Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
0
votes
1answer
55 views

Disable guest access in / directory Ubuntu [duplicate]

Follow up from: https://stackoverflow.com/questions/49703000/how-to-see-into-guest-account-filesystem-from-root I am root, and I need to restrict write or read access to / directory for a certain ...
2
votes
1answer
66 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
3
votes
2answers
440 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
2answers
417 views

odd ip address connected to my box

Today i went to the library. I was looking at my netstat -an output and i saw this. tcp 0 0 127.0.0.1:6379 127.0.0.1:46376 ESTABLISHED tcp 0 0 127.0.0.1:46376 ...
-4
votes
1answer
592 views

How does resolv.conf work? [closed]

Can someone try explaining (in simple terms) how Wi-Fi routers push nameservers and routes to my resolv.conf? I've noticed it gets changed automatically as I move between different Wi-Fi networks. I ...
0
votes
0answers
177 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
26
votes
3answers
13k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
2
votes
1answer
417 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
2
votes
1answer
159 views

Appearance of yam bitcoin miner

I had a VM based on Ubuntu 16.04.03 and the only package added to it was OpenVPN. The purpose of it was to provide a VPN into my private network sited within the cloud environment. The hypervisor ...
2
votes
1answer
928 views

Can malware have its own GRUB/boot-loader and use it to be active?

I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I ...
1
vote
0answers
127 views

Is there a way to make the login screen in ubuntu need ctrl-alt-del to put in your info? [closed]

In Windows, there is an option for a logon screen that looks like this: Image is there a way to do the same thing on Ubuntu?
3
votes
2answers
772 views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
2
votes
1answer
43 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
3
votes
1answer
240 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
0
votes
2answers
484 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
4
votes
1answer
185 views

Banking: Ubuntu virtual machine and virtual keyboard, or full Ubuntu install on USB drive?

I am mildly paranoid about protecting the security of my financial accounts. I often use Tails on a live USB for its light weight and amnesia. However, I also require the use of Chrome to visit some ...
1
vote
3answers
501 views

How secure is my logged out but not shut down luks HD

I'am running a Ubuntu 16.04 on a luks encrypted disk. Normally when I leave my machine for some minutes, I always shut it down to be safe with the luks encryption. But I wonder, what the possible ...
5
votes
1answer
188 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
3
votes
1answer
304 views

Malware: Is there a difference between automounting vs manually mounting?

This is specifically for Ubuntu, but if you'd like to include a reply that'd help Windows users, please do. Background: I'm working on the suspicion that there's malware on my neighbour's laptop, ...
0
votes
2answers
675 views

How to secure a fresh Ubuntu 16.04 install [closed]

I have a service that's spinning up fresh Ubuntu 16.04 instances onto a VPS (on behalf of users) and would really like to do what I can in terms of putting good privacy and security practices in by ...
2
votes
2answers
212 views

Isolating traffic between two physical networks on Ubuntu

I have two network segments (call them A @ 192.168.1.x and B @ 192.168.2.x) plugged into two separate NICs (NIC-A and NIC-B). The OS on the physical machine is standard stock Ubuntu, with nothing ...
3
votes
1answer
227 views

Question about potential ISO infection and ISO verification

I was downloading a ISO file from Ubuntu and was just curious on some security questions concerning this process and after the download process. If I'm downloading a file can my file be infected while ...
6
votes
3answers
8k views

Cryptomining Malware - Ubuntu - Stratum tcp

My LAMP server has been hit with some kind of crypto mining malware. Crontab is clear and unused, Clam can't seem to detect anything. It appears to automatically create these files in my /tmp folder ...
1
vote
1answer
334 views

How to handle sensitive data like API-keys and DB passwords on production

I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
5
votes
1answer
997 views

Has Ubuntu been patched for KRACKs?

I updated my Ubuntu 14.04 LTS. My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed. The changelog page says linux (3.13.0-134.183) trusty; ...
6
votes
1answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
-1
votes
1answer
2k views

Dirty COW exploit by Bash

I've found many exploits for Dirty COW vulnerability with many methods that written in C programming language. But I want to test this vulnerability on a target that doesn't have gcc as C compiler (...
2
votes
0answers
4k views

SNI and hostname provided via HTTP are different error

I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log, [ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
2
votes
0answers
84 views

Can a pure external disk be a threat to Ubuntu computer

I bought a used external disk and now I wonder if any threats can occur from this. Its a disk without casing, so I'am using my own USB adapter. Is there anything else I should take care of when I ...
0
votes
3answers
1k views

