Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debian]

One of the earliest Linux distros and officially consist of only free software. Many distros has been derived from the Debian codebase, like Ubuntu and Knoppix.

0
votes
0answers
31 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
0
votes
2answers
130 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
9
votes
2answers
318 views

Remote Code Execution in apt/apt-get

Recently, a vulnerability has been found in apt that allows arbitrary code execution, see here. Is it reasonable just to update the system? Or we should be worried that this has been used and so ...
0
votes
0answers
26 views

Using the same private key for both WSL-Ansible and Putty (or WSL-OpenSSH for that matter)

I use Windows 10 home on my PC and SSHing to up to 5 Linux IaaS machines with either Debian/ArchLinux as server environments. I use Ansible to orchestrate and continuously integrate and continuously ...
6
votes
1answer
2k views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
0
votes
2answers
174 views

How does default Debian boot drive encryption works?

When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password. It looks ok, but how does it work? ...
2
votes
1answer
169 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
2
votes
1answer
202 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
3
votes
1answer
141 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
1
vote
1answer
51 views

Remove sync user to harden the system

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, ...
2
votes
1answer
85 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
2
votes
1answer
145 views

How to understand how someone had ssh access, and how to remove CVE-2017-0358

I have a home server that was compromised recently, it has been used to mine some crypto currencies. I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
1
vote
1answer
220 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
1
vote
0answers
111 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...
2
votes
1answer
529 views

How fix warnings from Debsecan

I'm new in linux admin and security approach, and need some tips about warnings from Debsecan scanner tool. I have some warnings returned by simple check, like this below: CVE-2017-1000158 python2.7-...
0
votes
1answer
252 views

Suspicious SSH connection

this is the situation: vps with debian 8x32 virgin (new template of the provider's repository); exotic "user" and strong "password" ; 30 seconds later: command (apt-get update); 30 seconds later: ...
-1
votes
1answer
157 views

Debian 9 opted out of data collection, doing it anyway?

I've noticed when I log in to my Debian 9 account, it informs me that there are updates. I update and upgrade in terminal and it informs me that 0 bytes have been downloaded but requests to upload ...
2
votes
1answer
770 views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
0
votes
1answer
115 views

chkrootkit weird output DEBIAN 9 [closed]

I recently had this in the chkrootkit output comparison : +! 7:0| 255 0:0|242:0|243:0|245:0|253:1|254:1|7:0| -stringPrefs 3:7;release|174:3;1.0|191:332; ¼½¾ǃː??։֊׃״܁܂܃܄ᅟᅠ᜵           ???‐’․‧?...
0
votes
2answers
277 views

resolv.conf: my router acts as a nameserver - a vulnerability? How to change it?

I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file: search localdomain nameserver {ipofmyrouter} I guess that these - or ...
1
vote
1answer
456 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
0
votes
1answer
41 views

Is this version of openssl vulnerable?

I have an old Debian 3.1 (kernel 2.4.19) where the version of ssl is $ openssl version OpenSSL 0.9.8c 05 Sep 2006 I read that there was some issue about random generator being guessable. https://...
0
votes
1answer
232 views

/etc/sudoers file with permissions set to 640 instead of 0440: what does it mean?

So I'm still new to GNU/Linux: recently I installed Debian 9.1 with KDE. Now after executing: stat --format '%a' /etc/sudoers I found out that my sudoers file has the 640 permissions instead 0440 ...
2
votes
1answer
1k views

ClamAV findings under Debian 9: LibreOfficeMacros and PUA.Win.Exploit.CVE_2012_0110-1 - false positives?

I'm running a recently installed Debian 9.1 with KDE and a ClamAV scan gives me these findings: /usr/lib/libreoffice/share/extensions/wiki-publisher/WikiEditor/Module1.xba PUA.Doc.Tool....
1
vote
0answers
262 views

Frequent heavy CPU load from firefox browser -> malware? [closed]

Since recently I started to get very heavy CPU load on my 64bit Debian 9.0 Cinnamon machine. I have all my packages up to date including Firefox-ESR. Often the load is so heavy that I can hear my CPU. ...
0
votes
1answer
95 views

secure the code of a server physically rented to the client

My company rents a Debian server to the clients, that they have to connect to their own network. The server provides various services, an administration interface, and connects to the online service ...
6
votes
2answers
426 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
5
votes
1answer
2k views

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

According to NIST and HIPAA guidance, I miss one cipher on a new web server: TLS_RSA_WITH_3DES_EDE_CBC_SHA Despite I read this one is discouraged, I am curious as to how do I add it? I am on Linux ...
8
votes
2answers
6k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
1
vote
1answer
123 views

Is there a way to ask cracklib-check to go through a list of passwords?

