Questions tagged [ubuntu]
Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].
287
questions
1
vote
2answers
3k views
Constant POST request spam to /cgi-bin/ViewLog.asp endpoint
I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests:
POST http://127.0.0.1/cgi-bin/ViewLog.asp
...
2
votes
3answers
6k views
Is it possible to exploit a file upload with whitelist and filename hashing?
I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
1
vote
1answer
318 views
Fully-secured screen lock in Ubuntu with encryption
I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
3
votes
1answer
2k views
Investigating HP sure start triggering security warnings
The following question belongs more to the HP forums but unfortunately I am not gaining any traction there. Please move the question to another SE if its off topic for this community.
Recently I've ...
0
votes
1answer
193 views
How can I found a source of HTTP request in Wireshark?
There are weird requests to/from the AWS:
and another one to/from 177.143.198.104.bc.googleusercontent.com:
( http://whois.domaintools.com/177.143.198.104 )
I use Ubuntu 18.04 Desktop, web browsers ...
0
votes
1answer
67 views
How to check TCP sequence number to detect mitm?
I suspect that my router (I'm using an iPhone as router) has been owned and the attacker is making some kind of mitm attack. I suspect also that some html and js code has not been sent to my laptop ...
1
vote
1answer
115 views
Is VLC from the Ubuntu LTS official repository insecure?
Often it is impossible at first sight to understand if a package in a repository is up-to-date with security fixes, because the maintainers use a different naming when applying the patches to old ...
6
votes
0answers
134 views
Are Ubuntu Snaps more secure than the classic installation method from the official repos?
Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
0
votes
0answers
24 views
Is this profile for AppArmor insecure?
I'm using PHP-FPM with Apache2 on my server, as PHP-FPM doesn't run as Apache2 module, I figured it would need a profile for it.
This is my first time working with AppArmor, so I'm afraid of crashing ...
1
vote
1answer
169 views
How should GNU/Linux noobs harden their dekstop OS?
I'm interested in using GNU/Linux for different reasons. Partly for freedom, privacy, and security. But also to force myself to learn Linux. One issue I’ve found is that desktop Linux seems to have ...
0
votes
0answers
37 views
Should I change the default folder for uploads?
PHP 7 uses the default system folder (/tmp) to store uploaded files.
PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
3
votes
4answers
1k views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
0
votes
4answers
147 views
Mouse moving while unattended, how can I check for intrusions
A few hours ago, I spotted my unattended mouse moving and seeming to click on tabs. I promptly rebooted my system and removed Teamviewer (it's the only remote connection app that I have installed), ...
0
votes
1answer
58 views
Is there an effective way to disable root access on linux in an office setting
I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.
Is ...
0
votes
2answers
513 views
How to detect malicious files or web shell on a vps web server
How is it possible to detect malicious files or web shell on a vps web server?
I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
2
votes
1answer
929 views
Can malware have its own GRUB/boot-loader and use it to be active?
I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I ...
2
votes
1answer
667 views
Apparmor profile denying read access with r flag
I generated an apparmor profile for the tor binary that comes bundled in Ricochet:
# Last Modified: Sun Apr 2 2017
#include <tunables/global>
/ricochet/*-ricochet/tor {
#include <...
11
votes
3answers
3k views
Concerning GET request in logs
I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels.
My websockets keep crashing, and I ...
24
votes
3answers
7k views
How is it possible for boss to know I am finding a job?
Today, when my boss talking with me, he suddenly said: No you don't need to worry about it, everyday you have 3 or 4 messages with agent in Linkedin right?
I am very very surprised, because :
I work ...
1
vote
0answers
58 views
Spawning child processes from root using runuser command
I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank).
The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
1
vote
1answer
1k views
Files on external drives executable by default with exFAT or NTFS under Ubuntu
On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable.
This is because ...
3
votes
2answers
440 views
Malware techiques via Linux Chrome and its effects, non-root
Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
6
votes
1answer
1k views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
3
votes
1answer
225 views
- Exploit aborted due to failure: not-found: Can't find base64 decode on target
So. I am having some issues at metasploit.
