Tag Info

New answers tagged

0

Apport takes a Neanderthal approach to privacy. It's all or nothing. It offers one privacy protecting option, which is not to report an error in the first place. When you do report an error, it It doesn't even bother give any assurances about what information it does and does not collect. I.e. Does it always strip out filenames, usernames, directory ...


0

I recommend you to install fail2ban which is an intrusion preventation software, and works very well. It will ban the IP-address that shows malicious signs as, too many password failures, bots seeking for explotis, etc. [How to guide for Ubuntu] https://www.digitalocean.com/community/tutorials/how-to-install-and-use-fail2ban-on-ubuntu-14-04


5

Even in Debian, there are many many packages that don't get regular security updates. From the Debian security channel on OFTC IRC: The security team provides support for all packages, with the help of the package maintainers (and upstream developers). From the general discussion, we can assume that major security breakages get their attention, but ...


0

If your computer has never had an Android device connected, then I don't know where those files came from. On my computer (as I use both Android and its SDK) those files are an SSH key-pair that allow me to mark my computer as "trusted" to my phone. SSH keys shouldn't be harmful. If you want to verify that these are SSH keys, open ".android" in the file ...


0

Please note, you can set any password using root account, there rules accepted for users that trying to change it's own password. To set password expiration and other parameters for all new users you should check /etc/login.defs file. Actually your rules looks like correct, I think you just try to set password using root, but superuser (root) should have ...


0

TL;DR: Do things as root only when you have to. sudo makes this pretty easy. If you enable root logins, you can still follow this rule, you just have to be careful to do so. Although enabling root logins is not actually insecure if done right, you don't need to enable root logins because you have sudo. There are really two related questions here. Why is ...


0

You can Enhance your security by enable roundcube section Roundcube does have captcha plugins available which will mitigate this, but users will complain if they have to type in a captcha to login for mail. Fail2ban provides an easy solution for this. First up, we need to add roundcube into /etc/fail2ban/jail.conf [roundcube] enabled = false port = ...


0

According to what brought in How Effective is ASLR on Linux Systems? programs must be compiled as Position Independent Executables (PIE) to gain ASLR benifits. For gcc compiler -fPIE switch should be used to compile programs which use ASLR: gcc -fPIE -o ./test.o test.c^


0

Maybe this will help you: Privacy in Ubuntu 12.10: Full Disk Encryption


0

If someone searches for more details: I solved my problem with the fingerprints of the keyfiles (you can get them with apt-key finger) and compared them with other (secure) systems. Maybe helpful is this thread: How do I know my system updates are trustworthy?


0

The validity of the packages is checked against a keyring which can be explicitly specified with the --keyring=KEYRING option of debootstrap (see man debootstrap for details). If omitted debootstrap uses system keyrings which you can easily install with [name]-keyring packages in synaptic/apt-get and (only slightly more complicated) from source. If ...


1

You can just change the directories permissions to 700 (which equals to rwx------ which means no access at all for everybody, except full access for the owner). That way, no normal user (except your user account!) can enter the directory. They will still be able to see the folder from the outside, but they neither can open it to list its content nor can ...


1

you can use steganography method its not also protect your files it also hide your files https://scottlinux.com/2014/08/12/steganography-in-linux-from-the-command-line/ first install steghide sudo apt-get install steghide 2nd steghide embed -cf tux.jpg -ef mytext.txt Enter passphrase: Re-Enter passphrase: embedding "mytext.txt" in "tux.jpg"... ...


1

There's also the consideration of installed base and usage. Bash is present on practically every Ubuntu installation out there, is at the heart of an extremely large number of scripts, whereas Java ... not so much. I'd any day grant a higher priority to a bash exploit than a Java exploit. (And to hear people speak of it, Java exploits pop up every now and ...


4

All official flavours of Ubuntu, including Kubuntu, use the same repositories. Canonical commits to providing security updates to software in the main, and restricted, sections of the repositories. From the Security Team FAQ: What software is officially supported by the Ubuntu Security team? Ubuntu is currently divided into four components: ...


4

First, edit the /etc/sudoers only with visudo You can set the permission to the user joe for apt-get command only adding the following line: %joe your_hostname=(root):/usr/bin/apt-get Once logged in as joe, you can check the permissions: sudo -l Edit: The user will be able to use apt-get update, upgrade, install, etc; since those are just flags for ...


2

This is probably just a false positive. /usr/share/mime/mime.cache is a generated file of all known mime types on your system. It's not an executable. Virus scanners detect malicious software by sets of known fingerprints (hashes). This model leads to some false positives, inevitably. Perhaps it's a coincedence a known Windows virus matches the fingerprint ...


3

My initial reaction was to say it's a bad idea. However, having looked at your specific personal sudoers file, I'd say, no; it looks pretty standard for an Ubuntu system. You're not exposing any of specific software versions (that may have vulnerabilities) non-standard usernames (though if I was a bad guy, I'd be trying 'josh' or 'joshua' I quickly ...


0

I would advise you not to publish anything in a public repository, which is located in the /etc directory. This information will make you vulnerable in the worst case. The risk that you overlook a file containing sensitive data is too large. Maybe it's enough if you only commit the data, but do not push. Then the changes are saved locally.


