4

can localhost be spoofed?

view full story
linux-howto

http://serverfault.com – Is it possible for a remote machine to access another machine's localhost data by spoofing the loopback ip? Say if I wanted a setup where if I'm connecting from somewhere outside my own network, I will have to supply login credentials and my password will be required for all sensitive operations. However, if I am connecting from my computer, these credentials aren't needed because I have to login to my OS to access the network on that device anyway. Can I rely on the loopback address as a security measure in this way? Or is it possible for an attacker to make it appear as though they are conn (HowTos)

u85500's picture
Submitted by u85500 on 07/26/2012 – Made popular on 07/26/2012

Stories similar to can localhost be spoofed?

So in theory, if a person needs valid credentials for an Amazon server, instead of hardcoding in their access key/password, one can call out to 169.254.169.254 for credentials to access certain resources like so:

js = '' open('http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>') { |f| f.each_line {|line| js += line} } credentials = JSON.load(js)

n

During my experiments with VPS (11.10 x86) I meet some problem with remote access to my machine.

After installing the system, I'm able to login via Putty from Windows machine (default account with root privileges) with password.

In next step I've created new user:

adduser gsa

After that I've tried to login via ssh:

ssh gsa@localhost

and everything works correctly (so password is correct).

Hello!

Here's my situation:

I run a webserver Apache2, php5, and MySQL. They are all set up correctly and I can access my website at http://localhost

I have, also installed, noip2 to update my IP address to no-ip.com for my domain name.

Here's the problem: I can access my website through that domain name on other computers, both on internet and on the same network.

When i try to login to Nagios in my web browser and after having repeatedly enter my login and password on my Nagios page http://127.0.0.1/nagios/, i get this :

Authorization Required

This server could not verify that you are authorized to access the document requested.

I guess this would be the appropriate place to ask this sort of question. At university, our IT staff has set up network profiles, where you can use the same login credentials to gain access to any school-run computer terminal.

I wish to connect my machine to a server in some other city.

On a LAN each computer is assigned a different IP address each morning. When I installed Kubuntu 12.10 the IP address assigned to the machine was '10.0.0.2', but today it is '10.0.0.1'. When I try to connect to 'http://127.0.0.1' in a web browser I see in the status bar 'Connecting to 10.0.0.2'.

My problem is how to access guest VM from outside network. I am going to describe my problem in details.

I have single machine with Ubuntu Server 12.04 LTS contains two NICs. One NIC is connected to my gateway(i.e. 10.0.0.1) and 10.0.0.3 is IP address of this interface. Another NIC has IP 192.168.0.3 but this is a part of Bridge(i.e. br0).

We have Machine A (my Linux laptop), Machine B (a jump station server for access to internal network machines) and Machine C (the machine I want to access on the internal network). Is it possible to run a PERL Net::Expect script on Machine A and have it login to Machine C going through Machine B without having to login to Machine B? Basically is this possible through ssh tunnelling?