Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

0
votes
0answers
23 views

On Ubuntu, if Secure Boot is enabled, then can Trusted Boot even run?

Since Ubuntu supports Secure Boot, i don't see any reason to not enable Secure Boot before installing Ubuntu. Secure Boot verifies the 1st-stage bootloader all the way up to the launch of the Linux ...
4
votes
2answers
60 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
0
votes
0answers
33 views

SYN flood acting weird

I was playing around with SYN flood using tools like netwox 73 and hping3. In the process, I encounter a number of weird behaviors that I did not expect to see. All of my machines are set up with ...
1
vote
1answer
33 views

OpenVPN one account multiple servers & Load Balancing

I have recently been experimenting with OpenVPN. My aim is to create a group of servers in different locations with a single username and password for each user stored in a central database. For ...
1
vote
1answer
72 views

Files on external drives executable by default with exFAT or NTFS under Ubuntu

On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable. This is because ...
0
votes
0answers
4 views

Restricting ssh and ftp access to unix server [migrated]

I know I can restrict ssh and ftp access to my unix server by using tools like ufw (uncomplicated firewall). What if I restrict ssh and ftp access to one IP address (my home IP) and then suddenly lose ...
0
votes
0answers
11 views

Postgres on Ubuntu Server 16.04 - automatically backups [migrated]

I have Ubuntu Server 16.04 and PostgreSql database. How to organize automatically backups? Is this better idea to move my database to AWS RDS instead having database on my server?
1
vote
1answer
37 views

Securely Download lubuntu from Non-Ubuntu System

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
1
vote
2answers
33 views

Add main user account to docker group

I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
0
votes
0answers
29 views

How to find my security leak [duplicate]

This morning the police gave me a short visit with a search warrant. Fortunately, they quite quickly realised, that I didn't do it and/or there is nothing to find. They did not search anything, I ...
0
votes
1answer
77 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
0
votes
0answers
49 views

Uninstall metasploit completely on Ubuntu

So I want to remove completely Metasploit because there was a problem that I couldn't describe. And I want to reinstall it after that. I couldn't find the uninstall script so I deleted 2 folders ...
0
votes
1answer
69 views

Is my Vino server being attacked?

I installed vino on LUbuntu 18.04, and configured and started my vino server according to https://askubuntu.com/a/530196/1471 without understanding what the commands mean: $ export DISPLAY=:0 $ ...
0
votes
0answers
158 views

What is sandbox_i?

I have a few colleagues in India who are working from Ubuntu. While looking in their machines for sockets in ESTABLISHED state via lsof, we found a command called sandbox_i. The output is below, ...
3
votes
0answers
123 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
0answers
90 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
3
votes
2answers
312 views

What is this SSH attack, am I hacked?

I see this in my Ubuntu server's log file: in my ssh my user is root but i see other user Disconnected like "teamspeak", what does that mean? auth.log Jul 3 21:39:01 vmi189193 CRON[25937]: ...
1
vote
3answers
172 views

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult? [closed]

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult?
2
votes
1answer
48 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
16
votes
1answer
487 views

Password shown on screen after crash on Linux, any idea why?

So, my computer crashed during the night and when I came to work in the morning I had the following screen on. I did not type the password a single time after the crash. It appears to be related to ...
1
vote
0answers
197 views

2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy

I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/ and run their privacy test, they return: Defining tunnel (two way ping) found This is ...
53
votes
3answers
15k views

Why has Ubuntu 18.04 moved back to insecure Xorg?

