Tag Info

New answers tagged

0

I had the same problem on Ubuntu 14.04. LIBS=-ldl make PKCS11_INC=/tmp/truecrypt/pkcs11 solved my problem (/tmp/truecrypt/pkcs11 is where my pkcs11 files are stored.) One notice for people compiling on 14.04: do not install libwxgtk3.0-dev, use the older libwxgtk2.8-dev instead, otherwise it wont compile due to a bug in libwxgtk3.0-dev. see ...


0

This seems to work nicely: sudo apt-get install ubuntu-keyring gpgv --keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg SHA256SUMS.gpg SHA256SUMS grep ubuntu-14.04-desktop-amd64.iso SHA256SUMS | sha256sum --check


0

I'm not sure this accurately answers the question. If a file is open for reading (say, by a shared library with its contents loaded in memory), you really don't want those contents over-written unexpectedly. So, I believe the normal way (ie when data=ordered) is to write the data to disk, update the inodes/metadata, point the directory entry to the new ...


1

When looking at this I used Fedora as a reference (to see how another OS looks at this) (edit: these are Fedora's thoughts on setting up a SERVER! See the bottom part for why this is important): Documentation: accept_redirects - BOOLEAN Accept ICMP redirect messages. accept_redirects for the interface will be enabled if: - both ...


1

It's about process and policy as well as tools. I think you need a more holistic approach such as those outlined in the CIS benchmarks. I would consult the new Ubuntu one just released as well as the Apache one if you'll be running Apache as your web server. Ubuntu CIS Benchmark https://benchmarks.cisecurity.org/downloads/show-single/?file=ubuntu1204.100 ...


0

If you know to program, you can secure a web page with whatever you like. Whether it makes sense it is up to you. Basically, prompt the user on first access to supply whatever you want: a password, a file with a public key, a photo of his mother, a valid credit card number, and so on, and verify it using code afterwards.


1

You can find a deb version of Loiq (the same program, in qt) here. There's no 64-bit version, but you can install the 32-bit in any system, even ubuntu 64. Just download the package and: sudo dpkg -i loiq*.deb


1

Is there any file in ubuntu server that recommended to remove SUID/GUID bits from it? If there is it should be reported as a bug or security problem. Some easy to do check if all is normal: Find all SUID/SGID programs on your system, and keep track of what they are, so you are aware of any changes which could indicate a potential intruder. Use the ...


0

I cannot provide the reading material you need exactly, but let me tell you what do most Ubuntu users agree universally: It's safe. The Communications-Electronics Security Group of the United Kingdom Government tested many OSes, and Ubuntu was given the highest score among these. There are very few viruses for Linux, and the latest Ubuntu releases already ...


0

Beginners information on Threats/Security Some might consider this question too broad, but narrowing it down to just the desktop because of your desktop-environments tag, start with these three rules: Use a strong password that is impossible for anyone to guess, and if you write your password down, don't leave your password anywhere where people might be ...


1

Whenever you want to see what process is holding a port open, use the lsof command. For a tcp port use lsof -i tcp:80 and for a udp port use lsof -i udp:53. The info will provide all the info you require as to process name, pid, and ownership. For example: cyberfarer@Quadraphenia:~$ sudo lsof -i tcp:80 [sudo] password for cyberfarer: COMMAND PID USER ...


1

I think it's referring to apparmor which is indeed installed by default (not sure if it goes under the antivirus category though). See What is apparmor? for further details about the kind of protections it provides.


19

Ubuntu has released a patch, you just need to update and upgrade. sudo apt-get update sudo apt-get upgrade To check if you have the latest and patched version, run: openssl version -a OpenSSL 1.0.1e 11 Feb 2013 built on: Mon Apr 7 20:33:19 UTC 2014 platform: debian-amd64 Check the "built on:" item, it should be build Apr 7.


8

Why don't you update? If Ubuntu says you need 5.12, and that heartbleed site says you're vulnerable, what's the problem? I have the following installed, which was updated yesterday or today on my machine. ii openssl 1.0.1-4ubuntu5.12


10

For those who do not want to do a serverwide package upgrade. I read a bunch of these guides today and apt-get upgrade openssl === apt-get upgrade this will apply all security fixes required by your machine. Wonderful, unless you are explicitly leaning on an old package version somewhere. This is the minimal action required on Ubuntu 12.04 LTS running ...


8

I noticed many commenters here that need help urgently. They are following the instructions, and upgrading, and rebooting, and still vulnerable when using some of the test websites. You must check to make sure you don't have packages on hold such as libssl. :~$ sudo apt-get upgrade -V Reading package lists... Done Building dependency tree Reading state ...


1

It turns out that 14.04 did receive an update for OpenSSL, but I didn't see it earlier, because (according to Timo Jyrinki) security updates for pre-releases propagate through the usual mirror system (slowly) instead of becoming available right away via the repo hosted on security.ubuntu.com.


