Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Need help identifying and erradicating Cobalt Strike beacon and persistence [closed]

Posted this over in the Unix section earlier and was recommended here: I'm stopping by trying to further narrow down my understanding and ultimately the eradication of one if not multiple Cobalt ...
user avatar
  • 1
-1 votes
0 answers
9 views

how to add more history tabs [migrated]

I am using ubuntu 20.04 and i have the latest version of firefox. When i press ctrl+h i get all the history tabs. (Today/yesterday/last 7 days/this month...) Well sometimes i go offline and i don't ...
user avatar
  • 1
0 votes
1 answer
37 views

What are the potential risks of being able to navigate to any arbitrary directory on a web server?

I opened the access to a certain directory via SSH/FTP. Some adjustment to my web project is necessary, so I have organized an access for a programmer. The problem is that the command "cd" ...
user avatar
  • 101
0 votes
0 answers
9 views

How to analyze/monitor OSSEC logs on Ubuntu

I'm using OSSEC server to monitor machines with OSSEC agents, which monitor this login via SSH, file creation, etc. I have configured OSSEC to send an email when it detects a problem, but this control ...
user avatar
  • 153
0 votes
0 answers
23 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
user avatar
  • 101
0 votes
1 answer
96 views

safely storing untrusted files on a trusted machine

given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
user avatar
  • 1
8 votes
2 answers
3k views

Clamav identifies Certbot files as infected

I ran Clamav on an Ubuntu 20.04 machine and it identified ten Certbot files as infected. /snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND ...
user avatar
  • 183
0 votes
1 answer
186 views

How to locate a malicious script in the Linux system

I would like to ask for some directions to trace back to the original (malicious) script on my system (Ubuntu Server). I would try to be more specific if needed. If the question does not fit this ...
user avatar
  • 111
1 vote
2 answers
191 views

How do I activate a malware inside a virtual machine?

I have been doing research on malware detection and my current setup is: one host OS (Ubuntu 18.04) and one guest OS (Ubuntu 18.04) inside VirtualBox. I have downloaded and executed some malware (...
user avatar
0 votes
1 answer
99 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
user avatar
0 votes
0 answers
48 views

Could my Windows 7 VM access my network and perhaps my host internet history or data?

I have a Windows 7 Pro VM running on an Ubuntu 20.04 host. I'm a bit new to VirtualBox and set up the VM but it was too slow to do anything so I took a snapshot and closed it. I think my Ubuntu host ...
user avatar
  • 23
2 votes
1 answer
121 views

How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?

I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
user avatar
  • 23
1 vote
0 answers
121 views

Decompile a binary virus/worm

We got hacked, someone got access on our VPS machine. There are no ssh logs, there are no auth logs. There is no actual trace of remote access (that I could find and I'm not a security expert but I'm ...
user avatar
0 votes
0 answers
79 views

Lynis Audit Difference Between Found Known Binary and Just Found

When I run a Lynis audit of my Xubuntu system, under System Tools, binary scan, most of the binaries are returned as Found known binary: package (pkg category) - /path/to/binary But under /usr/bin ...
user avatar
1 vote
0 answers
110 views

How to do a post-mortem after being hacked [closed]

I am wondering what the general steps are in retrospect for trying to find out how one ends up being hacked. A couple of times I have had Linux servers that ended up being hacked. I noticed this in ...
user avatar
  • 111
0 votes
1 answer
202 views

Cipher, for a rookie, what's safe and not safe 2021?

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses: cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:...
user avatar
  • 115
0 votes
1 answer
190 views

How to check TCP sequence number to detect mitm?

I suspect that my router (I'm using an iPhone as router) has been owned and the attacker is making some kind of mitm attack. I suspect also that some html and js code has not been sent to my laptop ...
user avatar
1 vote
1 answer
185 views

Is VLC from the Ubuntu LTS official repository insecure?

Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old ...
user avatar
  • 15.3k
5 votes
1 answer
379 views

Are Ubuntu Snaps more secure than the classic installation method from the official repos?

Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
user avatar
  • 15.3k
1 vote
1 answer
357 views

How should GNU/Linux noobs harden their dekstop OS?

