Did you try **`passwd -d root`**? Most likely, this will do what you want.


----------


You can also manually edit `/etc/shadow`: (Create a backup copy. Be sure that you can log even if you mess up, for example from a rescue system.) Search for &quot;root&quot;. Typically, the root entry looks similar to 

    root:$X$SK5xfLB1ZW:0:0...

There, delete the second field (everything between the first and second colon):

    root::0:0...

Some systems will make you put an asterisk (*) in the password field instead of blank, where a blank field would allow no password (CentOS 8 for example)

    root:*:0:0...

Save the file, and try logging in as root. It should skip the password prompt. (Like `passwd -d`, this is a &quot;no password&quot; solution. If you are really looking for a &quot;blank password&quot;, that is &quot;ask for a password, but accept if the user just presses Enter&quot;, look at the manpage of `mkpasswd`, and use `mkpasswd` to create the second field for the /etc/shadow.)

Can I know what are the differences between each `Exec`, `ExecWait`, `ExecShell`, `nsExec::Exec`, `nsExec::ExecToLog,` `nsExec::ExecToStack`, `ExecDos` and `ExecCmd`, as in when to use which?

I &#39;ve posted the various execute calls I know. I am trying to make a comprehensive list, so that it helps future visitors..

1. `Exec`: Plainly execute the called string, be it some application, console or file.

2. `ExecWait`: Executes like `Exec` but waits till the process exits.

3. `ExecShell`: **What is it for?**

4. `nsExec::Exec`: Just like `Exec` or `ExecWait` but only for command prompt and that too without opening the console window. I am unsure if it waits for process to exit. **Does `nsExec::Exec` wait for child process to exit?**

5. `nsExec::ExecToLog`: `The documentation says ExecToLog` is similar to plain `nsExec` but it outputs to log window. **What does that mean, what is a log window?**

6. `nsExec::ExecToStack`: The documentation says `ExecToStack` is similar to plain `nsExec` but it pushes output to stack. I get that.

7. `ExecDos`: Same as `nsExec::ExecToStack` but it additionally (**Is it not**?)

 a. takes string parameter that serves as stdin for running application.

 b. works in both sync/async mode.

 c. it works out of section - for .onInit check outs.

8. `ExecCmd`: Same as `ExecDos` but it doesn&#39;t require these


        ExpandEnvStrings $3 %COMSPEC% 
        ExecDos::exec  /C 


 parts. **Am I correct?**

Exec vs ExecWait vs ExecShell vs nsExec::Exec vs nsExec::ExecToLog vs nsExec::ExecToStack vs ExecDos vs ExeCmd

I have been looking at SignalR from last few days. Using this I have created an Admin Dashboard to get realtime information about a database table. Basically this table gets populated by may different users from various applications. It has come out well. These updates are possible only when there is persistent connection between client Broswer and WebServer. I have few doubts before deploying this app in production.

I understand that SignalR first checks WebSockets then looks for Long Polling based on there availability between client and server. No matter what it uses, there will be a connection open between client and server. 

My question is how does it perform in scenario where more users are connected to the same server for example  100,000 admins are connected at same time. Does IIS has any limitations on number of persistent connections it can open at one point? If so can we configure to that to max value and what wud be that value.

Sorry if it is rookie question

ASP.NET MVC3 &amp; IIS 7 are used for development.

While using signalr, will there be any connection limits on IIS

I am running slitaz distro, and would like to completely remove the root password. I have tried giving a blank password to the `passwd` command, however that did not seem to do the trick. It gave me an error password was too short, ans it still asked me for a password when I ssh-ed in. The password was just hiting the &quot;Enter&quot; key.

**UPDATE:**  
Perhaps it has to do with the fact that slitaz uses dropbear for ssh? Because even with a blank password for root in `/etc/shadow`, it still prompts for a password.

How do I set a blank password for the root user in slitaz

I am running slitaz distro, and would like to completely remove the root password. I have tried giving a blank password to the <code>passwd</code> command, however that did not seem to do the trick. It gave me an error password was too short, ans it still asked me for a password when I ssh-ed in. The password was just hiting the "Enter" key.
UPDATE: 
Perhaps it has to do with the fact that slitaz uses dropbear for ssh? Because even with a blank password for root in <code>/etc/shadow</code>, it still prompts for a password.

Setup : Ubuntu Server on Virtual Machine with 6 cores and 3GB of RAM.

when I am trying to generate a `asymmetric key pair` via `GPG` like this `gpg --gen-key` . I get the following error :

    Not enough random bytes available.  Please do some other work to give
    the OS a chance to collect more entropy!
I tried to google a little bit. This is what I realise , 
I need to fire up another terminal and type in `cat /udev/random` --&gt; It randomly generates a series of randomly generated values to increase the entropy. 

