Skip to main content

Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
1 vote
0 answers
44 views

Ubuntu upgrade changed my home directory permissions - malicious or mistake? [migrated]

My setup I have a private server (Ubuntu 22.04.4) that I use as a test server for my web development code. Every couple of weeks I update it (sudo apt update; sudo apt upgrade -y). I don't usually ...
Dr Phil's user avatar
  • 111
0 votes
0 answers
32 views

Python os.system() does not change EUID to 0, but os.execl() does, why? [duplicate]

I was working on a CTF challenge that involved a setuid-enabled binary, '/usr/bin/python' where the owner is 'root'. The user I assumed was "www-data", with UID=33. The goal was to create a ...
theptr104's user avatar
0 votes
1 answer
107 views

Do I need to implement additional security measures for my self-hosted container web app?

Could you please suggest if I need to do anything else to ensure that my server is secure against the most common attacks? Currently it seems fine to me, but I would highly appreciate if someone with ...
dooshnila's user avatar
0 votes
1 answer
66 views

Random Requests Trying To Download Virus On Server?

So, I was hosting my website on fastapi, and then I saw this 2 requests on my server. I found that there was link, that was linking to file named "shk" on random ip adresses. I tried to ...
OJector's user avatar
1 vote
1 answer
166 views

Creating bootable USB from a compromised OS. Is it safe?

If we buy for instance a laptop with an OS pre-installed e.g. Ubuntu and but the original seller was not reputable and there are doubts with the preinstall. My question is: if we use the laptop to ...
Jim's user avatar
  • 183
0 votes
0 answers
153 views

Cracking 1000-password assignment from hashed file

OS: Ubuntu 20.04 on VMWare, tool: John the ripper The whole system is up-to-date The file has 1000 hashed passwords. There are 40 rules provided, a small word list is provided to help crack part of ...
nooonamee's user avatar
1 vote
2 answers
113 views

Detecting if application connects remotely in linux

Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters. Background: Say ...
ciru_4011's user avatar
0 votes
0 answers
108 views

Fail2ban not resulting in any update of IPTables

I have: Installed Fail2ban Created a local jail file. Changed lines within /etc/fail2ban/jail.local where enabled is mentioned x2 to true. Added enabled = true to the Asterisk section of the jail....
onerealbeanie's user avatar
0 votes
0 answers
158 views

Brute-Force by using XAMPP on windows, Ubuntu installed in Windows and DVWA

I am currently using XAMPP installed on windows to do a brute-force attack to DVWA. The command prompt that I used is Ubuntu, but the virtual machine is not opened and installed. Just a command prompt ...
Code Nauh's user avatar
1 vote
0 answers
66 views

Restricting ubuntu signing keys?

I started reading on apt and the security changes to always use GPG signing keys, but further saw that it by default uses all configured GPG signing keys, this seems like a small but unecessary ...
Xavanteex's user avatar
0 votes
1 answer
112 views

Is deploying a web application to a customer's encrypted drive a secure solution against code theft?

I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose. The customer wants my web service to run on their ...
harry_tums's user avatar
1 vote
2 answers
4k views

How to update Ubuntu SSH version to latest version [closed]

I'm trying to update the Ubuntu OpenSSH version to 9.3p2, because of the CVE-2023-38408 vulnerability, but I can't. The recomendation is update to last version: https://ubuntu.com/security/CVE-2023-...
Jhon Laurence's user avatar
0 votes
1 answer
501 views

Getting a couple of remote login and calls into Ubuntu server?

I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic. ...
felix's user avatar
  • 1
1 vote
1 answer
387 views

Is my website under attack?

I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs. Note: In the log report, I replace the name of my website with example.com and my second ...
martiz's user avatar
  • 11
1 vote
1 answer
1k views

Format a probably infected USB, is it safest Ubuntu live or Ubuntu installed?

I have an USB drive that probably is infected. I have a PC where currently I have not any partition, just an "empty" PC and I have a CD with Ubuntu 22.04. I would like to copy USB data, ...
woyim46107's user avatar
1 vote
0 answers
193 views

Is it possible to add a username a password to a hostname in /etc/hosts? [closed]

Is it possible to add a username a password to a hostname in /etc/hosts? Like: a.b.c.d username:password@hostname
1n4ho12's user avatar
  • 11
1 vote
0 answers
99 views

Can you configure Tripwire to produce an actual diff between modified files

I'm using the open source version of Tripwire on Ubuntu 22.04. Right now when a file is modified Tripwire will document this in the integrity check with an "Expected" vs "Observed" ...
Zzgooloo's user avatar
13 votes
3 answers
7k views

Understanding suspicious HTTP GET Request

I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code: "GET /?...
Tando's user avatar
  • 163
1 vote
0 answers
444 views

Is it safe to download and test EICAR test file [duplicate]

I need a sample malicious file that I can work with but does not harm my system. When I checked through the internet I found there is a file called EICAR test file. I am using Ubuntu 16.04 LTS. Can I ...
Avin Mathew's user avatar
0 votes
0 answers
92 views

Making time(0) produce an error

I'm currently reviewing/reversing a software (coded in C) and it has a line like this : time_t var = time(0); My goal it to get this time(0) call to return -1. (I cannot modify the parameter.) ...
531-M31C's user avatar
0 votes
1 answer
129 views

Ubuntu vs. Debian SSH public key login

In the Debian 9 server I have, these are the least restrictive permissions I can set for SSH login with public key to work: /home/user 775 /home/user/.ssh ...
Ehsan88's user avatar
  • 101
1 vote
3 answers
543 views

Can Windows invade my privacy by accessing files from my Linux OS?