I'm interested in using GNU/Linux for different reasons. Partly for freedom, privacy, and security. But also to force myself to learn Linux. One issue I’ve found is that desktop Linux seems to have ...
user avatar
0 votes
0 answers
82 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
user avatar
  • 153
0 votes
1 answer
102 views

Is there an effective way to disable root access on linux in an office setting

I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions. Is ...
user avatar
  • 101
0 votes
4 answers
197 views

Mouse moving while unattended, how can I check for intrusions

A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
user avatar
  • 101
11 votes
3 answers
3k views

Concerning GET request in logs

I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels. My websockets keep crashing, and I ...
user avatar
  • 213
24 votes
3 answers
7k views

How is it possible for boss to know I am finding a job?

Today, when my boss talking with me, he suddenly said: No you don't need to worry about it, everyday you have 3 or 4 messages with agent in Linkedin right? I am very very surprised, because : I work ...
user avatar
  • 351
1 vote
0 answers
153 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
user avatar
  • 113
1 vote
0 answers
80 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
user avatar
2 votes
1 answer
180 views

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? My understanding was that software downloaded ...
user avatar
3 votes
1 answer
549 views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
user avatar
  • 31
2 votes
1 answer
129 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
user avatar
  • 41
0 votes
3 answers
820 views

is there a way to close 22 ssh port from public, ubuntu?

I am using putty and private key to access my development server. I used Nmap online port scanner, to see which ports are visible to the public, and in fact, the 22 is open. My question is, is it ...
user avatar
1 vote
0 answers
131 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
user avatar
  • 15.3k
1 vote
0 answers
101 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
user avatar
  • 207
2 votes
2 answers
410 views

Was there ever any malware found in Debian/Ubuntu packages?

With over 30,000 projects packaged by Debian, it doesn't seem too unlikely that some of them may contain malware. On Ubuntu's side, the review process is apparently rather superficial, aimed at ...
user avatar
  • 302
4 votes
0 answers
637 views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
user avatar
1 vote
2 answers
255 views

I found an unknown UFW rule on my ubuntu server - have I been compromised?

The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.). One day I ...
user avatar
1 vote
1 answer
213 views

Trojan detected in windows 10 can it affect dual boot Ubuntu

My windows defender detected this trojan: win32/credentialaccess!rfn and I tried to remove it. I use dual boot with Ubuntu: can this also effect ubuntu? If i reset my windows completely can it come ...
user avatar
1 vote
1 answer
173 views

Step by step protocol for complete system wipe (suspecting persistent backdoor)

I have reason to believe that there is a persistent backdoor on my device, one which is not removed after a re installation of the OS. I wanted to know the step by step protocol of system wipe to ...
user avatar
  • 15
2 votes
1 answer
161 views

Check TRIM space on SSD

Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
user avatar
4 votes
1 answer
3k views

Investigating HP sure start triggering security warnings

The following question belongs more to the HP forums but unfortunately I am not gaining any traction there. Please move the question to another SE if its off topic for this community. Recently I've ...
user avatar
  • 61
0 votes
1 answer
96 views

WordPress script injections [duplicate]

I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception PHP Fatal error: Namespace declaration statement has to be the very ...
user avatar
  • 101
0 votes
2 answers
206 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
user avatar
0 votes
1 answer
111 views

Laravel | Why create a public_html folder and link/move it?

I am using laravel on shared hosting. Under my domain in my folder is the laravel app. Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
user avatar
  • 157
3 votes
4 answers
2k views

How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?

I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
user avatar
29 votes
5 answers
4k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
user avatar
  • 401
0 votes
2 answers
5k views

Constant POST request spam to /cgi-bin/ViewLog.asp endpoint

I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests: POST http://127.0.0.1/cgi-bin/ViewLog.asp ...
user avatar
  • 101
1 vote
1 answer
282 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
user avatar
0 votes
2 answers
756 views

Encrypt backup files and send them to AWS S3

I have a backup routine via crontab on Ubuntu. This routine generates a compressed tar.gz file and sends it to AWS S3. But I want to encrypt these files and be able to decrypt them when necessary on ...
user avatar
  • 153
47 votes
4 answers
15k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
user avatar
1 vote
2 answers
787 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
user avatar
  • 11

1
2 3 4 5 6