How Secure Is Ubuntu - Page 1
Forum section: electronics / general

author: bostonman
author_rank: Super Contributor
timestamp: February 23, 2021, 04:05:44 pm
content: I have an old laptop with XP and Ubuntu (dual OS obviously).Is using Ubuntu for secure stuff safe, or, because it's an open-source it is vulnerable to hackers stealing information as I'm typing it?

author: grumpydoc
author_rank: Super Contributor
timestamp: February 23, 2021, 04:10:54 pm
content: A hard question to answer - security is usually a compromise and you have to understand the trade-offs you are making.If you store data which needs to be kept secure on a laptop with Ubuntu install and make sure it is locked in a safe when you are not using it, and never connect it to any networks it will be perfectly secure - and some environments might actually require that approach. Some might need even more such as using it in a soundproofed environment within a Faraday cage.What is the cost of losing the data? What is your threat model?

author: tunk
author_rank: Super Contributor
timestamp: February 23, 2021, 04:14:42 pm
content: Is your Ubuntu an (LTS) version that still get updates?If yes, then it is (at least compared to XP which hasn'tgot updates for almost 7 years).

author: grumpydoc
author_rank: Super Contributor
timestamp: February 23, 2021, 04:19:40 pm
content: Quote from: tunk on February 23, 2021, 04:14:42 pmI'd certainly start by wiping XPIf the threat model is the laptop & hard disk being stolen Ubuntu (certainly current versions) supports disk encryption.If the threat model is dodgy websites stealing your personal data then you need to think about hardening the browser - and your own browsing practices as much as the OS.If the threat model is data being siphoned in flight across the internet then use HTTPS (but be aware this risk vector is tiny to the point of not existing for ordinary individuals).

author: bostonman
author_rank: Super Contributor
timestamp: February 23, 2021, 04:51:36 pm
content: I wasn’t thinking about including a threat model. I need to look at which version of Ubuntu but it does get updates.Threat model would be just Internet. If I log into a secure site like my credit card or similar, and assuming no virus (or the possibility XP vulnerability bleeding into Ubuntu - something I’m uncertain of), is that safe?

author: ataradov
author_rank: Super Contributor
timestamp: February 23, 2021, 05:38:09 pm
content: It is perfectly safe. I'm not even sure why this question comes up. There is such a bigger market for Windows vulnerabilities that not having the source code is not a factor at all. Even with the source code nobody cares to put a whole lot of effort into OS that holds 1% of the market (not that holes are much easier to find with the code).

author: Marco
author_rank: Super Contributor
timestamp: February 23, 2021, 06:35:52 pm
content: Quote from: bostonman on February 23, 2021, 04:05:44 pmOn any desktop OS it's best to assume local root exploits are infinite.It's all about keeping attacks away from the OS, ie. using an up to date browser, not installing malware, not allowing inbound traffic to anything with a significant attack surface (ie. more than 10 lines of C code, which unfortunately includes the TCP/IP stack, so compromises have to be made).

author: golden_labels
author_rank: Super Contributor
timestamp: February 24, 2021, 04:18:33 pm
content: Quote from: bostonman on February 23, 2021, 04:05:44 pmUsing anything is as secure as the weakest link, which is nearly always YOU. So the answer is: if YOU use it in a secure manner, it is secure. Certainly much more secure than unmaintained software past its EOL, which comes from time before Microsoft was even caring about security in their consumer OS.Quote from: bostonman on February 23, 2021, 04:05:44 pmWhy do you think cryptographic primitives are open? Closed designs are never more secure: they are merely unverifiable.

author: bostonman
author_rank: Super Contributor
timestamp: February 28, 2021, 03:23:05 pm
content: QuoteI understand and agree, but why would hackers not attempt Apple products since it's a popular product?

author: bostonman
author_rank: Super Contributor
timestamp: February 28, 2021, 03:50:08 pm
content: QuoteSadly enough, although I'm knowledgeable when it comes to being careful while online, sadly, I don't know enough about computer security to know what a "root account" is, and UAC.My guess is that Windows has layer upon layer and it's easier for hackers because a plethora of ways exist to compromise a system.

author: madires
author_rank: Super Contributor
timestamp: February 28, 2021, 03:54:09 pm
content: Macs and linux PCs/servers get hacked too. However, most attempts are simple dictionary attacks and scans for known vulnerabilities. The real fun starts when you're running a web server with CMS', blogs, forums, and tons of plugins.

author: madires
author_rank: Super Contributor
timestamp: February 28, 2021, 03:56:11 pm
content: Quote from: bostonman on February 28, 2021, 03:50:08 pmIn Windows terminology it's the administrator account or any other one with admin rights.

