Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

0
votes
0answers
145 views

What is sandbox_i?

I have a few colleagues in India who are working from Ubuntu. While looking in their machines for sockets in ESTABLISHED state via lsof, we found a command called sandbox_i. The output is below, ...
0
votes
0answers
14 views

Compilation of openssl failing showing error “no rule to make target 'jnix/jniglue.c'” [migrated]

I am trying to compile openssl using ndk-build on an linux machine and earlier compilation failed saying that "aes.h" file was missing for resolving that I installed libssl-dev package and that worked ...
3
votes
0answers
118 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
0answers
35 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
3
votes
2answers
302 views

What is this SSH attack, am I hacked?

I see this in my Ubuntu server's log file: in my ssh my user is root but i see other user Disconnected like "teamspeak", what does that mean? auth.log Jul 3 21:39:01 vmi189193 CRON[25937]: ...
1
vote
3answers
163 views

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult? [closed]

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult?
2
votes
1answer
35 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
16
votes
1answer
482 views

Password shown on screen after crash on Linux, any idea why?

So, my computer crashed during the night and when I came to work in the morning I had the following screen on. I did not type the password a single time after the crash. It appears to be related to ...
1
vote
0answers
115 views

2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy

I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/ and run their privacy test, they return: Defining tunnel (two way ping) found This is ...
53
votes
3answers
15k views

Why has Ubuntu 18.04 moved back to insecure Xorg?

After reading Xorg becomes the default display server again and considering the security risk of xorg, I am wondering why the developers left Wayland. The fact that a few programs do not work on ...
1
vote
0answers
32 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...
-1
votes
2answers
77 views

Why have distributions default HTTP package sources instead of HTTPS [duplicate]

Many distributions have HTTP links in their sources list for packages. Proof: https://docs.parrotsec.org/doku.php/mirrors-list https://docs.kali.org/general-use/kali-linux-sources-list-repositories ...
2
votes
2answers
204 views

VPN doesn't function properly on google websites

Why do google sites display content in my original country's language even if i'm connected to the internet through a VPN? For exapmple: google.com and youtube displays content in my actual language, ...
0
votes
1answer
48 views

Disable guest access in / directory Ubuntu [duplicate]

Follow up from: https://stackoverflow.com/questions/49703000/how-to-see-into-guest-account-filesystem-from-root I am root, and I need to restrict write or read access to / directory for a certain ...
1
vote
1answer
26 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
1
vote
2answers
129 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
2answers
294 views

odd ip address connected to my box

Today i went to the library. I was looking at my netstat -an output and i saw this. tcp 0 0 127.0.0.1:6379 127.0.0.1:46376 ESTABLISHED tcp 0 0 127.0.0.1:46376 ...
-5
votes
1answer
232 views

How does resolv.conf work? [closed]

Can someone try explaining (in simple terms) how Wi-Fi routers push nameservers and routes to my resolv.conf? I've noticed it gets changed automatically as I move between different Wi-Fi networks. I ...
0
votes
0answers
131 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
21
votes
3answers
7k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
0
votes
0answers
68 views

Auditd not writing to log after clearing without a service restart

I noticed that if everything is working fine with auditd on Ubuntu, and then the log at /var/log/audit/audit.log is cleared (all the text erased, the file is not deleted), auditd will no longer log ...
2
votes
1answer
166 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
2
votes
1answer
96 views

Appearance of yam bitcoin miner

I had a VM based on Ubuntu 16.04.03 and the only package added to it was OpenVPN. The purpose of it was to provide a VPN into my private network sited within the cloud environment. The hypervisor ...
1
vote
1answer
139 views

Can malware have its own GRUB/boot-loader and use it to be active?

I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I ...
0
votes
0answers
54 views

Shellcode on different Operating Systems?

