Questions tagged [ubuntu]

Ubuntu is a Linux version derived from Debian. For questions about Ubuntu that are not about security, please post on [AskUbuntu.SE].

Filter by
Sorted by
Tagged with
0
votes
0answers
43 views

Explanation for automatic tunneling attempt

I run a web forum built using Django, hosted on an Ubuntu 14.04 flavored VM. My users post comments and photos. Recently, a user left the following comments in one of the threads (as a verbal threat I ...
1
vote
1answer
1k views

Setting up Knockd issues

So i'm busy setting up a knockd service on a VM to enable SSH login when the correct sequence of ports are "knocked on" using knockd and ufw. The issue that I am currently having is that when the ...
1
vote
0answers
16 views

Meta Backup with Temporary Connections

I have an Ubuntu server set up as a NAS server among other things. I use that space for my backups, but for safety, I back up certain crucial files to an external USB Hard-drive. I back up about once ...
3
votes
1answer
359 views

Security onion only Seeing broadcast traffic and its own traffic

I am attempting to test my new security onion install. I have it set up on a static IP Ethernet adapter in a virtual machine with an IP of 10.0.3.47 When I go launch Sguill, it seems to work well ...
2
votes
1answer
82 views

What is the latest samba vulnability, and should I care?

I've seen this post on Slashdot. Quote: there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced. But she said it had taken researchers ...
0
votes
1answer
488 views

How to dissable 1024 bit Diffie Helman, SHA1, DES-CBS-SHA

We are using ubuntu server with apache 2.4 For PCI-DSS compliance need to disable 1024 bit Diffie Helman, SHA1, DES-CBS-SHAencryption and hashing ciphers. currently I am using below settings. ...
5
votes
4answers
6k views

kworker34 malware on Linux

Clam found this file named "kworker34" in the /tmp directory on my Ubuntu linux machine. I promptly deleted this file. Also found a shell file, kws.sh in there. Looks like it is connecting to 2 IP ...
1
vote
1answer
79 views

Hypothetical Scenario: How will an Ubuntu computer fare? [closed]

Imagine, for instance, a wireless network with four to five devices connected. Some are android phones, some are Windows computers. The attacker (Alice), a world-class expert from a nation-state's ...
5
votes
3answers
950 views

How to secure an OpenSSH server on Windows Subsystem for Linux (WSL)?

What are the basic security actions I should take when securing an OpenSSH server on Windows Subsystem for Linux (WSL), especially when I am the only one that should login to this server, but can't ...
2
votes
1answer
668 views

Apparmor profile denying read access with r flag

I generated an apparmor profile for the tor binary that comes bundled in Ricochet: # Last Modified: Sun Apr 2 2017 #include <tunables/global> /ricochet/*-ricochet/tor { #include <...
1
vote
3answers
390 views

How to secure my network and system setup? [closed]

I have 2 severs and 12 systems (All having UBUNTU) connected to each other over LAN. The 12 systems use multiple databases (Redis/Postgres etc.) hosted on the 2 servers using LAN. Now, I need to ...
4
votes
2answers
1k views

What lies behind this complicated shellcode on linux?

It's pretty much my first time playing around with a buffer overflow exploit. I've written a simple C program that is vulnerable to buffer overflows: #include <stdio.h> #include <stdlib.h>...
2
votes
2answers
341 views

Is a netcat server without -e exploitable?

This is related to a college assignment. I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message ...
-3
votes
2answers
2k views

What logs to look for on Ubuntu when Postgres DB is hacked! [closed]

Updated the question title to clarify that this post is not asking the community to answer "how we got hacked" but "what logs to look for or pointers that may help our investigation". We feel that ...
1
vote
1answer
5k views

How to prevent host header attack in Ubuntu Server 14.04?

