Tag Info

New answers tagged

3

Physical access means you have all the power you need to do anything. There is no need for an operating system to prevent anything when someone is actually touching the machine. This has been convenient for the current problem I'm trying to fix, As intended. but I don't think this is desirable in any other circumstance. I do not see an ...


0

No, nobody will be able to access your encrypted data without you passphrase. This is the whole point of encrypting data.


0

I'm honestly not sure what you're asking, you seem to ask multiple questions. What I get is, is that you're asking wether someone with physical access to your PC, can access your encrypted data? If a person has physical access, and your PC is running, they can at the very least access the decrypted data from memory. If the PC is turned off, they will need ...


2

I am writing now from the machine that works exactly that way. First, you will need to put whole /boot folder on the dongle. Encrypt the disk with key file and put the keyfile into the boot dongle too. Edit /etc/crypttab, add this line sda2_crypt UUID=14-88 /dev/disk/by-uuid/88-14:/rootfs.key luks,keyscript=/lib/cryptsetup/scripts/passdev where ...


5

In order to log on to a machine you need to know both the user name and password. /etc/passwd provides information on users which gives you half of the information you need and used to include a hash of your password. A hash being something calculated from your password. It is difficult to find a password from a hash but not the other way round. If you ...


24

Technically /etc/passwd isn't that scarry. In the past it has been used to store private data, passwords obviously, but as of nowadays you'd need to be more worried about /etc/shadow. Why every pentester/white-hat as well as black-hat target /etc/passwd is that this file is often used as proof of concept, as a test of possibility of gaining access to a ...


0

Ubuntu has more then that i think! Cyber Sec I PPa's (Cybersec Team) Black hat sec PPA's ( by D4RkNiK0l4s) Utopic ppa:darklordpaunik8880/kalibuntu ppa:darklordpaunik8880/kalibuntu1 Trusty ppa:cybersec/chaos-ppa ppa:cybersec/chaos-ppa-v1 ppa:cybersec/chaos-ppa-v2 ppa:cybersec/test ppa:cybersec/trojan-horse ppa:darklordpaunik8880/darkminttrustytahr ...


2

Yes and no. If you're browsing the internet, you can be tracked on anything since you're requesting data from external servers, which keep track of that data and when and who from it was requested. If you're talking about spyware, there are very few spywares out there for Ubuntu, but they're out there. Linux is "Security through Obscurity"


0

For Tomcat 6, in addition to the above, we also had to do the following: In server.xml connector, add: ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA" Source: ...


0

Yes, it is safe as long as you have a complex wifi password.The only way for people to get in is by gaining access to your wifi or router (wan). I recommend that you use a password though. If you want to ensure that nobody is on your network, run the arp -na command (you can also use nmap to scan the whole netmask).


2

As long as you only use this on your private home network and you don't share the network with other people that you don't know/trust (such as in an apartment complex), then you should be fine. WPA2 can be breached through brute-force attacks but someone would have to be in range of your wifi connection in order to attempt to gain access, and if you're very ...


0

I installed Xubuntu 14.04LTS on my HP 2000-2b09WM Notebook PC. Apparmor works on the installation, therefore, I know that the problem was the fact that I was running from a live-usb. clearkimura was right-on, thank you. RCline7


0

Perhaps the Ubuntu "Minimal CD", aka the "minimal ISO image", is close enough to what you are looking for. "Installation/MinimalCD": http://help.ubuntu.com/community/Installation/MinimalCD After doing a minimal install, I think there's only one more thing you need to do to allow ssh connection: The Ubuntu Server Guide says (in the OpenSSH Server ...


0

I found this blog article that listed the steps for manually installing OpenSSH 6.7. I followed the instructions, using OpenSSH 6.9 instead.


1

I am experiencing the same issue. While I await a fix from ubuntu I have also decided this is an issue I would address with my CSA; for the following reason. If I understand the issue presented, the issue only arises if a root user on the affected computer is allowed to forward X11 connections. In my environment, the same root users on the affected ...


3

When users log in as a guest, their entire home directory is clean and is deleted as soon as they log out. Of course, asking users to log in to Ubuntu and to log out when they're done may not be as convenient for them as a browser in kiosk mode.


8

I focused on this: without them being downloaded to computer There is a Mozilla tool for this called mkiosk: Firefox Kiosk Mode with optional Tabs Guides for Public Access Point. Complete solution. Block downloads/addon, bookmarks, reset kiosk inactivity, retry on errors, restricted interface, show favorites as buttons and more! This will ...


3

The Solution for your problem will be a shell script which will delete those downloaded files in regular time intervals. Put this in your shell script and save it as deldownloads.sh find /home/<username>/Downloads/* -mtime +1 -exec rm -f {} \; More options You can change the path to point to any folder. Make sure you use absolute path. You can ...


1

Apparmor that runs normally will show a number of loaded profiles. However, this is applicable only when Xubuntu has been installed to the local machine. Could it be because I am using the live-usb? So the short answer is, yes. And it is not just Live USB, but also applies to Live CD/DVD regardless of the Xubuntu releases (I have confirmed myself ...


