Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
53
votes
3answers
19k views

Why has Ubuntu 18.04 moved back to insecure Xorg?

After reading Xorg becomes the default display server again and considering the security risk of xorg, I am wondering why the developers left Wayland. The fact that a few programs do not work on ...
47
votes
5answers
24k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
46
votes
4answers
14k views

Aren't keyfiles defeating the purpose of encryption?

I just added a drive to my system which is basically a partition mounted for extra storage. I'd like to encrypt it to protect my data in case of god knows what, and by doing that I'd need to enter the ...
42
votes
6answers
10k views

Why is disabling root necessary for security?

This page on server hardening claims: Disabling the root account is necessary for security reasons. Why is disabling the root account necessary for security reasons?
29
votes
5answers
4k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
26
votes
3answers
13k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
24
votes
3answers
7k views

How is it possible for boss to know I am finding a job?

Today, when my boss talking with me, he suddenly said: No you don't need to worry about it, everyday you have 3 or 4 messages with agent in Linkedin right? I am very very surprised, because : I work ...
20
votes
5answers
4k views

How to use FDE without needing to share the encryption password

We have an AI model which needs to be deployed on premise. The hardware will be provided by us, so we can do what ever we want on the device. The device is a mini PC running Ubuntu 18.04. The UI is ...
20
votes
1answer
8k views

How to read CVE - 2016 - 5696 correctly

The Ubuntu CVE Tracker page contains multiple tables related to kernel packages, some of which say DNE , others pending and version next to each . I would like to know how to properly read each table....
18
votes
3answers
3k views

ISO27001 and Linux/Ubuntu

My company has an ISO 27001 certification. They provided me a new laptop with Windows 8 OS in it. I asked if I can have a Linux/Ubuntu OS installed, they said that it is not possible due to the ISO ...
17
votes
8answers
4k views

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

I recently got a VPS with Ubuntu on it, and I'd like to start creating a very basic website. However, I don't know what steps I should take to secure this server. I'm new with Ubuntu, new with ...
17
votes
3answers
20k views

Are there ransomware infections of Ubuntu Linux in the wild?

Due to the recent media coverage of ransomware attacks several people for whom I've provided personal computer support in the past have expressed concerned. The majority of these people are running ...
16
votes
3answers
4k views

Breaching security of a notebook with full disc encryption when screen is locked

I am using full disc encryption on my portable computer (running Ubuntu). The setup requires me to enter a password during the boot sequence to access fully encrypted hard drive. There is no ...
16
votes
1answer
547 views

Password shown on screen after crash on Linux, any idea why?

So, my computer crashed during the night and when I came to work in the morning I had the following screen on. I did not type the password a single time after the crash. It appears to be related to ...
12
votes
1answer
7k views

How does Nautilus store passwords on Ubuntu?

When I mount a LUKS volume, I get these options: Forget password immediately Remember password until you logout Remember forever I assume the first is the safest, and I can work on the files until I ...
11
votes
3answers
3k views

Concerning GET request in logs

I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels. My websockets keep crashing, and I ...
10
votes
2answers
286 views

How to approach creating a Linux app that requires root privilege?

I'm working on an indicator for Ubuntu, and one of the tasks it's supposed to perform is chmod -x and chmod +x a specific root-owned binary (/usr/lib/x86_64-linux-gnu/notify-osd to be precise). As far ...
8
votes
5answers
2k views

I don't recognise my DNS server's address: does this mean I am compromised?

I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address ...
8
votes
3answers
1k views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
8
votes
1answer
77 views

What are the recommended directory ownership & permissions for hosted websites?

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites. └── var └── www ├── website1 │   └── public_html └── website2 ...
7
votes
2answers
5k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
7
votes
2answers
2k views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but couldn't:...
7
votes
2answers
8k views

Security of Linux Full Disk Encryption (Ubuntu / Mint) -insecure?

I'm wondering, why is Ubuntu and Mint using SHA1 for Full Disk Encryption? I heard several times that SHA1 shouldn't be used anymore because it is weak and it could be cracked. Could you guys ...
6
votes
2answers
2k views

Why can 'Others' read files by default in Ubuntu?

