Questions tagged [ubuntu]
Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].
261
questions
0
votes
1answer
35 views
Laravel | Why create a public_html folder and link/move it?
I am using laravel on shared hosting.
Under my domain in my folder is the laravel app.
Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
2
votes
2answers
83 views
How safe is dm-crypt/LUKS? Would TPM make me more secure in this case?
I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM ...
0
votes
1answer
153 views
How can I found a source of HTTP request in Wireshark?
There are weird requests to/from the AWS:
and another one to/from 177.143.198.104.bc.googleusercontent.com:
( http://whois.domaintools.com/177.143.198.104 )
I use Ubuntu 18.04 Desktop, web browsers ...
1
vote
2answers
645 views
Constant POST request spam to /cgi-bin/ViewLog.asp endpoint
I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests:
POST http://127.0.0.1/cgi-bin/ViewLog.asp
...
29
votes
5answers
4k views
What are the potential vulnerabilities of allowing non-root users to run apt-get?
There are two ways I can think of doing this:
On a system with sudo, by modifying /etc/sudoers.
On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
0
votes
2answers
76 views
Encrypt backup files and send them to AWS S3
I have a backup routine via crontab on Ubuntu.
This routine generates a compressed tar.gz file and sends it to AWS S3.
But I want to encrypt these files and be able to decrypt them when necessary on ...
0
votes
2answers
51 views
How to detect malicious files or web shell on a vps web server
How is it possible to detect malicious files or web shell on a vps web server?
I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
46
votes
4answers
13k views
Aren't keyfiles defeating the purpose of encryption?
I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
1
vote
1answer
107 views
If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?
I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
0
votes
1answer
74 views
How to secure an IoT device
Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)?
Fully disk encryption is of course an option, but is it ...
1
vote
5answers
4k views
How do I harden compilers (as suggested by Lynis)?
This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web.
ii g++ 4:5.3.1-1ubuntu1 ...
3
votes
3answers
241 views
Have I been pwned? Public SSH with key
I have a dedicated server with public IP address, opened port 22 and fail2ban running. I am using root account (I know it is wrong but I have to) and I have disabled logins with password. I am using ...
Michael - Where's Clay Shirky
2,2121 gold badge16 silver badges35 bronze badges
1
vote
1answer
694 views
Files on external drives executable by default with exFAT or NTFS under Ubuntu
On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable.
This is because ...
2
votes
2answers
358 views
Malware techiques via Linux Chrome and its effects, non-root
Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
5
votes
1answer
837 views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
0
votes
1answer
52 views
Loopholes in secured file server
My system to share private data works like this:
I rent a virtual server at a hosting company.
There I have a self-signed certificate installed.
The folder with the files inside is password ...
0
votes
1answer
52 views
VPN as a firewall in a public network
My configuration is: allow only OpenVpn traffic and block any other (income/outcome) traffic with UFW on my ubuntu laptop.
unreal scenario: let’s say i have ubuntu with chrome version 50 [2016] on ...
17
votes
8answers
4k views
Is a firewall enough of a security measure for an Ubuntu server that hosts a website?
I recently got a VPS with Ubuntu on it, and I'd like to start creating a very basic website. However, I don't know what steps I should take to secure this server.
I'm new with Ubuntu, new with ...
0
votes
1answer
54 views
Are security scrutinies conducted by independent agencies on open source software like Ubuntu or Mozilla Firefox?
Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is ...
1
vote
2answers
112 views
How to protect my ubuntu linux computer from screen capture programs or keystroke loggers?
I have a Ubuntu home PC. I often use this system to enter passwords to various websites. Some sites also offer a graphical on screen keyboard to protect from keyloggers. However, I suspect that even ...
1
vote
1answer
119 views
Fully-secured screen lock in Ubuntu with encryption
I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
0
votes
0answers
35 views
Updating Ubuntu [duplicate]
How can I make sure in the terminal that my Ubuntu updates are from the real source?
I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok....
0
votes
0answers
46 views
Bypassing non-writeable permissions on Ubuntu server
Say I have gained RCE on a server which has a firewall blocking all egress traffic:
Linux cmweb6 4.15.0-1040-azure #44-Ubuntu SMP Thu Feb 21 14:24:01 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
But I am ...