If we send a request from any host like example.com our server gives back a HTTP 1.1 200 OK response status. In correct condition it should show either 302, 400 or 404 error message (not found ...
1
vote
1answer
101 views

Ubuntu 14.04 Laravel Web Server - What should I be concerned about? [closed]

This is my first web-server which I'm looking to construct for my client. I have developed a Laravel application which has been fully deployed onto this server; now i'm looking for any security issues....
1
vote
3answers
2k views

Are these log entries normal?

I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top. User dinko was just some random user that I created and had a Ruby application ...
1
vote
1answer
91 views

Any known risks with Elastic File System?

I want to give some of my clients the ability to write files via SFTP, which later I can read from my main server. Since I'm using EC2, to do so I simply opened an Elastic File System (EFS) and ...
1
vote
0answers
209 views

security breach: php file edited on codeigniter site, ubuntu server

I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
0
votes
1answer
73 views

Is there any serious vulnerability or danger if the hard-disk gets disconnected often?

I'm using a Lenovo machine which runs ubuntu 16.04 which is installed in an external Seagate Hard Disk (of size 1 TB). Sometimes (happens from the beginning of installation) the hard-disk gets ...
1
vote
0answers
180 views

spoof OS name in ubuntu for nmap scans [duplicate]

How can I spoof the OS CPE that is reported by nmap? This is my CPE: OS CPE: cpe:/o:linux:linux_kernel:3 when scanning with nmap leakage all my OS properties. But I need to change the original ...
0
votes
1answer
1k views

Exploiting a buffer overflow in ubuntu terminal [closed]

I'm trying to exploit some buffer overflow through linux terminal of a program I've written for self education. I'm inputting a string usnig scanf("%s") and my goal is to overrwrite the return address ...
2
votes
1answer
344 views

FTP session opened from an unknown IP

I have a website made in Magento and hosted on an Ubuntu server and since a few months have been registering FTP connections open from unknown IP trying to open the file lic.php. In the proftpd.log ...
0
votes
1answer
207 views

Locking down Ubuntu

A competition is coming up at my school for securing computers and my OS for this challenge is Ubuntu. I'm trying to think of things to add to my list of security measures and things to look out for. ...
5
votes
2answers
420 views

Why does Ubuntu make requests to these Amazon EC2 IPs at startup?

Each time I bootup and login to Ubuntu 16.04, and before I launch any software/browser, I watch in Wireshark that Ubuntu has some requests to and from these IPs: 54.173.79.111 54.231.40.234 Whois ...
4
votes
2answers
380 views

What is the best way to approach and generate apparmor profiles?

I'm thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I'm doing in a right way. So, I'm thinking to begin with apache2 profiling. Right now I'm ...
2
votes
2answers
147 views

Will changing permission of /bin & /usr/bin increase security?

Normally permissions of folders like /bin & /usr/bin ... are -rwxr-xr-x (755) - executable and readable by anyone. So my idea here is to change permissions to -rwxr-x--- (750) - not anymore ...
0
votes
2answers
166 views

Flooded with apache2 processes

It seems that I've being flooded with requests to my websites, which is very strange, I only use my server for private use, I can only assume that who ever is doing this has a bad motive. This is ...
2
votes
2answers
499 views

Is Ubuntu Guest Session safer than Ubuntu Live CD for examining malicious USB drives?

I have some allegedly malicious USB drives that I want to test. I have an already installed Ubuntu OS with a guest session and the Ubuntu Live CD. Which environment setup is safer for testing the ...
0
votes
1answer
2k views

Whitelist mail domains and users to smtp on mail server

Lately our mail server (postfix 2.9.6, ubuntu 12.04, courier) got compromised by spammers that are send plenty of dummy mails to many recipients, The spammers used two different ways: 1- using real ...
0
votes
2answers
6k views

Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32

I am using nodejs and Ubuntu. When i scan my domain on trustwave.com i got following error Block cipher algorithms with block size of 64 bits (like DES and 3DES) birthday attack known as Sweet32 ...
4
votes
2answers
30k views

How to get openssl to use a cert without specifying it via -CAfile

I'm using this command: openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/GTE_CyberTrust_Global_Root.pem It works. If I don't specify that CAfile I get a code 20. The cert is in /etc/...
1
vote
2answers
6k views

This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F

I am verifying my domain name with SSL LABS and got Grade F and i got this message This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to ...
3
votes
1answer
936 views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
10
votes
2answers
286 views

How to approach creating a Linux app that requires root privilege?

