• 0 Posts
  • 46 Comments
Joined 3 months ago
cake
Cake day: June 21st, 2024

help-circle
  • Just one open source example … freeradius has an option to log passwords:

    log {
        destination = files
        auth = no
        auth_badpass = no
        auth_goodpass = no
    }
    

    Or another example: The apache web server has a module that dumps all POST data, with passwords, in plain text:

    mod_dumpio allows for the logging of all input received by Apache and/or all output sent by Apache to be logged (dumped) to the error.log file. The data logging is done right after SSL decoding (for input) and right before SSL encoding (for output). As can be expected, this can produce extreme volumes of data, and should only be used when debugging problems.

    I don’t agree that this is “absolutely malice”, it could also be stupidity and forgetfulness.








  • I believe there are several Linux-related topics that could be valuable for this cybersecurity community. While I’m not a Linux expert, here are a few suggestions:

    • Security features in the Linux kernel: An overview of features like ASLR and cgroups, including their strengths and limitations.
    • Securing Linux servers: Practical guides, how-tos, and tools (e.g., Auditd, Sysdig) for hardening Linux systems.
    • Vulnerabilities and detailed writeups: Sharing in-depth analyses to learn from real-world mistakes. (But please, let’s avoid posting every CVE. 😉)