I am trying to figure out why when creating new files and directories in, let's say, the Documents folder, they get assigned, by default, the following permissions: -rw-rw-r-- 1 hello world 0 Nov ...
6
votes
1answer
125 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
6
votes
3answers
8k views

Cryptomining Malware - Ubuntu - Stratum tcp

My LAMP server has been hit with some kind of crypto mining malware. Crontab is clear and unused, Clam can't seem to detect anything. It appears to automatically create these files in my /tmp folder ...
6
votes
1answer
3k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
6
votes
0answers
134 views

Are Ubuntu Snaps more secure than the classic installation method from the official repos?

Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
6
votes
1answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
5
votes
4answers
6k views

kworker34 malware on Linux

Clam found this file named "kworker34" in the /tmp directory on my Ubuntu linux machine. I promptly deleted this file. Also found a shell file, kws.sh in there. Looks like it is connecting to 2 IP ...
5
votes
3answers
3k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
5
votes
5answers
298 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
5
votes
1answer
4k views

Why does my openssl connection fail with elliptic curve cipher ECDH-RSA-AES128-SHA?

I am using openssl example server and client with specific cipher in ubuntu 14.10 pc. The openssl version is 1.0.1. When I use the RC4-SHA cipher in both sides, the connection is established ...
5
votes
1answer
997 views

Has Ubuntu been patched for KRACKs?

I updated my Ubuntu 14.04 LTS. My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed. The changelog page says linux (3.13.0-134.183) trusty; ...
5
votes
1answer
195 views

How to keep backup servers safe?

I use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these ...
5
votes
2answers
1k views

Ubuntu: How do I download PPA software over HTTPS?

The default PPA address is: http://ppa.launchpad.net How do I connect to this via https, or use a mirror with https? Yes, I'm aware that the packages are signed. Thing is, signing keys can be stolen....
5
votes
2answers
420 views

Why does Ubuntu make requests to these Amazon EC2 IPs at startup?

Each time I bootup and login to Ubuntu 16.04, and before I launch any software/browser, I watch in Wireshark that Ubuntu has some requests to and from these IPs: 54.173.79.111 54.231.40.234 Whois ...
5
votes
2answers
1k views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
5
votes
1answer
234 views

Is this way of client-side SSL secure enough, to keep hackers away from my web app?

I'm wonderying if the following steps are enough to protect my cloud service, in a meaning that non-authorized users can not play with my web app? In other words, is it possible to bypass this kind ...
5
votes
1answer
188 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
5
votes
3answers
950 views

How to secure an OpenSSH server on Windows Subsystem for Linux (WSL)?

What are the basic security actions I should take when securing an OpenSSH server on Windows Subsystem for Linux (WSL), especially when I am the only one that should login to this server, but can't ...
5
votes
1answer
505 views

I have been hacked and im not sure how — Ubuntu 14 VPS, crypto wallet [closed]

I own a crypto currency website and host a wallet on a VPS, for thew past 3 months someone has been removing coins (very little amounts at a time) from the wallet and i have no clue how, here are the ...
4
votes
3answers
1k views

How to choose a linux for learning? [closed]

I am beginner in Security. My first assignment is about "Linux firewall using IPTABLES" . I know about Ubuntu, backtrack and kali Linux. How to choose a Linux distribution to learn about security?
4
votes
3answers
3k views

Can hackers access my webcam? [duplicate]

Can hackers gain access to a webcam without turning the webcam on? Can this be done on Ubuntu?
4
votes
2answers
1k views

What lies behind this complicated shellcode on linux?

It's pretty much my first time playing around with a buffer overflow exploit. I've written a simple C program that is vulnerable to buffer overflows: #include <stdio.h> #include <stdlib.h>...
4
votes
2answers
188 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
4
votes
2answers
259 views

Truecrypt and swap

I've got Ubuntu 14.04 Desktop and I use Truecrypt to store my confidential files. I've read that since Truecrypt does on the fly encryption, it only stores its decrypted content (and user's password ...
4
votes
2answers
30k views

How to get openssl to use a cert without specifying it via -CAfile

I'm using this command: openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/GTE_CyberTrust_Global_Root.pem It works. If I don't specify that CAfile I get a code 20. The cert is in /etc/...
4
votes
2answers
5k views

How to handle disk encryption for remote connection?

I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely. ...
4
votes
1answer
239 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...

1
2 3 4 5 6