I'm working on an indicator for Ubuntu, and one of the tasks it's supposed to perform is chmod -x and chmod +x a specific root-owned binary (/usr/lib/x86_64-linux-gnu/notify-osd to be precise). As far ...
1
vote
1answer
405 views

Trying to understand ASLR in Ubuntu 16.04

Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right? .... f7fd8000-...
3
votes
0answers
2k views

Dirty cow freezing [closed]

I checked my Ubuntu PC for dirtycow vulnerability, by using following code I downloaded from here. I compiled and run this code and run.When i execute this code using cc . $ gcc cowroot.c -o ...
1
vote
1answer
526 views

error in running snoopy in kali linux 2016.2 [closed]

I have installed the snoopy tool in Kali Linux but when I run the tool from terminal it's giving this error. Can you help me to solve this? I've also tried pip install libmproxy ___ _ _ ...
0
votes
3answers
873 views

Make Files Encrypted As They Download

Is it possible to encrypt a file as it downloads? Security is #1 concern, so what I am after is a way that once the file is completely downloaded and moved to an encrypted drive (not directly ...
1
vote
3answers
578 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
1
vote
1answer
535 views

nodev option for /tmp directory

The CIS standard for Ubuntu 14.04 LTS (01-07-2015) states that the /tmp directory should be mounted with a nodev flag - this is under the FileSystem Configuration (Section 2). This prevents the ...
2
votes
1answer
840 views

Using update with SQLMAP error

I am trying to use UPDATE or insert after getting victim database information, for that I am using command: sqlmap -u somewebsite.com/id=2 --sql-shell After that: > sql-shell : UPDATE ...
2
votes
0answers
559 views

Remote Access Trojan in Ubuntu? [closed]

Note: I have already posted this to ubuntu forums but I have not received an answer. I was given advice that information security is a better place for such a topic even if it's ubuntu-related ...
1
vote
2answers
92 views

Should I (care to) install security updates if I run on VirtualBox

I'm running Ubuntu 14.0.4 LTS on Oracle VirtualBox. The host system is Windows 10 with Bitdefender Antivirus. Should I still install security updates for the guest OS?
1
vote
1answer
810 views

Dangerous file extensions in Linux?

There are many dangerous file extensions in Windows with which an attacker could execute arbitrary commands on the target system. For example .exe, .js, .com, .wsh or .vbs. My question is now, are ...
4
votes
2answers
259 views

Truecrypt and swap

I've got Ubuntu 14.04 Desktop and I use Truecrypt to store my confidential files. I've read that since Truecrypt does on the fly encryption, it only stores its decrypted content (and user's password ...
-1
votes
2answers
211 views

SFTP user has access to its public key, is it an issue?

I have set up access over sftp, and the connection is jailed to the home directory of the user. In that directory is the .ssh folder, containing their public key. Is it a risk that they can access it?...
20
votes
1answer
8k views

How to read CVE - 2016 - 5696 correctly

The Ubuntu CVE Tracker page contains multiple tables related to kernel packages, some of which say DNE , others pending and version next to each . I would like to know how to properly read each table....
2
votes
1answer
810 views

inetsim installation perlipq/libipq error

I am trying to install inetsim on Ubuntu 14.04 where I have been following instructions from several blogs and the inetsim.org documentation itself at: inetsim download and installation Now one of ...
1
vote
5answers
5k views

How do I harden compilers (as suggested by Lynis)?

This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web. ii g++ 4:5.3.1-1ubuntu1 ...