Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
2
votes
1answer
38 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
0
votes
2answers
68 views

is there a way to close 22 ssh port from public, ubuntu?

I am using putty and private key to access my development server. I used Nmap online port scanner, to see which ports are visible to the public, and in fact, the 22 is open. My question is, is it ...
1
vote
0answers
38 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
52 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
1
vote
0answers
84 views

Was there ever any malware found in Debian/Ubuntu packages?

With over 50,000 packages in Debian, it doesn't seem too unlikely that some of them may contain malware. On Ubuntu's side, their review process is apparently rather superficial, aimed at catching some ...
3
votes
0answers
69 views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
1
vote
2answers
187 views

I found an unknown UFW rule on my ubuntu server - have I been compromised?

The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.). One day I ...
0
votes
1answer
98 views

Trojan detected in windows 10 can it affect dual boot Ubuntu

My windows defender detected this trojan: win32/credentialaccess!rfn and I tried to remove it. I use dual boot with Ubuntu: can this also effect ubuntu? If i reset my windows completely can it come ...
1
vote
1answer
98 views

Step by step protocol for complete system wipe (suspecting persistent backdoor)

I have reason to believe that there is a persistent backdoor on my device, one which is not removed after a re installation of the OS. I wanted to know the step by step protocol of system wipe to ...
2
votes
1answer
82 views

Check TRIM space on SSD

Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
3
votes
1answer
742 views

Investigating HP sure start triggering security warnings

The following question belongs more to the HP forums but unfortunately I am not gaining any traction there. Please move the question to another SE if its off topic for this community. Recently I've ...
0
votes
0answers
22 views

Does the TPM check the addition/removal of boot-entries

I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following; I have a ...
0
votes
1answer
47 views

WordPress script injections [duplicate]

I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception PHP Fatal error: Namespace declaration statement has to be the very ...
0
votes
2answers
107 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
0
votes
1answer
45 views

Laravel | Why create a public_html folder and link/move it?

I am using laravel on shared hosting. Under my domain in my folder is the laravel app. Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
3
votes
3answers
638 views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
29
votes
5answers
4k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
1
vote
2answers
3k views

Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests: POST http://127.0.0.1/cgi-bin/ViewLog.asp ...
1
vote
1answer
153 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
0
votes
2answers
204 views

Encrypt backup files and send them to AWS S3

I have a backup routine via crontab on Ubuntu. This routine generates a compressed tar.gz file and sends it to AWS S3. But I want to encrypt these files and be able to decrypt them when necessary on ...
46
votes
4answers
14k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
0
votes
2answers
288 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
0
votes
1answer
78 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
0
votes
1answer
52 views

Loopholes in secured file server

My system to share private data works like this: I rent a virtual server at a hosting company. There I have a self-signed certificate installed. The folder with the files inside is password ...
0
votes
1answer
57 views

VPN as a firewall in a public network

My configuration is: allow only OpenVpn traffic and block any other (income/outcome) traffic with UFW on my ubuntu laptop. unreal scenario: let’s say i have ubuntu with chrome version 50 [2016] on ...
17
votes
8answers
4k views

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

I recently got a VPS with Ubuntu on it, and I'd like to start creating a very basic website. However, I don't know what steps I should take to secure this server. I'm new with Ubuntu, new with ...
0
votes
1answer
56 views

Are security scrutinies conducted by independent agencies on open source software like Ubuntu or Mozilla Firefox?

Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is ...
1
vote
2answers
269 views

How to protect my ubuntu linux computer from screen capture programs or keystroke loggers?

I have a Ubuntu home PC. I often use this system to enter passwords to various websites. Some sites also offer a graphical on screen keyboard to protect from keyloggers. However, I suspect that even ...
3
votes
3answers
253 views

Have I been pwned? Public SSH with key

I have a dedicated server with public IP address, opened port 22 and fail2ban running. I am using root account (I know it is wrong but I have to) and I have disabled logins with password. I am using ...
0
votes
0answers
35 views

Updating Ubuntu [duplicate]

How can I make sure in the terminal that my Ubuntu updates are from the real source? I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok....
0
votes
0answers
46 views

Bypassing non-writeable permissions on Ubuntu server

Say I have gained RCE on a server which has a firewall blocking all egress traffic: Linux cmweb6 4.15.0-1040-azure #44-Ubuntu SMP Thu Feb 21 14:24:01 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux But I am ...
1
vote
1answer
217 views

Fully-secured screen lock in Ubuntu with encryption

I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
5
votes
1answer
153 views

How to keep backup servers safe?

I use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these ...
0
votes
1answer
93 views

Maintaining root SSH access on Linux Ubuntu even after losing it? [closed]

Consider I have root ssh access to a Linux server (Ubuntu 18.04 LTS). What is the best way to maintain access even after losing ssh access? Are there any tools out there to help maintaining ...
20
votes
5answers
4k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
0
votes
0answers
100 views

How to do a SSL MITM for all programs trying to access the internet on my local Ubuntu

How to do an SSL MITM for all programs trying to access the internet on my local Ubuntu. When a program on my local machine tries to access the internet using https I would like to intercept and ...
6
votes
1answer
112 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
0
votes
1answer
51 views

UFW Blocks some IPs which are trying to attempt a connection to the server

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
0
votes
1answer
151 views

metasploit openvas plugin not connecting to OpenVAS9-Manager

I recently installed openvas9 following this guide. I can log into the web interface on port 4000 just fine, and I ran a scan on my metasploitable VM for testing, and it seems good. Now I wanted to ...
0
votes
0answers
39 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
0
votes
1answer
422 views

For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?

Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables? Assuming my public ip is known (and I don't want to change it), would it provide complete ...
0
votes
1answer
90 views

Can a malicious optical disc infect Ubuntu without user action?

Assuming that a malign user has unlimited resources at his/her disposal to infect a computer running Ubuntu, but he/she is only limited in transferring the malware through an optical disc (CD, DVD, BD ...
1
vote
0answers
108 views

Find files with autopsy [closed]

I had an Ubuntu 14 machine. A couple of days I installed Ubuntu 18 on this machine. I'm trying to recover some files from the previous installation. I'm using autopsy. I think I'm doing something ...
3
votes
1answer
320 views

Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
-1
votes
2answers
121 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
2
votes
1answer
968 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
1
vote
1answer
716 views

How to get result from airdump-ng on Ubuntu 18.04 LTS?

Issue: when I run airodump-ng wlp3s0mon, no results appear. I recently installed all kali linux tools on Ubuntu 18.04 LTS from this git repo https://github.com/LionSec/katoolin My chipset is the ...
1
vote
1answer
207 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
2
votes
2answers
269 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
0
votes
0answers
42 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...

1
2 3 4 5 6