I dont see any change in here `watch cat /proc/sys/kernel/random/entropy_avail`

and it still persists to give me the same error


PGP: Not enough random bytes available. Please do some other work to give the OS a chance to collect more entropy

I&#39;d like to add to PATH the value &quot;:/home/me/play/&quot;  
for the installation of Play! framework.  
so I ran this command:  

    PATH=$PATH:/home/me/play

it worked. but in the next time I checked, the value changed back to the old one.  

so I guess I didn&#39;t &quot;saved&quot; the new value, right?  

how do you do that?  

change PATH permanently on Ubuntu

How can I see the size of files and directories in Linux? If use `df -m`, then it shows the size of all the directory at the top level, but, for the directories and files inside the directory, how do I check the size?


linux command to get size of files and directories present in a particular folder?

I have a file in Linux, I would like to diplay lines which contain a specific string in that file, how to do this?

How to find lines containing a string in linux

I am testing Python threading with the following script:

    import threading
    
    class FirstThread (threading.Thread):
        def run (self):
            while True:
                print &#39;first&#39;
    
    class SecondThread (threading.Thread):
        def run (self):
            while True:
                print &#39;second&#39;
        
    FirstThread().start()
    SecondThread().start()

This is running in Python 2.7 on Kubuntu 11.10. &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt; will not kill it. I also tried adding a handler for system signals, but that did not help:

    import signal 
    import sys
    def signal_handler(signal, frame):
        sys.exit(0)
    signal.signal(signal.SIGINT, signal_handler)

To kill the process I am killing it by PID after sending the program to the background with &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;Z&lt;/kbd&gt;, which isn&#39;t being ignored. Why is &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt; being ignored so persistently? How can I resolve this?

Cannot kill Python script with Ctrl-C

I&#39;m using passportJS and I&#39;m wanting to supply more than just `req.body.username` and `req.body.password` to my authentication strategy (passport-local). 

I have 3 form fields: `username`, `password`, &amp; `foo`

How do I go about accessing `req.body.foo` from my local strategy which looks like:

    passport.use(new LocalStrategy(
      {usernameField: &#39;email&#39;},
        function(email, password, done) {
          User.findOne({ email: email }, function(err, user) {
            if (err) { return done(err); }
            if (!user) {
              return done(null, false, { message: &#39;Unknown user&#39; });
            }
            if (password != 1212) {
              return done(null, false, { message: &#39;Invalid password&#39; });
            }
            console.log(&#39;I just wanna see foo! &#39; + req.body.foo); // this fails!
            return done(null, user, aToken);
            
          });
        }
    ));

I&#39;m calling this inside my route (not as route middleware) like so:

      app.post(&#39;/api/auth&#39;, function(req, res, next) {
        passport.authenticate(&#39;local&#39;, {session:false}, function(err, user, token_record) {
          if (err) { return next(err) }
          res.json({access_token:token_record.access_token});
       })(req, res, next);
  
      });

Using PassportJS, how does one pass additional form fields to the local authentication strategy?

I&#39;m designing a web site that will have a mobile companion (initally iPhone only). The web site will be an ASP.Net MVC 3 application. I&#39;ll also have an ASP.Net Web API site (MVC 4) to expose services to the iPhone application. The iPhone app will have its own form to capture username and password from the user and send that to the web API in JSON headers.

I want to consider security from the start rather than an after thought. *I&#39;m not a security expert by any means.* I&#39;ve done a good deal of research to see how other&#39;s are handling authentication of a mobile application client from a web service. I think I&#39;ve come up with a decent solution that doesn&#39;t involve hooking into to third party oAuths.

I would greatly appreciate any and all opinions, advice, criticism and general WTFs that any of you can offer. :)

My biggest concerns are:
&lt;ol&gt;
&lt;li&gt;Ensuring that calls made to the web API are authorized&lt;/li&gt;
&lt;li&gt;Minimizing the risk of replay attacks (hence timestamps in the calls below)&lt;/li&gt;
&lt;/ol&gt;

The iPhone app will be developed as such:&lt;br&gt;
*Two strings are hard-coded into the iPhone app (same values for every user):*
&lt;ol&gt;
&lt;li&gt;&lt;b&gt;Application ID&lt;/b&gt;&lt;br&gt;This is a string that is used to identify the type of client that is accessing the web API (iPhone, Android, Windows phone, etc).&lt;/li&gt;&lt;br&gt;
&lt;li&gt;&lt;b&gt;Application&#39;s Hashing Salt&lt;/b&gt;&lt;br&gt;This is a string that is used to salt hashes for user-agnostic requests.&lt;/li&gt;
&lt;/ol&gt;
*Two strings are stored in the iPhone app&#39;s local database (values unique to each user):*
&lt;ol&gt;
&lt;li&gt;&lt;b&gt;API User Access Token&lt;/b&gt;&lt;br&gt;This is a string (token) provided to the client by the web API upon successful authentication and allows the client to access the web API without sending the username and password in each request.&lt;br&gt;&lt;/li&gt;