Root access without password

I know it's strongly advised against enabling root access on server but as cracking SSH keys is almost impossible can I enable root access just by using ssh keys and be safe? My OS is Ubuntu 16.04. ...
1
vote
2answers
308 views

Source Code audit

I have a question regarding source code review of Linux packages. I downloaded a package of Ubuntu lets say samba, I thought to review source code of samba to look for security vulnerabilities. I ...
1
vote
3answers
228 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
0
votes
1answer
568 views

Is it possible to safely access a USB pen drive in Windows via a virtual box with Linux? [duplicate]

This is for a computer that has many different people plug in their pen drives into, for taking printouts. As a result, the computer is always infected with all kinds of Windows viruses. Once the ...
3
votes
1answer
3k views

How should output of fail2ban postfix-sasl look like

I want to be sure that fail2ban is properly banning failed postfix SASL login attempts. When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned ...
0
votes
1answer
466 views

Airodump-ng and my iPhone

Yesterday I run the Airodump-ng tool to check out the invisible. I noticed that in the client section there was a somewhat familiar name of a Probe. The person that this nickname reminded is a tech-...
2
votes
0answers
395 views

Nethogs showing several IP addresses and ports - Port sniffing?

I have a small Ubuntu server (VPS from provider with control panel) machine for practice purposes - no production or critical stuff. I've set up ufw and nginx with a sample index.html page. I control ...
1
vote
0answers
644 views

How to implement RBAC on Ubuntu?

I'm looking for the best approach to implement RBAC for about 100 Ubuntu servers. Currently all users are created locally mostly via Chef and we have no user directory service. All users have access ...
0
votes
2answers
1k views

hundreds of users creating mail.ru and projectgold.ru accounts on my application db

I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this: ...
4
votes
1answer
203 views

Finding out the password or bypass Linux password for home encryption?

I forgot the password of one of my account on Ubuntu 16.04. The user account directory is encrypted. I have configured the Yubikey SSH key based login so I am able to login, into that account. But ...
1
vote
1answer
2k views

Configuring docker securly on a developer machine

As a developer, I use docker and have a docker server running on my machine. I would expect that docker would not give my user permission to operate on files beyond my user's current set of ...
1
vote
2answers
2k views

DNS Leak with VPNBook (OpenVPN)

DNS Leak with VPNBook (OpenVPN) My current setup: OS: Ubuntu 17.04 Service: OpenVPN VPN: VPNBook (free) VPN Setup: I setup VPNBook on my Ubuntu OS by downloading the US1 Files on this link: ...
2
votes
1answer
187 views

No password root accounts of an entire laboratory!

2 days ago some of the university staff asked me about 3 computers here. All the computers are using Ubuntu and have the exact same password on the login screen for the superuser. Let's say StackPa$$...
1
vote
1answer
347 views

Can attacker escalate its privileges if he has access a web Application running with www-data [closed]

I have deployed an opensource web Application named "opencart" it has simple password. My question is can attacker login my system and escalate privileges if he login web application and even know the ...
1
vote
0answers
90 views

How should I manage wireless connections if using iptables?

I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu WARNING: Iptables and NetworkManager can conflict. Also if you are concerned enough ...
5
votes
2answers
1k views

Ubuntu: How do I download PPA software over HTTPS?

The default PPA address is: http://ppa.launchpad.net How do I connect to this via https, or use a mirror with https? Yes, I'm aware that the packages are signed. Thing is, signing keys can be stolen....
0
votes
2answers
869 views

Is it safe and secured to use Mono-Project for Ubuntu to run a ASP.NET with a MySQL database?

I am looking to rent a VPS server to host a game server, MySQL database and an ASP.NET site on it. A Windows server is too expensive for me but Mono-Project for Ubuntu does everything that I need it ...
1
vote
0answers
179 views

Was My computer vulnerable to VLC subtitle hack?

In May, a vulnerability has been discovered in VLC and other media players (like kody and popcorn time ...). They explain in the article https://fossbytes.com/subtitle-hack-affects-millions-device-vlc-...
2
votes
1answer
118 views

Does CVE-2017-9445 also effect Ubuntu 14.04.X and 16.04.X?

After all the buzz about CVE-2017-9445 it seems unclear to me which versions are really affected and need patching and which not? Their own CVE issue states that Ubuntu 14.04 to the latest upstream ...
-2
votes
1answer
78 views

Howto securely invoke a script on a remote server?

I have an application running on a dedicated (Ubuntu) server. There is also a desktop GUI which functions as dashboard for the application. I want to be able to start and stop the application from the ...
0
votes
1answer
426 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...