author: rdl
author_rank: Super Contributor
timestamp: February 28, 2021, 10:09:14 pm
content: I have no experience with Windows 8 or 10, but up through Windows 7 the default setup starts with an administrator account and it's easy to skip adding a password. Best thing is to use a strong password for the default admin account then set up a secondary account with limited privileges for day to day use. Having said that, I have to admit I never do it.

author: retiredcaps
author_rank: Super Contributor
timestamp: February 28, 2021, 10:36:29 pm
content: Quote from: bostonman on February 28, 2021, 03:50:08 pmIf this is a really old laptop, I suggest Lubuntu 20.04. It's Ubuntu, but stripped down so it runs on older computers that have less DRAM and a slower CPU. It will happily run with 1GB DRAM, 10GB hard drive and P4 or better.I have been running Lubuntu since 2014 on all my computers at home. It has automatic updates so it downloads security patches and updates itself. I have never had a problem with the updates going wrong in almost 7 years. Updates take only minutes.I use the Brave browser + ublock origin. With this combination, your exposed surface attack vector will be smaller than the majority. Or you can use Firefox + ublock origin. Firefox comes preloaded with Lubuntu.Also, I use the simple built in firewall on Lubuntu. Open a terminal and type insudo ufw enableIt's disabled by default. Or you can enable it via some GUI, but I'm comfortable using CLI vs GUI.

author: retiredcaps
author_rank: Super Contributor
timestamp: February 28, 2021, 10:40:53 pm
content: Lubuntu's default desktop, LXQT, looks similar to XP's start menu so the learning curve is easier for newbies. If you spend most of your time in a browser, Lubuntu + browser + ublock origin will be very easy for you to use. Then, if you like it, you can learn the more advanced things with Linux.I also lock down all my browser settings by turning off pretty much everything.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: March 03, 2021, 08:26:48 pm
content: What is the origin of this Laptop?Do you know and trust it's source?If I'd use it for anything personal I'd start by wiping the whole disk, re partitioning it and installing a fresh Linux OS.What sort of hardware is in the laptop?My previous PC, which I used until about half a year ago was a 12 year old Dualcore E6550 with a Passmark rating of around 1500 and 4GB of RAM and it was still adequate when I upgraded it for an i7-680 (That's probably first gen) I got for free and has about 2x the speed and better video too.

author: janoc
author_rank: Super Contributor
timestamp: March 03, 2021, 10:22:18 pm
content: Quote from: bostonman on February 28, 2021, 03:23:05 pmWhy do you think they don't?https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/(and that's only the most recent one)Macs don't get as many pieces of malware and hacks as Windows does but that's merely because Windows is so much easier and bigger target than Mac (or Linux).

author: jmelson
author_rank: Super Contributor
timestamp: March 06, 2021, 03:24:19 am
content: I have a web server running Ubuntu, it has not been broken into in over a decade. Back then, I learned a few tricks.1. Have an absolute minimum number of user accounts on the machine, like ONE.(If the user password can be guessed on a non-privileged account, that can be used to try cracking the root password 10,000 times faster than over the net.)2. Run denyhosts with pretty restrictive settings. Most importantly, do not re-enable attacking IPs in less than 2 weeks.(I used to have 1000 login attempts/day. 2 weeks after I set up denyhosts, to the exact hour, the attacks dropped to 3/day. Obviously,the hackers have a net where they compare notes on who has hard security and who is a soft target.)Once I put in these two protections, I have not been hacked in a decade. The hackers are contantly trying to ssh in, do SQL injection to my web server, etc. but it doesn't work.Any user computer behind a firewall with NAT, using a little common sense, is fairly safe. I routinely open suspicious emails, and when I click on attachments, I can see "badprogram.exe" as the contents of the archive, and dump it right there. Corrupt archives and documents with macros are flagged by sane software in Linux.Jon

author: nigelwright7557
author_rank: Frequent Contributor
timestamp: March 06, 2021, 04:23:20 am
content: Security is a real pain from two viewpoints.1/ Using dodgy downloaded software.2/ But also from the other direction where you write software but then its gets sand pitted despite having no threats in it.I spend half my life updating software then having to get it whitelisted which means uploading it to Norton etc.Then the poor old user gets it and is bombed out by Windows defender which needs it to be verified as safe.I sell systems with software and you would be gobsmacked how many people still use XP.I use Win 10 and Norton internet security and havent been badly hit yet.Downloading free software off the internet is my biggest threat.