I have a 500 GB SSD drive with Windows 10 installed, and a 250 GB SSD drive with Ubuntu 22.04 installed. I use the latter mainly to maintain my privacy; Ubuntu is like my personal computer, with ...
Best Quality Vacuum's user avatar
0 votes
1 answer
84 views

What are the potential risks of being able to navigate to any arbitrary directory on a web server?

I opened the access to a certain directory via SSH/FTP. Some adjustment to my web project is necessary, so I have organized an access for a programmer. The problem is that the command "cd" ...
Kifsif's user avatar
  • 101
0 votes
0 answers
119 views

File traversal vulnerability found on Ubuntu server running a node process using Nessus

I have an Ubuntu server running a normal Node express framework app and a vulnerability was found by a tool called Nessus. It looks like a pretty standard issue to me, and I will have shell access, ...
DaraJ's user avatar
  • 101
0 votes
1 answer
189 views

safely storing untrusted files on a trusted machine

given a collection of files (text and binary) that are likely to have been modified by a resourceful and motivated adversary in a targeted attack, is there a security risk to copying that collection ...
nqzero's user avatar
  • 1
8 votes
2 answers
3k views

Clamav identifies Certbot files as infected

I ran Clamav on an Ubuntu 20.04 machine and it identified ten Certbot files as infected. /snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND ...
user's user avatar
  • 183
1 vote
1 answer
1k views

How to locate a malicious script in the Linux system

I would like to ask for some directions to trace back to the original (malicious) script on my system (Ubuntu Server). I would try to be more specific if needed. If the question does not fit this ...
Long's user avatar
  • 131
1 vote
2 answers
843 views

How do I activate a malware inside a virtual machine?

I have been doing research on malware detection and my current setup is: one host OS (Ubuntu 18.04) and one guest OS (Ubuntu 18.04) inside VirtualBox. I have downloaded and executed some malware (...
Maksudur Rahman's user avatar
0 votes
1 answer
715 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
nerdball8000's user avatar
2 votes
1 answer
254 views

How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?

I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
renthus's user avatar
  • 23
1 vote
0 answers
197 views

Decompile a binary virus/worm

We got hacked, someone got access on our VPS machine. There are no ssh logs, there are no auth logs. There is no actual trace of remote access (that I could find and I'm not a security expert but I'm ...
Nicos Karalis's user avatar
1 vote
0 answers
171 views

How to do a post-mortem after being hacked [closed]

I am wondering what the general steps are in retrospect for trying to find out how one ends up being hacked. A couple of times I have had Linux servers that ended up being hacked. I noticed this in ...
oligofren's user avatar
  • 111
0 votes
1 answer
550 views

Cipher, for a rookie, what's safe and not safe 2021?

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses: cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:...
JoBe's user avatar
  • 115
0 votes
1 answer
458 views

How to check TCP sequence number to detect mitm?

I suspect that my router (I'm using an iPhone as router) has been owned and the attacker is making some kind of mitm attack. I suspect also that some html and js code has not been sent to my laptop ...
BiosRootKit's user avatar
1 vote
1 answer
284 views

Is VLC from the Ubuntu LTS official repository insecure?

Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old ...
reed's user avatar
  • 15.8k
5 votes
2 answers
995 views

Are Ubuntu Snaps more secure than the classic installation method from the official repos?

Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
reed's user avatar
  • 15.8k
1 vote
1 answer
528 views

How should GNU/Linux noobs harden their dekstop OS?

I'm interested in using GNU/Linux for different reasons. Partly for freedom, privacy, and security. But also to force myself to learn Linux. One issue I’ve found is that desktop Linux seems to have ...
arrakies's user avatar
0 votes
0 answers
126 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
Tom's user avatar
  • 174
0 votes
1 answer
145 views

Is there an effective way to disable root access on linux in an office setting

I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions. Is ...
Exelian's user avatar
  • 101
0 votes
4 answers
244 views

Mouse moving while unattended, how can I check for intrusions

A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
Olumide's user avatar
  • 101
10 votes
3 answers
4k views

Concerning GET request in logs

I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels. My websockets keep crashing, and I ...
MattG's user avatar
  • 203
24 votes
3 answers
7k views

How is it possible for boss to know I am finding a job?

Today, when my boss talking with me, he suddenly said: No you don't need to worry about it, everyday you have 3 or 4 messages with agent in Linkedin right? I am very very surprised, because : I work ...
Elisa's user avatar
  • 351
1 vote
0 answers
556 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
Algo7's user avatar
  • 113
1 vote
0 answers
113 views

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages ...
Michael Altfield's user avatar
4 votes
1 answer
458 views

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages? My understanding was that software downloaded ...
Michael Altfield's user avatar
3 votes
1 answer
1k views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
Paul's user avatar
  • 31
2 votes
1 answer
338 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
Duck's user avatar
  • 41
0 votes
3 answers
3k views

Is there a way to close 22 SSH port from public, ubuntu?

I am using putty and private key to access my development server. I used Nmap to see which ports are visible to the public, and in fact the 22 is open. Is it possible to hide open port from the public?...
filtertips's user avatar
2 votes
0 answers
308 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
reed's user avatar
  • 15.8k
1 vote
0 answers
159 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
nwarp's user avatar
  • 207

1
2 3 4 5
7