1
vote
1answer
324 views
dhclient cloud-init /var/tmp process
There's a process that's running that I'm trying to investigate why its running and what its doing. The server is a Linux Ubuntu server running on AWS. Running 16.04.
The process in question is:
...
3
votes
1answer
103 views
How to keep backup servers safe?
I use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these ...
0
votes
1answer
88 views
Can a malicious optical disc infect Ubuntu without user action?
Assuming that a malign user has unlimited resources at his/her disposal to infect a computer running Ubuntu, but he/she is only limited in transferring the malware through an optical disc (CD, DVD, BD ...
0
votes
1answer
91 views
Maintaining root SSH access on Linux Ubuntu even after losing it? [closed]
Consider I have root ssh access to a Linux server (Ubuntu 18.04 LTS). What is the best way to maintain access even after losing ssh access? Are there any tools out there to help maintaining ...
20
votes
5answers
4k views
How to use FDE without needing to share the encryption password
We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04.
The UI is ...
0
votes
0answers
60 views
How to do a SSL MITM for all programs trying to access the internet on my local Ubuntu
How to do an SSL MITM for all programs trying to access the internet on my local Ubuntu.
When a program on my local machine tries to access the internet using https I would like to intercept and ...
6
votes
1answer
99 views
Printing document on usb drive with confidential information on multi user computer
I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
3
votes
1answer
742 views
Dirtycow runs (lib-c to root) fine but crashes on reboot
I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
0
votes
1answer
37 views
UFW Blocks some IPs which are trying to attempt a connection to the server
UFW Blocks some IPs which are trying to attempt a connection to the server.
I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
0
votes
1answer
85 views
metasploit openvas plugin not connecting to OpenVAS9-Manager
I recently installed openvas9 following this guide.
I can log into the web interface on port 4000 just fine, and I ran a scan on my metasploitable VM for testing, and it seems good. Now I wanted to ...
0
votes
0answers
38 views
Hacking attempts to our server - what does this code do? [duplicate]
Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like
css2.php db_model.php ....
4
votes
1answer
234 views
Weird attack making my server CPU super high
I noticed that my server CPU is super high and the reason is grep "A" command
After a deep look, that what I've found in my active internet connections list (netstat -tupn)
tcp 0 0 ...
0
votes
1answer
290 views
For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?
Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables?
Assuming my public ip is known (and I don't want to change it), would it provide complete ...
2
votes
4answers
2k views
What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?
I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com)
I'm using Squid as a transparent proxy server. Solutions I don't ...
1
vote
2answers
629 views
How to get result from airdump-ng on Ubuntu 18.04 LTS?
Issue: when I run airodump-ng wlp3s0mon, no results appear.
I recently installed all kali linux tools on Ubuntu 18.04 LTS from this git repo https://github.com/LionSec/katoolin
My chipset is the ...
0
votes
0answers
34 views
Saved browser login information disappearing [duplicate]
I recently noticed that my browser (Chrome) is not saving my login state for websites anymore. The first time it happened I didn't thought much of it but it happened again and again. I also noticed ...
5
votes
1answer
184 views
Monero miner in ~/.info directory - a worm signature?
On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab.
...
1
vote
0answers
84 views
Find files with autopsy [closed]
I had an Ubuntu 14 machine. A couple of days I installed Ubuntu 18 on this machine.
I'm trying to recover some files from the previous installation. I'm using autopsy.
I think I'm doing something ...
3
votes
1answer
239 views
Is suspend-to-ram really a meaningful risk for Full Disk Encryption?
Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
2
votes
2answers
210 views
Isolating traffic between two physical networks on Ubuntu
I have two network segments (call them A @ 192.168.1.x and B @ 192.168.2.x) plugged into two separate NICs (NIC-A and NIC-B).
The OS on the physical machine is standard stock Ubuntu, with nothing ...
2
votes
1answer
2k views
2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy
I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/
and run their privacy test, they return:
Defining tunnel (two way ping) found
This is ...
-1
votes
2answers
109 views
How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]
I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
2
votes
1answer
705 views
Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?
I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow:
// gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
1
vote
1answer
133 views
Permissions for Azure OMS Agent files
I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
2
votes
2answers
261 views
Would an Ubuntu server accessible from the internet be hacked within days?
I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:
18 packages can be updated.
7 updates are security updates.
I install ...
4
votes
2answers
172 views
Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?
BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
0
votes
0answers
41 views
Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be.
Is it ...