author: james_s
author_rank: Super Contributor
timestamp: March 06, 2021, 07:10:51 am
content: Quote from: bostonman on February 28, 2021, 03:23:05 pmApple products are not immune, but Windows is still 80-90% of the PC market. Hackers are going to go for the biggest/most common target and that is Windows.Linux is capable of being very secure, it runs a large portion of the back end of the internet where security is important. Unix and later Linux were built from the ground up to be multi-user networked operating systems, Unix had decades to mature before it was ever common for Windows PCs to be networked to the outside world.

author: madires
author_rank: Super Contributor
timestamp: March 06, 2021, 12:43:37 pm
content: Quote from: jmelson on March 06, 2021, 03:24:19 amThere's a much simpler solution, simply use IPv6 and drop all ssh connections via IPv4 (maybe allow some safe networks). So far I haven't seen any dictionary attacks from IPv6 addresses.

author: bostonman
author_rank: Super Contributor
timestamp: March 06, 2021, 01:06:17 pm
content: QuoteGuilty of this. I've wanted to buy pieces to build a PC, and, each time I attempt to do so, I get caught up with trying to figure out if I'm overspending or whether I'll be happy with my selections (I've been using PCpartpicker.com). After getting frustrated (or busy doing other stuff), I give up because I'm uncertain what to get.The laptop that has Ubuntu also runs XP (dual OS), but it has XP only because it can't be upgraded and I never really use XP, just Ubuntu.Sadly I know little about methods to protect my systems (ignoring that I use outdated OS's). Sometimes I've been known to find a keygen or accidentally go on a torrent site, so I also fear that I'll infect a new PC if I'm not careful. I figure I'll use maybe a Raspberry Pi for questionable sites, but this too has hindered my progress on getting a new PC because I had this plan years ago, got lazy with trying to use dual PCs (one for regular stuff and the other for going on questionable sites), and basically depended on Norton (which Comcast is no longer giving for free) to save me from hacks.

author: janoc
author_rank: Super Contributor
timestamp: March 06, 2021, 04:35:00 pm
content: Quote from: blueskull on March 06, 2021, 04:40:02 amHe means free as in beer, not freedom.And he probably never got a drive-by download in Windows or never saw a Windows worm/virus neither ...

author: james_s
author_rank: Super Contributor
timestamp: March 06, 2021, 07:21:15 pm
content: Quote from: bostonman on March 06, 2021, 01:06:17 pmIs there a particular reason you want to build one instead of just buying a ready made system? It's still fun to build, and you can get exactly what you want, but it sounds like you don't know exactly what you want, so maybe just buy one that is already put together and guaranteed to work. The most low end crappy thing you can buy today is going to be so much faster than anything that came with XP that there is no comparison, we're talking an order of magnitude or more. You can even get good used stuff, core i3 or i5 Lenovo desktop for maybe $150. Pop in a SSD and install the OS of your choice.

author: golden_labels
author_rank: Super Contributor
timestamp: March 07, 2021, 02:17:23 am
content: Quote from: jmelson on March 06, 2021, 03:24:19 amThat is a very bad idea. If you have only the root user, it means three things: that you are logging in as root, that the root user is accessible from internet and that you have services running as root. Triple tragedy.Even if you have multiple users, but artificially limit their number, it means you share users between services. This is the problem with thenobodyuser, which was once very popular as “secure, restricted” account. Until someone has noticed that many servers pack a dozen different services into that single user, so if an adversary gets access through one of them, they have access to practically everything that matters. The best approach is to have a separate user for every service, which is opposite of the suggestion above. Of course that is not always worth the effort too.Quote from: jmelson on March 06, 2021, 03:24:19 amIt should not be possible to log in using a password in the first place. Preferably only SSH key should be allowed for accounts that need external access. And no access at all for other accounts.Quote from: madires on March 06, 2021, 12:43:37 pmSecurity by obscurity is never a good idea. However, that is useful in reducing noise in logs.The reason you do not see attacks on IPv6 is probably because so far it’s cheaper to attack IPv4. The whole IPv4 internet can be enumerated in a matter of minutes, while IPv6 machines must be discovered one by one. But it’s a matter of probability, not a real security feature.

author: madires
author_rank: Super Contributor
timestamp: March 07, 2021, 12:07:52 pm
content: Quote from: golden_labels on March 07, 2021, 02:17:23 amIt reduces the attack surface. And I don't see where the obscurity should be. The point is that nearly all ssh attacks come from IPv4 addresses at the moment. So blocking IPv4 ssh connections is more efficient than running fail2ban and Co. This will change in the future when IPv4 is phased out. Anyhow, you have to make sure to keep your ssh daemon up-to-date, to use strong passwords (for direct login or the keys), and also to keep the keys safe. The goal is to make it as hard as possible for the attacker. Blocking specific IP addresses (or address family in this case) is part of that game, and not "security by obscurity".

