New answers tagged

1

Seems to be a reported bug (#1554803) It can be solved installing apparmor-easyprof-ubuntu or creating the folders by hand.


-1

You just need to edit this line from file /etc/ssh/sshd_config from yes to no . ChallengeResponseAuthentication yes ChallengeResponseAuthentication no


0

The "suspicious" activity is explained by the following: my laptop no longer suspends when the lid is closed, the laptop is a touch screen and reacted to applied pressure (possibly my cats). The provided lines from /var/log/auth.log, and the output of the who command are consistent with a guest session login. While I disabled guest session login from the ...


15

The current version does indeed include the mitigations for these vulnerabilities. Rather than keeping up with the OpenSSL releases, the security team prefers to backport fixes. You can confirm that the package contains the mitigation for the CVEs listed in the question by downloading the Debian packaging for the openssl package: apt-get source openssl ...


1

I just want to mention that "multiple browser tabs/windows open, Software Center open, files downloaded to desktop" is not very consistent with someone logging into your machine via SSH. An attacker logging via SSH would get a text console which is completely separate from what you see on your desktop. They also wouldn't need to google "how to install git" ...


4

find command is the most appropriate for this task, in combination with stat , you can see the owner of the file find $HOME -type f -executable -printf "FILE:%p OWNER: " -exec stat -c "%U" {} \; Or purely with find printf: find $HOME -executable -printf "FILE:%p OWNER:%u\n " And if you're adventurous enough, here's a pythonic solution: import os ...


3

find ~ -type f -executable should work. Maybe add -exec ls -l {} \; to get user and group.


0

Not sure if its what your looking for, but i always install privacy badger on my Firefox to help get rid of potential trackers. Hope i could help. PS. privacy badger is multi browser: https://www.eff.org/privacybadger


1

Your question is pretty broad, but inferring from your first sentence about "different security measurements" for home, etc, I would recommend you try gufw gufw is a GUI front-end to the ufw firewall and it allows you to create profiles for home, etc. sudo apt-get install gufw As a simple solution, you can just set the default Incoming rule to Deny and ...


0

If your are sure you have been hacked then the course of action is clear, get an iso make sure its not compromised, make yourself a LIVE CD/USB and do a clean install while disconnected from any network. IF already someone got access to your machine he might have changed essential parts which allows him to gain entry again and again even if you change your ...


2

This will be a bit of a simplification, but I'll try to go through the process of accessing a file on an encrypted filesystem. For example, let's say a the beginning of the encrypted filesystem there's a file table; let's say we want to read /foo.bar. So, the first thing we do is read the beginning of the partition, decrypt it, and look through it for the ...


6

hidepid procfs on Linux now supports the hidepid option. From man 5 proc: hidepid=n (since Linux 3.3) This option controls who can access the information in /proc/[pid] directories. The argument, n, is one of the following values: 0 Everybody may access all /proc/[pid] directories. This is the ...


0

Modern computers can do billions of operations per second, so it doesn't surprise me that encryption and decryption are fast. This is how I would intuitively rank how fast computers are at doing things: Doing calculations within memory (especially L1 and L2 memory), extremely fast Reading from local storage, less fast (solid state disks are faster than ...


2

How does AES / Rijndael Encryption in general work? This page has a fun A Stick Figure Guide to the Advanced Encryption Standard (AES) that looks easy to understand, though it looks to be 50+ images, for example these two: and It's far too much to duplicate it all here, but if you have to have an all-in-one image it's this one: Or, there's a ...


-2

Pull out the wireless card/stick and look over the traces. Make a record of your logs so askbuntu can help further. After that wipe your drives and try a different distro, try a live cd leave it running to see if there's a pattern to the attacks.


0

For large numbers of users/certificates consider LDAP integration. Large organizations use LDAP as a repository for user credentials and certificates stored on badges or fobs, whether the certificates are used for authentication or signing emails. Examples include openLDAP, openDJ, Active Directory, Oracle Universal Directory, IBM Directory Server, ...