&lt;li&gt;&lt;b&gt;User&#39;s Hashing Salt&lt;/b&gt;&lt;br&gt;This is a string that is used to salt hashes for requests made against established user accounts.&lt;/li&gt;
&lt;/ol&gt;
&lt;br&gt;
&lt;br&gt;
The iPhone will make calls to the web API in the following manner:&lt;br&gt;&lt;br&gt;
&lt;b&gt;API Method: Create Account&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;New Account Data (Username, Password, First Name, Last Name, etc..)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with Application&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;New User&#39;s Hashing Salt&lt;br&gt;&lt;br&gt;The idea here is that, when creating an account, I can use the application&#39;s hardcoded salt since it&#39;s not a huge security risk if that salt ever got out (through decompilation or some other means).&lt;br&gt;&lt;br&gt;
But for methods that access and modify the user&#39;s data I&#39;ll use a salt that is owned only by that user so it can&#39;t be used by an attacker to impersonate others.&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Get Account&lt;/b&gt;&lt;br&gt;(Used for getting user&#39;s hashing salt for accounts that were created on the web site but haven&#39;t yet been synced on the iPhone. This happens when a user tries to log in on the iPhone and iPhone detects that it has no record for that username.)&lt;br&gt;
&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Username&lt;/li&gt;
&lt;li&gt;Password (hashed with Application&#39;s Hashing Salt)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with Application&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;Existing User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Log In (Authenticate)&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Username&lt;/li&gt;
&lt;li&gt;Password (hashed with User&#39;s Hashing Salt)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;API User Access Token&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Any Command (i.e. Create Post, Update Profile, Get Messages, etc...)&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Command Data&lt;/li&gt;
&lt;li&gt;API User Access Token&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID + API User Access Token salted with User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;

Authenticating requests from mobile (iPhone) app to ASP.Net Web API (Feedback requested on my design)

I&#39;m setting up my PostgreSQL 9.1. I can&#39;t do anything with PostgreSQL: can&#39;t `createdb`, can&#39;t `createuser`; all operations return the error message

    Fatal: role h9uest does not exist

`h9uest` is my account name, and I `sudo apt-get install` PostgreSQL 9.1 under this account.  
Similar error persists for the `root` account.

PostgreSQL error: Fatal: role &quot;username&quot; does not exist

We have a website where the *only* way to login and authenticate yourself with the site is with Facebook (this was not my choice). The first time you login with Facebook, an account gets automatically created for you.

We now want to create an iPhone application for our site and also a public API for others to use our service.

This question is about how to authenticate with our website from the app/API and is broken into 2 parts:

1. What is the correct way to handle REST authentication from an API to a website which only uses Facebook OAuth as an authentication method?

 I have read and researched a lot about standard methods of authentication for REST API. We can&#39;t use such methods as [Basic Auth over HTTPS][1], as there are no credentials for a user as such. Something like [this][2] seems to be only for authenticating applications using the API.

 Currently, the best way I can think is you hit an /authorize end-point on our API, it redirects to Facebook OAuth, then redirects back to the site and provides a &#39;token&#39; which the user of the API can use to authenticate subsequent requests.

2. For an official application that we create, we wouldn&#39;t necessarily need to use the public API in the same way. What would be the best way then to talk to our website and authenticate users?

I understand (I think) how to authenticate 3rd-party applications that are using our API, using API (public) keys and secret (private) keys. However, when it comes to authenticating the user who is using the app, I am getting rather confused about how to go about it when the only way we have to authenticate a user is Facebook.

I feel like I&#39;m missing something very obvious, or don&#39;t fully understand how public REST APIs should work, so any advice and help would be greatly appreciated.


  [1]: https://stackoverflow.com/questions/7919533/rest-api-authentication-tokens
  [2]: http://acaasia.blogspot.com/2013/04/designing-secure-rest-web-api-without.html

REST API for website which uses Facebook for authentication

Assuming that I&#39;m trying to pull from a RESTful api that uses basic authentication / basic certificates, what would be the best way to store that user name and password in my program?   Right now it&#39;s just sitting there in plaintext.

    UsernamePasswordCredentials creds = new UsernamePasswordCredentials(&quot;myName@myserver&quot;,&quot;myPassword1234&quot;);

Is there some way of doing this that is more security minded?

Thanks

Handling passwords used for auth in source code

I am using Linux, Oracle10g.
I have created one user called test. and granted create session and select any dictionary permission to the same user.

i also granted sysdba and sysoper roles to the same users.

Now i want to display all the privileges and roles granted to the user. 
I found following query but it shows only create session and select dictionary privileges.

    select privilege 
    from dba_sys_privs 
    where grantee=&#39;SAMPLE&#39; 
    order by 1;

please help to resolve the issue.

Thanks

 

Content Type	Original Author	Original Content on Stackoverflow
Question	Plazgoth	View Question on Stackoverflow
Solution 1 - Linux	tiwo	View Answer on Stackoverflow

How do I set a blank password for the root user in slitaz

Linux Problem Overview

Linux Solutions

Solution 1 - Linux

While using signalr, will there be any connection limits on IIS

Exec vs ExecWait vs ExecShell vs nsExec::Exec vs nsExec::ExecToLog vs nsExec::ExecToStack vs ExecDos vs ExeCmd

Attributions