author: bostonman
author_rank: Super Contributor
timestamp: March 07, 2021, 03:08:28 pm
content: QuoteI don't want to deviate from the topic of this thread, however, I don't want to blow off your question. One reason I haven't dumped my current PC is due to the amount of software I've "obtained" over the years. Keeping older versions of software doesn't make sense, but I can't obtain new versions very easily anymore (or at least I'm unfamiliar with newer methods), or, if I do obtain newer versions, I may end up visiting non-safe sites, using keygen's, etc...The other reason is to build one that is quite powerful rather than go commercial, get loads of useless software that expires in thirty-days, etc... and have a mediocre PC rather than something high end. I plan to do 3D graphics, PCB layout, etc... so I want a powerful machine.

author: NiHaoMike
author_rank: Super Contributor
timestamp: March 07, 2021, 04:13:25 pm
content: What about redirect the attacker to a fake SSH server that accepts any login and then spew random data to try to crash the attacker?

author: Monkeh
author_rank: Super Contributor
timestamp: March 07, 2021, 04:32:56 pm
content: Quote from: NiHaoMike on March 07, 2021, 04:13:25 pmDon't antagonize children with botnets.

author: james_s
author_rank: Super Contributor
timestamp: March 07, 2021, 07:07:48 pm
content: Quote from: bostonman on March 07, 2021, 03:08:28 pmWell you can blow away the software on a ready made system and install from scratch, that's what I've done on my laptops.You can image your whole existing hard drive and run it in a VirtualBox VM on a new machine. You can boot the old XP install under whatever host OS you want.

author: jmelson
author_rank: Super Contributor
timestamp: March 15, 2021, 04:10:32 pm
content: Quote from: golden_labels on March 07, 2021, 02:17:23 amNo, on Ubuntu, by default, the root used cannot log in remotely. You have to log in as a general user and then either su, ssh or sudofrom the already logged-in account.

author: Monkeh
author_rank: Super Contributor
timestamp: March 15, 2021, 04:11:48 pm
content: Quote from: jmelson on March 15, 2021, 04:10:32 pmBut again, consolidating every service under a single user is a catastrophically bad idea.

author: Marco
author_rank: Super Contributor
timestamp: March 15, 2021, 05:46:15 pm
content: Sudo protects against accidentally deleting root or a user program bug doing it.It also provides a trivial avenue for privilege escalation from any sudo user account. Just install a terminal with a keylogger inside the given user's environment, takes no higher privileges, and wait for them to enter their password.

author: golden_labels
author_rank: Super Contributor
timestamp: March 15, 2021, 11:42:18 pm
content: Quote from: jmelson on March 15, 2021, 04:10:32 pmThen there are already two users, at least.Quote from: Marco on March 15, 2021, 05:46:15 pmMore importantly, it allows control over what commands may be called and keeps logs of its invocations. Unlike logging in as root, which gives unrestricted access and leaves little to no traces.Quote from: Marco on March 15, 2021, 05:46:15 pmOnly ifsudois unrestricted and that is not different than the user logging in as root usingsuorssh. Withsudobeing restricted, obtaining the password gives only limited access. Sometimes so limited that you can disable authentication for per-user setsuit-style invocation. And all this assumes passwords are used instead of key-based authentication.

author: jmelson
author_rank: Super Contributor
timestamp: March 16, 2021, 02:20:47 am
content: Quote from: Monkeh on March 15, 2021, 04:11:48 pmI did not do that. There are many services that have various accounts, NONE of which will accept "logins" from outside.The web server (apache2), pop server, SMTP server, etc. all have their own accounts, with appropriate privileges.But, there is ONLY ONE account that will accept an ssh login. The issue I had many years ago was to have multiple people who could set dumb passwords like "joe" or "bob". That is just asking for password guessing and then they have a beachhead to mount a brute-force attack on the passwords.Jon

author: grumpydoc
author_rank: Super Contributor
timestamp: March 16, 2021, 10:09:49 am
content: Quote from: jmelson on March 16, 2021, 02:20:47 amDon't allow passwords, even over ssh - insist on ssh keys. Weak passwords matter much less if you do that.

author: ricard2k
author_rank: Unknown
timestamp: March 16, 2021, 05:03:00 pm
content: The security is not in the OS, but in the user.If you use you ubuntu with and old browser and you visit sites of "dubious reputation", please have other PC to save your valuable data.Also try to have the system up to date.