivity level from the user or obtaining it from PAM environment.
MODULE TYPES PROVIDED
Only the session module type is provided.
RETURN VALUES
PAM_AUTH_ERR
Unable to get or set a valid context.
PAM_SUCCESS
The security context was set successfully.
PAM_USER_UNKNOWN
The user is not known to the system.
EXAMPLES
auth required pam_unix.so
session required pam_permit.so
session optional pam_selinux.so
SEE ALSO
pam.conf(5), pam.d(5), pam(7)
AUTHOR
pam_selinux was written by Dan Walsh <dwalsh@redhat.com>.
Linux-PAM Manual 08/31/2010 PAM_SELINUX(8)