1

This looks like repeated attempts to log in as the root user via ssh, whether it's a real person or a bot is not clear, or particularly relevant. Reverse checking the IP shows that it's coming from Russia. It's not a good idea to be able to ssh into your system as root for precisely this reason. Of course, if you've already denied access, or not activated ...


1

Robots trying to guess your password. When you have public IP and running service on open port, they are trying all the time. If you are not specially targeted and have reasonably strong passwords or disabled password authentication, they are harmless. It is just eating your processor time. You can fight with this by hiding your service to different port, ...


0

You can use wildcards for the AllowUsers line on the /etc/ssh/sshd_config file. So it would be feasible to add the line: AllowUsers *@192.168.1.100 Or: AllowUsers *@hostname To allow everyone from that IP address or hostname access. Remember to: service ssh restart Once you've made the changes, so long as you're on a version before 15.04. 15.04 ...


1

See man sshd_config. There is possibility to add AllowUsers block where you can specify both user and host like this: AllowUsers user@host # or IP Of course you need to specify also other users you want to allow login from, if you have some. Another solution (depends on bug fixes!) As I think about it once more, there is possibility to modify your ...


0

You can generate the missing hostkey via: ssh-keygen -A ed25519 is a bit faster and more secure. It's not necessary and, aside from logspam, this doesn't have that much effect. You could, indeed, comment out HostKey /etc/ssh/ssh_host_ed25519_key, without much effect. But, at the same time, `ed25519 is a good host-key format to support.


0

Nmap covers misidentified hosts in the online documentation, but here is the short version: Make sure you are using the latest Nmap. Get better scan conditions. Nmap will give unreliable results if you are more than 5 network hops away, if you are scanning with -T5, or if there were no open or no closed TCP ports discovered. Send a correction if Nmap still ...


0

What command did you typed in to get this output ? May the man nmap can help you to fix your command if you don't want to share it. To get to know your ubuntu version use lsb_release -a The output should be like No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 15.04 Release: 15.04 Codename: vivid To check your nmap ...


2

Try looking at multiple blogs which address a certain issue. There may be details that one blog addresses but another does not. I would also suggest you keep a log of the changes you make in case you need to revert them in the future. And if something comes to worse, you can always reset Ubuntu to its default configuration.


30

TL;DR No, you are not 100% safe. Or with other words, think twice. ;) Don't execute code snippets without understanding the basics. Use man to learn more about a command or a program. Use Google or an other search portal if you don't understand. And if you still doubt, simply do not execute the code. Do you trust me? Then run: man man Ok, not ...


3

Some blogs are definitely a lot better than others. And yes, it's hard for beginners to tell the difference. Number one, make sure the instructions are for your version of ubuntu. Non lts releases only last for 9 months or so. Blog posts last a lot longer. And what worked for older releases often don't on newer ones. Also, don't do it if they don't ...


4

My general assumption on this would be yes, because the guys here at askUbuntu usually know their way around. However, in general I always like to understand what I'm doing, so if you get an answer with a command / syntax you're not familiar with- just ask for a wider explanation. I'm sure that the person that helped in first place wouldn't mind on sharing ...


5

The same applies for any network you do not trust completely: Only use TLS (that is to say, only use URLs that begin with https://) Don't accept any certificates that aren't globally trusted. Remove certificate exceptions from your browser If in doubt, use another encrypted network layer like socks over SSH, or use a VPN to a safe network. You could ...


3

A basic Desktop firewall is going to deny inbound and allow outbound 'traffic' in a basic setup. Essentially, while Windows can incorporate application-based filtering, it's default rulesets are to permit outbound and reject inbound except where the outbound traffic is getting a response. This is the typical "desktop" firewall setup usually observed in the ...


2

It has to be for security reasons, so a guest won't be able to somehow "hack" the system and gain administrator rights, making changes which will break the OS. What if a "guest" knows some kind of security hole and somehow logs in without knowing the password of root or another privileged user and log in using su? Then he/she may even run a rm -rf ...


4

Please note: This latest vulnerability (CVE-2015-1793) was introduced in a recent update to OpenSSL package (as maintained by OpenSSL.org). OpenSSL's latest advisory: https://www.openssl.org/news/secadv_20150709.txt This should not affect a standard Ubuntu install. from: ComputerWorld >> OpenSSL fixes serious flaw (Jul 9, 2015) ".. the OpenSSL ...


1

No, you are not vulnerable to CVE-2015-1793, but you are likely vulnerable to several other bugs. The latest version from the Ubuntu Security Team version is in the trusty-updates and trusty-security repositories as expected (see the Security Team FAQ) and the CVE tracker says that it isn't affected. If you can't see this version yet, check: if you have ...


1

There is a link to the appropriate bugs page right there on the wiki page. Just click on the link, and then on the resulting Ubuntu-docs bugs page click on the "Report a bug" link in the upper right corner of the page. You should end up here. You will need to have a launchpad account. Note that there is controversy over that particular wiki page because it ...


1

I would combine parts 1 and 2. MySql allows you to take encrypted backups as detailed here: mysqlbackup --backup-image=/backups/image.enc --encrypt --key-file=/meb/key --backup-dir=/var/tmp/backup backup-to-image The next bit would be to push the image up to a cloud service. This comes down to personal preference. If you like Dropbox, it has a ...



Top 50 recent answers are included