Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

0
votes
0answers
34 views

Saved browser login information disappearing [duplicate]

I recently noticed that my browser (Chrome) is not saving my login state for websites anymore. The first time it happened I didn't thought much of it but it happened again and again. I also noticed ...
0
votes
0answers
5 views

Is it possible to put my network card into Monitor mode without root privileges [migrated]

I want to put my network card into monitor mode to try out some simple network packet capturing but i need to have root on my user account in order to enable it. is There someway to do this without ...
1
vote
0answers
61 views

Find files with autopsy [on hold]

I had an Ubuntu 14 machine. A couple of days I installed Ubuntu 18 on this machine. I'm trying to recover some files from the previous installation. I'm using autopsy. I think I'm doing something ...
0
votes
0answers
6 views

How to encrypt whole folder in Ubuntu? [migrated]

I want to upload a folder to Google Drive. I don't want those Google bots to read my folder and files to make their company smarter (I assumed here that they read and learn from user's files too). ...
2
votes
1answer
136 views

Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
-1
votes
2answers
102 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
2
votes
1answer
155 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
1
vote
2answers
211 views

How to get result from airdump-ng on Ubuntu 18.04 LTS?

Issue: when I run airodump-ng wlp3s0mon, no results appear. I recently installed all kali linux tools on Ubuntu 18.04 LTS from this git repo https://github.com/LionSec/katoolin My chipset is the ...
1
vote
1answer
43 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
2
votes
2answers
246 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
0
votes
0answers
33 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
0
votes
0answers
40 views

There are cached icons and screenshots from another person, am I hacked? [duplicate]

I'm running Ubuntu bionic 16.04 LTS and there are being constantly added new files into the ~/.cache/gnome-software/ directory. I've uploaded all of them into this new GitLab repository, so that you ...
1
vote
1answer
76 views

Is it a security risk to run master process of nginx as root?

I'm using nginx (Port 8888) as a reverse proxy for my web server running over 8080. In the traditional way, nginx master process runs as root and spawns the child processes with user www-data. Is it ...
-1
votes
1answer
111 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
0answers
26 views

Why is Veracrypt showing 2 created partitions?

I wiped my 1TB Samsung 850 Evo SSD and I just used veracrypt to perform full disk encryption with it. I have another HDD drive as well that I've done this with. The HDD is sdb, and the EVO is sdc. ...
2
votes
3answers
3k views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
0
votes
2answers
109 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
0
votes
1answer
87 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
0
votes
0answers
161 views

Man in the middle-attack

I'm trying to do a MITM-attack on my Ubuntu platform. After some searching arounf at the internet I'm doing everything correct as follow: sudo arpspoof -i wlan0 -t Victim-IP Router-IP sudo arpspoof -...
0
votes
1answer
132 views

dhclient cloud-init /var/tmp process

There's a process that's running that I'm trying to investigate why its running and what its doing. The server is a Linux Ubuntu server running on AWS. Running 16.04. The process in question is: ...
2
votes
1answer
56 views

Do openssl CA certificates get updated with apt-get upgrade?

I use Ubunut 18.04. I need to know if OpenSSL CA certificates that are in this file: /etc/ssl/certs/ca-certificates.crt get updated when I upgrade my system using: apt-get upgrade? I have a ...
0
votes
2answers
121 views

Boot from live usb to avoid being spied on

Suppose the government wants to spy on you using government-designed malware. If you then want to visit sensitive pages on the internet, would it be more secure to use Tor browser within a USB - live ...
2
votes
2answers
94 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
-1
votes
1answer
396 views

How to switch from Ubuntu 18.04 to kali linux? [closed]

I am using now ubuntu 18.04.1 and i wanna make dual boot with kali linux. How to do that?
45
votes
5answers
14k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
2
votes
1answer
91 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
6
votes
2answers
2k views

Why can 'Others' read files by default in Ubuntu?

I am trying to figure out why when creating new files and directories in, let's say, the Documents folder, they get assigned, by default, the following permissions: -rw-rw-r-- 1 hello world 0 Nov ...
-1
votes
2answers
93 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
0
votes
1answer
64 views

Read-only to the root user

Is there a permanent and secure (as in integrity) way to make the entire Ubuntu system of a VPS (virtual private server) read-only to all users (including the root user)?
2
votes
1answer
39 views

Limit rights for user applications

I have a website, where users are available to upload small applications which runs 24/7 on my server. So if the user upload an application, some folders will be created: /{USER_ID}/{APP_ID}/ (if ...
3
votes
1answer
110 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
5
votes
5answers
202 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
1
vote
1answer
126 views

OpenVPN one account multiple servers & Load Balancing

I have recently been experimenting with OpenVPN. My aim is to create a group of servers in different locations with a single username and password for each user stored in a central database. For ...
1
vote
1answer
252 views

Files on external drives executable by default with exFAT or NTFS under Ubuntu

On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable. This is because ...
2
votes
1answer
52 views

Securely Download lubuntu from Non-Ubuntu System

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
1
vote
2answers
107 views

Add main user account to docker group

I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
0
votes
1answer
92 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
0
votes
1answer
164 views

Is my Vino server being attacked?

I installed vino on LUbuntu 18.04, and configured and started my vino server according to https://askubuntu.com/a/530196/1471 without understanding what the commands mean: $ export DISPLAY=:0 $ ...
3
votes
1answer
195 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
0answers
225 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
3
votes
2answers
426 views

What is this SSH attack, am I hacked?

I see this in my Ubuntu server's log file: in my ssh my user is root but i see other user Disconnected like "teamspeak", what does that mean? auth.log Jul 3 21:39:01 vmi189193 CRON[25937]: ...
1
vote
3answers
201 views

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult? [closed]

When hardening a LINUX system what command line tools would you remove first in order to make an attackers life really difficult?
3
votes
1answer
158 views

Is there a security tracker aggregated file for Ubuntu server like Debian has?

Debian has a JSON file containing all CVE<->Fixed package versions map. Link: https://security-tracker.debian.org/tracker/data/json Does Ubuntu have something similar?
16
votes
1answer
500 views

Password shown on screen after crash on Linux, any idea why?

So, my computer crashed during the night and when I came to work in the morning I had the following screen on. I did not type the password a single time after the crash. It appears to be related to ...
2
votes
1answer
628 views

2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy

I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/ and run their privacy test, they return: Defining tunnel (two way ping) found This is ...
55
votes
3answers
17k views

Why has Ubuntu 18.04 moved back to insecure Xorg?

After reading Xorg becomes the default display server again and considering the security risk of xorg, I am wondering why the developers left Wayland. The fact that a few programs do not work on ...
1
vote
0answers
81 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...
-1
votes
2answers
108 views

Why have distributions default HTTP package sources instead of HTTPS [duplicate]

Many distributions have HTTP links in their sources list for packages. Proof: https://docs.parrotsec.org/doku.php/mirrors-list https://docs.kali.org/general-use/kali-linux-sources-list-repositories ...
2
votes
2answers
364 views

VPN doesn't function properly on google websites

Why do google sites display content in my original country's language even if i'm connected to the internet through a VPN? For exapmple: google.com and youtube displays content in my actual language, ...
0
votes
1answer
52 views

Disable guest access in / directory Ubuntu [duplicate]

Follow up from: https://stackoverflow.com/questions/49703000/how-to-see-into-guest-account-filesystem-from-root I am root, and I need to restrict write or read access to / directory for a certain ...