up vote 0 down vote favorite

I have a Ubuntu 14.10 machine and I would like to check if my security is OK. I doubt that some one accessed my machine from internet and remotely controlled it. so what are the suitable tools I need to use to see if that really had happen and what are the logs related to this issue I can check for history ?

share|improve this question

closed as too broad by Eliah Kagan, muru, Elder Geek, guntbert, Fabby Apr 12 '15 at 16:50

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
4  
-1 This is far too vague, what makes you think you are "hacked" ? this is unlikely, do you mean you have a virus, here's some reading on basic security, including vulnerability and how to improve your security wiki.ubuntu.com/BasicSecurity, but we need more info on your specific issue to help you, do you use a firewall or anti-virus, how/when/where were you "hacked" – Mark Kirby Apr 12 '15 at 5:59
    
WOW , all this down votes and close requests for a question i see normal that's strange anyhow i was just looking for a guidance of a some linux tools or how to check my logs to check if my machine had been accessed from internet or by some people – Fat Mind Apr 12 '15 at 12:08
1  
I don't know why this got flanged, it shouldn't of, but I down voted because of a lack of detail, I told you what areas were lacking, don't take it personally, how can anyone tell if your computer was hacked without access to it or at least a good explanation of how you use it and what you mean by hacked, you say "i was just looking for a guidance of a some linux tools or how to check my logs" Your question in no way says this, please update it so we can help, and I will change my vote. – Mark Kirby Apr 12 '15 at 14:08
1  
If by hacked you mean someone tried to get access to your pc remotely, this may be what you need askubuntu.com/questions/178016/… – Mark Kirby Apr 12 '15 at 14:19
    
hope the new edit make the question more clear – Fat Mind Apr 15 '15 at 12:14
up vote 5 down vote

It is a very vague question because Ubuntu Security is pretty good out of the box, and if I would have hacked your computer, you would not be able to actually check that you were hacked as I would have installed a rootkit, and the only way to get me out of your computer would be by restoring a back-up since before you were hacked…

The best way not to get hacked is to prevent it.

  • Turn off all hardware you don't need in the BIOS (this includes: microphones & speakers as they have been shown in the past to be used as communication channels once the PC was hacked, printer ports, USB ports, WiFi, etc)
  • Don't install Ubuntu in an Internet café, but at a secure Internet behind a NAT router.
  • Install RKHunter just after installing from DVD
  • Black-list all hardware you don't need and that cannot be disabled in the BIOS
  • Secure your system
  • Always install all updates
  • Don't let anyone physically touch your computer
  • Use encrypted communications
  • Install as little software as needed (and uninstall software you don't use any more)
  • Don't install software known to track you (flash, silverlight)
  • Use Firefox with the noscript and modify headers plugins
  • Disable all cookies. Only allow cookies per site and only for the session.
  • Make system back-ups so you can roll back to previous versions
  • Use full disk encryption
  • Only use the Ubuntu official repositories as Linux isn't invulnerable
  • …

and then you'll get rid of 99.9999% of hackers.

Fair warning: I didn't do all of the above (just some) but I use the most important security rule of all: Use common sense!

share|improve this answer
1  
Everyday is not sunday, It might not get 23 upvotes like previous similar question – Faizan Akram Dar Apr 15 '15 at 1:54
    
I think It was simple for some one to tell me to check /var/log/auth.log ... where I found some evidence for trying to access my machine from china – Fat Mind May 6 '15 at 9:14
    
If any decent cracker would have cracked you machine, there would have been no way for you to find them back in any of your logs, as the first thing a cracker does is cover his/her/its tracks. If you're looking for more information on how to interpret log files, here's where you need to look. – Fabby May 6 '15 at 10:51
    
If you like the answer, just click the little grey ☑ of the left hand side of the answer now turning it into beautiful green. If you do not like the answer, click on the little grey down-arrow below the 0, and if you really like my answer, click on the little grey checkmark and the little up-arrow... If you have any further questions, go to askubuntu.com/questions/ask – A.B. Aug 13 '15 at 14:17
1  
@FatMind traces of a user in /var/log/auth.log are evidence of you NOT being hacked, not of someone hacking you. 1st thing I would do is remove the lines in there showing I was on your system. – Rinzwind Aug 13 '15 at 14:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.