2

Do you have any friends that like to access your laptop remotely/physically while you're gone? If not: Wipe the HDD with DBAN and reinstall the OS from scratch. Be sure to backup first. Something may have been severely compromised within Ubuntu itself. When you reinstall: Encrypt /home. If the HDD/laptop itself is ever physically stolen, they cannot gain ...


22

It looks like someone opened a guest session on your laptop while you where away from your room. If I were you I'd ask around, that may be a friend. The guest accounts you see in /etc/passwd and /etc/shadow are not suspicious to me, they are created by the system when someone open a guest session. Apr 27 06:55:55 Rho su[23881]: Successful su for ...


31

Wipe the hard drive and reinstall your operating system from scratch. In any case of unauthorised access there is the possibility the attacker was able to get root privileges, so it is sensible to assume that it happened. In this case, auth.log appears to confirm this was indeed the case - unless this was you that switched user: Apr 27 06:55:55 Rho ...


2

The processor uses dedicated instruction set. It is possible because of it, AES-NI. It enables fast encryption and decryption or you can say it cuts the overhead. It is fast because it is hardware implementation, as explained here. You can check about performance impacts here and they are worth it for added security.


2

The easiest and most fail safe way will be to save your files in password protected archive files, 'zip' being the most popular archive file format supporting such protection. This format is supported directly in most OS's including Ubuntu and Windows, without installing any other applications. If you want complete drive encryption you'll have to install a ...


3

Xenial Xerus now has a newer version of irssi: andrew@athens:~$ irssi --version irssi 0.8.19 (20160323 0008) This version has built-in support for SASL and has been set to reject the cap_sasl.pl script with the error message in the question. Easy enough to fix by closing irssi and removing the script and links to it: mv -v ...


6

/ should not be world-writeable / being world-writeable can be a huge problem. Having write permissions on /, any user can move/rename any file or directory in /. This means that any user can replace /etc, /usr or any of the other directories in / with directories of their choosing. Denial of Service: Trivial Any user can trivially DoS your system, by ...


6

No. It's not safe for / (the root directory) to have 777 permissions. That means rwxrwxrwx, i.e., every user has write permission to the root directory. With that permission, every user will be able to create new subdirectories, delete existing subdirectories, and replace existing subdirectories. For instance, a malicious user could delete /bin (by ...


9

That is interesting that the / actually allows 777 permissions to be set on it. The / folder should not have 777 permissions, as this means that any user logged into the system can create files and folders at the / root level. I have tested this in a VM and you CANNOT delete any of the folders or files that are not 777 without being sudo, root or the ...


2

It depends on your privacy concerns... Your username and hostname could be used by someone who cracked your wifi as a "hint" to access your samba/netatalk shares. It can reveal some info about you depending on how you named the host and your username... But these are not a system vulnerability, but a privacy concern. I, personally, change my hostname and ...


0

I asked this question at SCALE. Live kernel patching isn't going to be here in 16.04, probably not in 16.10 but maybe in 17.04 according to what the presenters said.


3

As I understand it, it only means that as long as you use X11 Snap doesn't provide any additional security over using e.g. apt packages. So you will need to remain just as careful about your software sources as before. When running on Mir, supposedly Snap provides much better isolation between applications (sandboxing), which could provide more security ...


3

Unfortunately, no; last access time is the only thing that can help you and it's not recorded by default on FAT filesystems (if you try with stat, you'll find a semi-fake number, based on last mount I think): θ64° [romano:/media/romano/PEN8G] % stat present.pdf File: ‘present.pdf’ Size: 291235 Blocks: 576 IO Block: 4096 regular file ...


0

The short answer is "no, not on a vanilla Ubuntu distribution" (and btw, hitting printscreen is not the only way to take a screenshot). The somewhat longer answer is that the question is ill-posed. Whether some approach might work would depend on the specific combination of X server (or whatever display server you are using), window manager, whether you ...


0

There is no added benefits to using https for checksums. HTTP might be insecure but that does not make the "sums are provided over HTTP" insecure. See the discussion on launchpad about this. Comment 8: It doesn't matter if the ISO, checksums, and public keys are served insecurely (although it would be simple if they were), as long as the public key ...


