On 2014-12-17 09:06, DMakowecky wrote:
>
> Hello again.
Hello, hello. Long time no see.
I should mention that you can not expect us to remember all the details,
last time you posted was 3 months ago. And the previous chunk was on June.
> Firstly, I would like to say that the numlock key turned off when
> entering a password. If I pushed the numlock button twice it would turn
> back on. Not flash - sorry if I stated that wrong.
It doesn’t matter.
I have not seen any link to a security report where they document that
kind of behaviour. Blink, flash, switch off…
However, it is possible that something (web page, program?) disables the
numeric keypad or enables it the instant a password entry box is
activated, to avoid people entering wrong keys. I have not read about
such a feature, but it might be.
Some web pages want you to click pin numbers on the display and ignore
the keyboard, because the physical keyboard is easy to hack (if the
attacker can hook cables).
But malware doing it, I have not heard of it. What for? So that you can
detect its presence?
> I have tried to segregate any important data from potential hackers by
> creating a browser user and also enabling home directory encryption
> using the cryptconfig command. The command seemed to work (a copying
> files message appeared), but I got a message that file stat failed. I
> also enabled the pm-mount option to auto-load into the users encrypted
> image file system. But, now I can see into the main user directory from
> the browser user I set up and vice versa without using sudo. But I used
> the sudo command to create both encrypted file system images.
Sorry, I’m lost.
> Is there
> any way to disable one user from being able to see into another users
> files? Did I do this wrong? Is there any explanation on the order of the
> steps and anything to avoid doing, etc. (The documentation is pretty
> sparse.)
It is sparse because it is common unix knowledge decades old. It has not
changed. Any unix/linux book explains it. You only have to set the
directory and files permissions right. By default in openSUSE other
users can read other homes. Change it.
If you need help on this specific question, please post in the
application forum a question about only this. Or read a book 
> I can copy the data out of the .img file system and start over - if
> needed. How do I tell if the encrypted image is being used? It seems to
> mount all users file systems, not just the logged in user. This is NOT
> what I wanted. (A problem might be that when I re-installed OS v13.1 I
> kept the home partition so there may be old users config info left. I
> thought I cleaned it all out but I may have missed something.
Depends on what you did. If you want other people homes not to be
mounted, you have to give them different mounts, possibly different
encrypted storages.
If you used a single encrypted home, every user has access while the
system is mounted.
And remember that encryption only protects you while the computer is
OFF. Tme minute you start it and give the password, the disk is readable
to any one with permission, password or not. Specially to malware.
> Also, while I was entering the pm-mount options for the second user
> (browser) the numlock key turned off, so the original hacker/key-logger
> problem is back.
We need some official report of such a key-logger attack to believe it.
You are the only one giving some vague descriptions, separated by months
of silence.
–
Cheers / Saludos,
Carlos E. R.
(from 13.1 x86_64 “Bottle” at Telcontar)