I know cracklib-check can be used to check individual password, like - $ echo "12345" | /usr/sbin/cracklib-check 12345: it is too short If not wanting to be super-user as on Debian it requires to ...
1
vote
2answers
198 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
2
votes
4answers
2k views

Unauthenticated packages in debian

Yesterday I updated my debian server using: apt-get update && apt-get upgrade I received message that some of the packages cannot be authenticated being in a rush I hit yes to install ...
1
vote
1answer
447 views

protect c ++ application via an automatic hardware binding

I have a Qt App which is running on a raspberry pi (Debian Wheezy). The raspberry image is autogenerated via a python script: - Get the latest version of the generic custom-raspi-image - Mount the ...
1
vote
0answers
176 views

Vulnerable Keys? CVE-2008-0166 openssl DSA Key Signature Blacklist coverage?

Would the current set of DSA key blacklists detect a DSA key that was generated with openssl on an affected/vulnerable system, BUT whose DSA parameters (dsaparam) were generated on an unaffected ...
5
votes
1answer
635 views

All weak Debian openssl DSA keys

More weak keys? 32768 weak keys can be downloaded for analysis, but are there more? Three times as many? There is much information about DSA-1571-1 openssl -- predictable random number generator. ...
0
votes
0answers
58 views

Does `npm install` retrieve binaries or sources?

I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources? If it's binaries, it's already a deal breaker for ...
1
vote
1answer
415 views

error in running snoopy in kali linux 2016.2 [closed]

I have installed the snoopy tool in Kali Linux but when I run the tool from terminal it's giving this error. Can you help me to solve this? I've also tried pip install libmproxy ___ _ _ ...
0
votes
1answer
456 views

Is Node.js on Debian Jessie really insecure?

As I was reading the release notes for Debian Jessie, I came upon these paragraphs: The Node.js platform is built on top of libv8-3.14, which experiences a high volume of security issues, but ...
0
votes
2answers
572 views

Is wiping LUKS header needed?

So I previously had an encrypted install of Debian, and wanted to install a new distro with full system encryption again. Now I understand that you don't need to fill the disk with random data if you ...
0
votes
1answer
394 views

Is my system infected with Operation Windigo in Kali Linux? [closed]

I did my research and the first things that I did to test my system was to run some commands based on my research. The problem is trying to determine if I am truly infected. Any, confirmation will be ...
1
vote
0answers
115 views

Enabling specific access with iptables on Debian

I am running a Debian server that hosts several Docker containers but also works as my router and internet gateway. I am having trouble getting SSH access from outside (specific ipaddresses) working ...
2
votes
2answers
3k views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
0
votes
2answers
91 views

How do I analyze traffic chain when using both Tor and a browser-configured proxy

For example, I have set up the Tor network in Debian. I then set up proxy in Iceweasel browser (via the Preferences). How can I examine the traffic chain to determine if browser requests first go ...
2
votes
2answers
1k views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...
1
vote
0answers
39 views

Port Knocking origination matching problem

I set up port knocking using first this method using knockd and then I tried using this method using only iptables directly but when both failed I thought I'd check a bit deeper into the problem. ...
3
votes
3answers
172 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
3
votes
1answer
397 views

Hacked debian server alternative boot

The server of a customer has been hacked last night. It is a standard debian distribution with mysql, apache and ssh for remote access. The way it has been hacked is very peculiar. The standard URL ...
2
votes
1answer
1k views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
1
vote
2answers
636 views

How to know if a host has been compromised and re-secure it again? (particular case of a raspberry) [duplicate]

I'm running a raspberry PI and I've accidentally left the 22 port open to it from a public IP for about 24 hours. Raspberries' raspbian distro comes by default with a "pi" user and "raspberry" ...
-1
votes
1answer
253 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...