61

The bug is known as Heartbleed. Am I vulnerable? Generally, you're affected if you run some server that you generated an SSL key for at some point. Most end-users are not (directly) affected; at least Firefox and Chrome don't use OpenSSL. SSH is not affected. The distribution of Ubuntu packages isn't affected (it relies on GPG signatures). You are ...


4

OK, it seems the correct patched version varies between releases/version. http://www.ubuntu.com/usn/usn-2165-1/ quote: Ubuntu 13.10: libssl1.0.0 1.0.1e-3ubuntu1.2 Ubuntu 12.10: libssl1.0.0 1.0.1c-3ubuntu2.7 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.12


33

To see which OpenSSL version is installed on Ubuntu run: dpkg -l | grep openssl If you see the following version output, patch for CVE-2014-0160 should be included. ii openssl 1.0.1-4ubuntu5.12 Secure Socket Layer (SSL)... Looking at https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12, it shows which kind of bugs are fixed: ... ...


11

If your apt-get repositories don't contains any precompiled 1.0.1g OpenSSL version, so just download sources from official website and compile it. Below the single command line to compiling and install the last openssl version. curl https://www.openssl.org/source/openssl-1.0.1g.tar.gz | tar xz && cd openssl-1.0.1g && sudo ./config ...


108

Security updates are available for 12.04, 12.10, 13.10 and 14.04 see Ubuntu Security Notice USN-2165-1. So first you need to apply the available security updates, for example by running sudo apt-get update sudo apt-get upgrade from the command line. Do not forget to restart the services (HTTP, SMTP, etc.) that use the affected OpenSSL version, ...


0

I had this problem on my desktop after I had set on autologin and then set it off for myself. Even though I set it off in the user settings box, it remained on and automatically logged my in without requiring a password. I finally fixed it by locating and removing the following line in the /etc/group file: "nopasswdlogin:x:118:username"


0

Tested in ubuntu 14.04: Search for the "Disks" application Select Device, select volume, Click cogs (more actions) -> "Change passphrase" screenshot: http://imgur.com/wkgKjOa


0

You can SSH login without password if you want to, as nathwill said you should use passphrase for extra security, but there are ways to add more security disable password login use allowusers/denyusers white list iptables


5

I do not think you are understanding the thread you linked or the ssh server. In the thread you linked, the OP had been cracked, likely because of a weak password, but we do not know. As a result, a cracked server called sshd was installed and running. This is not the same thing as the ssh server in the ubuntu repositories. By default, the ssh server is not ...


-1

Just put in /etc/sudoers all this and it will work # User privilege specification root ALL=(ALL) NOPASSWD: ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) NOPASSWD: ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL) NOPASSWD: ALL


0

Assume you give the user their first password using some insecure media, like email or papernote. If someone (let's say Eve) happens to see that note, she could login with the same password. Making password a one-time-password removes the possibility of a second login. And if the wrong person makes the first login, well you are likely to found out soon ...


1

The whole point of password changes is to help keep "the evil guy" guessing. This is especially useful if the system has unknowingly already been compromised as it will prevent that invader from being able to easily regain access. How many passwords to keep in history would really depend on how often you demand a change in password. I have experienced ...


1

It is to prevent user from iterating over two or three passwords every time the mandatory password change happens. This is a risk because this favorite user's password may be already known to the evil guy.


1

As with any system, an extraneous account is only a problem if the following conditions are met: Can access be gained to that user? Even if you could become that user, could you do anything else? There are plenty of user accounts around the system (less /etc/passwd) but plenty of them can't be accessed without sudo access at the least. Look at ...


1

What it means is that if there are more accounts than are needed (or old accounts) anyone with access to those old accounts can get in and potentially cause harm to the system. Removing user accounts limits points of access to the system, making it more secure. Any user account that hasn't been used in 30 days should be removed from the system. The ...


8

First, get that machine off the network now! Second, why did you have the root account enabled? You really shouldn't enable the root account unless you have a very good reason to do so. Thirdly, yes, the only way to be sure you're clean is to do a clean install. It's also advised that you start fresh and don't go back to a backup, as you can never be ...


0

If you do not need something, better turn it off, indeed. There are two things that you can generally do: 1) If you do not need PHP, then turn it OFF. Under Ubuntu you can see the list of modules that are turned on under /etc/apache2/mods-enabled/ Try: ls /etc/apache2/mods-enabled/ If you see entries such as php5.conf and php5.load, delete them. ...


0

I'm pretty sure it is pointless to have disk encryption if you never turn the computer off. I could be wrong though. But if you never turn it off, it will never boot to the screen that unencrypts your hard drive. So it is pretty much always unencrypted. Do you have a /home partition that is encrypted? If so, if someone were to steal it, they would not have ...


1

Here is my analyze to the 4 possibible ways to record Firefox passwords listed in your question, plus a new solution (#5): Their are some notes to security in the README. It seems that it is not more or less secure then the original implementation. But for GNOME Keyring you have some options like auto-lock your keyring after a certain (idle) time. Source ...


0

Still not solved but: Ubuntu 13.10 won't be supported for too long. This question will be questioned, should it not build, again when Ubuntu 14.04 is released.



Top 50 recent answers are included