1

Not installing security updates creates a situation in which hackers can use your machine to tamper with your data and use your machine to attack others. For example, an operating system that is using OpenSSL that has not been updated can be tampered with and cause your data to be leaked.


3

Yes, signed with the same key as the other Ubuntu releases. E.g. Download both the checksum files and the detached signature: http://cdimage.ubuntu.com/kubuntu/releases/14.04.2/release/SHA256SUMS http://cdimage.ubuntu.com/kubuntu/releases/14.04.2/release/SHA256SUMS.gpg Then verify it against the preinstalled APT keyring which should have this key: ⟫ ...


1

Attack Vectors The Ubuntu installer brings (equally to pretty much all other Linux distributions) a set of OpenPGP keys trusted by the package manager. Given you download/get hold of a tampered ISO image, different things might happen based on what was changed. If the OpenPGP keys have been changed, you might either not be able to install updates any ...


1

You should have the tool cryptsetup already installed. To show details of the current cipher you can run the following command: sudo cryptsetup status sda5_crypt Replacing sda5_crypt with the name of your encrypted volume. You should see an output similar to this: type: LUKS1 cipher: aes-xts-plain64 keysize: 512 bits device: /dev/sda5 ...


1

Can we say with certainty that an IP from china somehow SSH'd into my machine? Even though it only accepted RSA key authorization? It is unlikely they were authenticated, unless they managed to obtain a valid key. Try connecting from a host you control without a key and check the running processes. They should be similar to what you saw. The fact the ...


1

Lots of ssh brute force attacks taking place. It is possible you have an obsolete ssh package and they got in that way. Check for ssh failures in the logs, he maybe simply doing a brute force against you. go to /tmp and post its output from ls -al, if there is a root kit it might show up there. You can set allow users in ssh and fail2ban is useful as ...


2

It is a very vague question because Ubuntu Security is pretty good out of the box, and if I would have hacked your computer, you would not be able to actually check that you were hacked as I would have installed a rootkit, and the only way to get me out of your computer would be by restoring a back-up since before you were hacked... The best way not to get ...


0

Those packets are igmp packets from the router itself. "The Internet Group Management Protocol (IGMP) is a communications protocol used by hosts and adjacent routers on IPv4 networks to establish multicast group memberships. IGMP is an integral part of IP multicast." I do not use UFW, but in my iptables rule set I have a rule to drop those packets without ...


1

To answer the actual question: Yes, a software can write to a device directly but contrary to your assumption this doesn't destroy a file system since software also can read directly from the file system. If the software does everything right it would just be like reading and writing the usual (indirect) way. Remember that it just had to do what your system ...


0

until this bug is resolved, you can try to first kill plymouth. Unfortunately, there is no easy way to determine the PID of plymouthd. But plymouth knows how to quit itself :-) So the following should be sufficient. plymouth --quit; echo -ne "keyphrase" > /lib/cryptsetup/passfifo


2

Stop worrying! You'll have a heart attack before your time! ;-) Promiscuous mode on a computer has nothing to do with catching nasty viruses like AIDS... It just means that your network adapter will be able to read TCP/IP packets that are meant for other adapters. (A.k.a. "sniffing" and that's a great tool to find obscure TCP/IP communication bugs)


0

If sendmail is sending out those messages, you should check the logs. Bit cheap of me, but please start at the link be below. Combine the email addresses, time stamps mentioned in the NDR's (Non-Delivery Report) and check the logs. where-to-check-log-of-sendmail But, you might not be even sending those emails from your server. It could be bounce ...


1

Use this: gpg --decrypt /tmp/directory.tar.gz.gpg | tar xzvf -


4

This ip address, 106.49.174.61, belongs CHINACACHE. xxx@xxx ~ $ whois 106.49.174.61 % [whois.apnic.net] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html % Information related to '106.48.0.0 - 106.49.255.255' inetnum: 106.48.0.0 - 106.49.255.255 netname: CHINACACHE descr: Beijing Blue I.T Technologies ...


14

It is important to install the latest security updates to help protect your system. Ubuntu base is the collective name for the tools and services and core parts of the Operating System and the following applies equally to any software installed, including what is categorised as Ubuntu based as mentioned in the question. There are situations where NOT ...


1

It never rarely happens in Ubuntu, because: all the most of the trojans and remote spy tools are programmed for windows systems. If anyone infects you with one of these tools for Linux, it will be interested particularly by you, and will take a very hard work to hack your Linux computer. 1.1. There is a good collection of fake apps and other resources ...


2

Yes, any process running with the privileges of one user is allowed do anything that user is allowed to do herself. As you correctly state, this is less of a problem, if that user doesn't have super-user privileges, which would allow him and any of her processes to modify the system configuration. Installing system-wide packages through a front-end like ...


1

a lot of security holes allow "arbitrary code" and many applications, firefox for example, or vim, allow you to start external programs or a shell or other code. Once a malicious user gets a shell they can do damage without root access or they can try to escalate privileges. This is where one would use something such as apparmor or selinux to prevent ...



Top 50 recent answers are included