I am trying to exploit
exploit/multi/http/wp_crop_rce.
I am using Docker, in order to install wordpress version: 4.8.9.
PHP 7.2.12 (cli) (built: Nov 28 2018 ...
1
vote
0answers
40 views
Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get packages ...
2
votes
1answer
57 views
Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)
Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded ...
2
votes
3answers
339 views
Would an Ubuntu server accessible from the internet be hacked within days?
I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:
18 packages can be updated.
7 updates are security updates.
I install ...
0
votes
0answers
58 views
ARP Spoof dropping ALL connections involved
Please note I have clicked nearly every possible link describing this issue online, and none of them have explained nor assisted in fixing the phenomena.
I have a three-computer system, in which one ...
2
votes
1answer
49 views
Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?
I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
0
votes
2answers
170 views
is there a way to close 22 ssh port from public, ubuntu?
I am using putty and private key to access my development server. I used Nmap online port scanner, to see which ports are visible to the public, and in fact, the 22 is open.
My question is, is it ...
3
votes
1answer
936 views
Dirtycow runs (lib-c to root) fine but crashes on reboot
I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
1
vote
0answers
48 views
Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)
In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
56 views
Intercept HTTP requests for invalid domains in Linux
I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page.
More specifically, when trying to load ...
1
vote
0answers
104 views
Was there ever any malware found in Debian/Ubuntu packages?
With over 50,000 packages in Debian, it doesn't seem too unlikely that some of them may contain malware. On Ubuntu's side, their review process is apparently rather superficial, aimed at catching some ...
3
votes
0answers
210 views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
1
vote
2answers
197 views
I found an unknown UFW rule on my ubuntu server - have I been compromised?
The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.).
One day I ...
0
votes
1answer
137 views
Trojan detected in windows 10 can it affect dual boot Ubuntu
My windows defender detected this trojan: win32/credentialaccess!rfn and I tried to remove it.
I use dual boot with Ubuntu:
can this also effect ubuntu?
If i reset my windows completely can it come ...
1
vote
1answer
117 views
Step by step protocol for complete system wipe (suspecting persistent backdoor)
I have reason to believe that there is a persistent backdoor on my device, one which is not removed after a re installation of the OS.
I wanted to know the step by step protocol of system wipe to ...
4
votes
2answers
30k views
How to get openssl to use a cert without specifying it via -CAfile
I'm using this command:
openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/GTE_CyberTrust_Global_Root.pem
It works. If I don't specify that CAfile I get a code 20. The cert is in /etc/...
2
votes
1answer
92 views
Check TRIM space on SSD
Is it possible to 'view' the space that TRIM would take care of to see if that space was really wiped? I am using both Windows and Linux.
0
votes
0answers
32 views
Does the TPM check the addition/removal of boot-entries
I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following;
I have a ...
3
votes
4answers
309 views
Is the Linux / Debian software and package-management ecosystem secure?
My basic question is this:
When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
0
votes
1answer
47 views
WordPress script injections [duplicate]
I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception
PHP Fatal error: Namespace declaration statement has to be the very ...
1
vote
5answers
5k views
How do I harden compilers (as suggested by Lynis)?
This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web.
ii g++ 4:5.3.1-1ubuntu1 ...
0
votes
2answers
129 views
Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]
Saw this in the journalctl for a service I have:
jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485
jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
5
votes
1answer
195 views
How to keep backup servers safe?
I use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these ...
0
votes
1answer
63 views
Laravel | Why create a public_html folder and link/move it?
I am using laravel on shared hosting.
Under my domain in my folder is the laravel app.
Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
29
votes
5answers
4k views
What are the potential vulnerabilities of allowing non-root users to run apt-get?
There are two ways I can think of doing this:
On a system with sudo, by modifying /etc/sudoers.
On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
0
votes
2answers
380 views
Encrypt backup files and send them to AWS S3
I have a backup routine via crontab on Ubuntu.
This routine generates a compressed tar.gz file and sends it to AWS S3.
But I want to encrypt these files and be able to decrypt them when necessary on ...
46
votes
4answers
14k views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