2

In normal cases where you want a stable deployment of lets say LAMP and all what comes with it in production environment security updates are sufficient. You need to change the /etc/apt/apt.conf.d/10periodic file to this: # switches on the apt get update run 0 for off APT::Periodic::Update-Package-Lists "1"; # lets the server pre download available ...


6

Given you have sufficient permissions, the find commands will recursively change the permission bits of all files to 660 and all directories to 770 starting from the directory where it is run. As you were in /root (root's home directory) and assuming you were running as root and the owner user:group is root:root, this should not be a major problem except ...


2

That command locates all of the directories from within the directory that you ran the command and modifies its permissions. It then does the same but with files. In this case, the command changes the permissions of the directories so that you have full access but other users will not have any access. If you are the only user of the system, then this should ...


0

That first dot after the command is the root of the tree where find searches. So it affected the files of the folder you ran it, and the whole tree below it.


0

This answer is more for if you just want to simplify / automate different tasks you do using scripts and crontab. You can set up a script that you can run whenever you wish. #!/bin/bash chkrootkit rkhunter cat /var/log/auth.log | grep opened | grep sshd:session | more #the ' | more' splits output into multiple screens, you can cut it off if you want ...


2

I would personally suggest a piece of software called OSSEC HIDS (Host Intrusion Detection System) which if configured properly (which is reasonably easy to do so, just follow the installer) will regularly send you system and security related information such as what is listening on which port, if the hashsums of any important files have been changed, when ...


0

Since you are on 14.04, your packages (in main) get security upgrades for 5 years. I guess the Ubuntu team is already working on that. You'll only need the ppa if you have reason to believe it's going to be exploited at your site before the fix hits official Ubuntu packages.


2

See here for the Ubuntu security update packages: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1569497 Took a little while to get published, but a hell of a lot easier than patching 3.6.3 up to 3.6.25 and applying the official patches on top of that. NB: I tried to build 3.6.25 from source on precise and failed. YMMV.


18

The technical concept you're looking for is known as Privilege Separation. With this concept, each program uses the privileges granted to the user running the application, which is enforced by the operating system's security modules. When a user needs to do something that's outside of their normal privileges, the system challenges the user in order to grant ...


39

Your question is a bit vague, but you seem to be asking about the principle of least privilege, which basically says that a system is most secure when each piece only has the permissions necessary to do its own tasks. This limits the possibility of damage from mistakes or malicious actions. An ordinary user typically does not need to be modifying ...


10

What is BadLock Badlock is a bug that affects Windows and Samba. What Can hackers do with this security bug? Two things: Man-in-the-middle (MITM) attacks: Denial-of-Service (DoS) attacks: The Badlock CVE is: CVE-2016-2118. There are additional CVEs related to Badlock. Those are: CVE-2015-5370 (Multiple errors in DCE-RPC code) CVE-2016-2110 (Man ...


0

Most people don't realise that software encryption of your drive is unnecessary if they've got an SSD. Just set a hard drive password because the data in flash is almost certainly encrypted anyway, and the drive password protects the key. Check the specs of your drive to verify this.


3

First and foremost, I believe there isn't any encryption which can be deemed 100% secure. The reason for that is, it is human made. Despite that the evolution of hardware in the past 20 years has prooven that nothing is secure forever. Best example is here the long time deemed secure md5 one way encryption. But back to your question, your best security is ...


2

Ubuntu is affected the same way as the other vulnerable OSs: Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. In other words, Ubuntu is as exploitable as the the rest of the systems running the vulnerable Flash plugin. Flash for Linux has ...


14

You can configure PAM to do this for you. Just open /etc/pam.d/common-password and append use_authtok to the first password line (the one which calls the pam_unix module) so that it looks somewhat like this: password [success=1 default=ignore] pam_unix.so obscure sha512 use_authtok Now add this line above the previously modified line: password ...


0

You could make the root directory of the home directory world readable. This wouldn't change the mode of the files or the other directories that is subdirectories of the instant home directory. You could do this with: $ sudo chmod go+x /home/someuser The above mode parameters are: g - group access o - others/everyone else x - execute (in this ...



Top 50 recent answers are included