After reading Xorg becomes the default display server again and considering the security risk of xorg, I am wondering why the developers left Wayland. The fact that a few programs do not work on ...
1
vote
0answers
42 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...
-1
votes
2answers
80 views

Why have distributions default HTTP package sources instead of HTTPS [duplicate]

Many distributions have HTTP links in their sources list for packages. Proof: https://docs.parrotsec.org/doku.php/mirrors-list https://docs.kali.org/general-use/kali-linux-sources-list-repositories ...
2
votes
2answers
237 views

VPN doesn't function properly on google websites

Why do google sites display content in my original country's language even if i'm connected to the internet through a VPN? For exapmple: google.com and youtube displays content in my actual language, ...
0
votes
1answer
48 views

Disable guest access in / directory Ubuntu [duplicate]

Follow up from: https://stackoverflow.com/questions/49703000/how-to-see-into-guest-account-filesystem-from-root I am root, and I need to restrict write or read access to / directory for a certain ...
1
vote
1answer
27 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
1
vote
2answers
166 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
2answers
326 views

odd ip address connected to my box

Today i went to the library. I was looking at my netstat -an output and i saw this. tcp 0 0 127.0.0.1:6379 127.0.0.1:46376 ESTABLISHED tcp 0 0 127.0.0.1:46376 ...
-5
votes
1answer
326 views

How does resolv.conf work? [closed]

Can someone try explaining (in simple terms) how Wi-Fi routers push nameservers and routes to my resolv.conf? I've noticed it gets changed automatically as I move between different Wi-Fi networks. I ...
0
votes
0answers
140 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
23
votes
3answers
8k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
0
votes
0answers
96 views

Auditd not writing to log after clearing without a service restart

I noticed that if everything is working fine with auditd on Ubuntu, and then the log at /var/log/audit/audit.log is cleared (all the text erased, the file is not deleted), auditd will no longer log ...
2
votes
1answer
223 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
2
votes
1answer
100 views

Appearance of yam bitcoin miner

I had a VM based on Ubuntu 16.04.03 and the only package added to it was OpenVPN. The purpose of it was to provide a VPN into my private network sited within the cloud environment. The hypervisor ...
1
vote
1answer
172 views

Can malware have its own GRUB/boot-loader and use it to be active?

I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I ...
0
votes
0answers
61 views

Shellcode on different Operating Systems?

Due I was testing some code, to learn. I tried to use a sample code in Assembly 32 bit, which I compiled. And exported it to an environment variable. Then I got the hex-address of the shell code ...
1
vote
0answers
60 views

Is there a way to make the login screen in ubuntu need ctrl-alt-del to put in your info? [closed]

In Windows, there is an option for a logon screen that looks like this: Image is there a way to do the same thing on Ubuntu?
2
votes
2answers
296 views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
2
votes
1answer
34 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
3
votes
1answer
156 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
0
votes
2answers
175 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
4
votes
1answer
85 views

Banking: Ubuntu virtual machine and virtual keyboard, or full Ubuntu install on USB drive?

I am mildly paranoid about protecting the security of my financial accounts. I often use Tails on a live USB for its light weight and amnesia. However, I also require the use of Chrome to visit some ...
1
vote
3answers
144 views

How secure is my logged out but not shut down luks HD

I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible ...
5
votes
0answers
116 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
3
votes
1answer
136 views

Malware: Is there a difference between automounting vs manually mounting?

This is specifically for Ubuntu, but if you'd like to include a reply that'd help Windows users, please do. Background: I'm working on the suspicion that there's malware on my neighbour's laptop, ...
0
votes
2answers
460 views

How to secure a fresh Ubuntu 16.04 install [closed]

I have a service that's spinning up fresh Ubuntu 16.04 instances onto a VPS (on behalf of users) and would really like to do what I can in terms of putting good privacy and security practices in by ...
2
votes
2answers
146 views

Isolating traffic between two physical networks on Ubuntu

I have two network segments (call them A @ 192.168.1.x and B @ 192.168.2.x) plugged into two separate NICs (NIC-A and NIC-B). The OS on the physical machine is standard stock Ubuntu, with nothing ...
2
votes
1answer
133 views

Question about potential ISO infection and ISO verification

I was downloading a ISO file from Ubuntu and was just curious on some security questions concerning this process and after the download process. If I'm downloading a file can my file be infected while ...
6
votes
3answers
4k views

Cryptomining Malware - Ubuntu - Stratum tcp

My LAMP server has been hit with some kind of crypto mining malware. Crontab is clear and unused, Clam can't seem to detect anything. It appears to automatically create these files in my /tmp folder ...