Due I was testing some code, to learn. I tried to use a sample code in Assembly 32 bit, which I compiled. And exported it to an environment variable. Then I got the hex-address of the shell code ...
1
vote
0answers
52 views

Is there a way to make the login screen in ubuntu need ctrl-alt-del to put in your info? [closed]

In Windows, there is an option for a logon screen that looks like this: Image is there a way to do the same thing on Ubuntu?
2
votes
2answers
241 views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
2
votes
1answer
34 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
3
votes
1answer
149 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
0
votes
2answers
126 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
4
votes
1answer
80 views

Banking: Ubuntu virtual machine and virtual keyboard, or full Ubuntu install on USB drive?

I am mildly paranoid about protecting the security of my financial accounts. I often use Tails on a live USB for its light weight and amnesia. However, I also require the use of Chrome to visit some ...
1
vote
3answers
130 views

How secure is my logged out but not shut down luks HD

I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible ...
5
votes
0answers
103 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
3
votes
1answer
119 views

Malware: Is there a difference between automounting vs manually mounting?

This is specifically for Ubuntu, but if you'd like to include a reply that'd help Windows users, please do. Background: I'm working on the suspicion that there's malware on my neighbour's laptop, ...
0
votes
2answers
421 views

How to secure a fresh Ubuntu 16.04 install [closed]

I have a service that's spinning up fresh Ubuntu 16.04 instances onto a VPS (on behalf of users) and would really like to do what I can in terms of putting good privacy and security practices in by ...
2
votes
2answers
129 views

Isolating traffic between two physical networks on Ubuntu

I have two network segments (call them A @ 192.168.1.x and B @ 192.168.2.x) plugged into two separate NICs (NIC-A and NIC-B). The OS on the physical machine is standard stock Ubuntu, with nothing ...
2
votes
1answer
121 views

Question about potential ISO infection and ISO verification

I was downloading a ISO file from Ubuntu and was just curious on some security questions concerning this process and after the download process. If I'm downloading a file can my file be infected while ...
6
votes
3answers
3k views

Cryptomining Malware - Ubuntu - Stratum tcp

My LAMP server has been hit with some kind of crypto mining malware. Crontab is clear and unused, Clam can't seem to detect anything. It appears to automatically create these files in my /tmp folder ...
1
vote
1answer
112 views

How to handle sensitive data like API-keys and DB passwords on production

I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
5
votes
1answer
961 views

Has Ubuntu been patched for KRACKs?

I updated my Ubuntu 14.04 LTS. My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed. The changelog page says linux (3.13.0-134.183) trusty; ...
2
votes
0answers
345 views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
-1
votes
1answer
498 views

Dirty COW exploit by Bash

I've found many exploits for Dirty COW vulnerability with many methods that written in C programming language. But I want to test this vulnerability on a target that doesn't have gcc as C compiler (...
2
votes
0answers
2k views

SNI and hostname provided via HTTP are different error

I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log, [ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
0
votes
0answers
66 views

Can a pure external disk be a threat to Ubuntu computer

I bought a used external disk and now I wonder if any threats can occur from this. Its a disk without casing, so I'am using my own USB adapter. Is there anything else I should take care of when I ...
0
votes
3answers
552 views

Root access without password

I know it's strongly advised against enabling root access on server but as cracking SSH keys is almost impossible can I enable root access just by using ssh keys and be safe? My OS is Ubuntu 16.04. ...
1
vote
2answers
184 views

Source Code audit

I have a question regarding source code review of Linux packages. I downloaded a package of Ubuntu lets say samba, I thought to review source code of samba to look for security vulnerabilities. I ...
1
vote
3answers
115 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
0
votes
1answer
140 views

Is it possible to safely access a USB pen drive in Windows via a virtual box with Linux? [duplicate]

This is for a computer that has many different people plug in their pen drives into, for taking printouts. As a result, the computer is always infected with all kinds of Windows viruses. Once the ...
2
votes
1answer
764 views

How should output of fail2ban postfix-sasl look like

I want to be sure that fail2ban is properly banning failed postfix SASL login attempts. When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned ...
0
votes
1answer
119 views

Airodump-ng and my iPhone

Yesterday I run the Airodump-ng tool to check out the invisible. I noticed that in the client section there was a somewhat familiar name of a Probe. The person that this nickname reminded is a tech-...