Comments on: Your Distro is Insecure: Ubuntu http://www.linux-mag.com/id/7297/ Open Source, Open Standards Sat, 05 Oct 2013 13:48:18 +0000 hourly 1 http://wordpress.org/?v=3.1 By: hip flexor strain running http://www.linux-mag.com/id/7297/#comment-981039 hip flexor strain running Tue, 04 Jun 2013 09:02:49 +0000 http://www.linux-mag.com/id/7297/#comment-981039 These De - Puy products were proven to be defective and harmful to the patients who used them. We are able to bend at the hips and perform other activities concerning the hip thanks to this bone. (2) compression of abdominal contents results, impeding circulation,. These De – Puy products were proven to be defective and harmful to the patients
who used them. We are able to bend at the hips and perform other
activities concerning the hip thanks to this bone.
(2) compression of abdominal contents results, impeding circulation,.

]]> By: develop iphone apps on windows http://www.linux-mag.com/id/7297/#comment-972995 develop iphone apps on windows Thu, 30 May 2013 20:47:25 +0000 http://www.linux-mag.com/id/7297/#comment-972995 Hello there! I know this is kinda off topic nevertheless I'd figured I'd ask. Would you be interested in trading links or maybe guest authoring a blog article or vice-versa? My site addresses a lot of the same topics as yours and I feel we could greatly benefit from each other. If you're interested feel free to send me an email. I look forward to hearing from you! Wonderful blog by the way! my blog post <a href="http://miesha34spillers.blinkweb.com/" rel="nofollow">develop iphone apps on windows</a> Hello there! I know this is kinda off topic nevertheless I’d figured I’d ask.

Would you be interested in trading links or maybe guest authoring a blog article or vice-versa?
My site addresses a lot of the same topics
as yours and I feel we could greatly benefit from each other.

If you’re interested feel free to send me an email. I look forward to hearing from you! Wonderful blog by the way!

my blog post develop iphone apps on windows

]]> By: Cheap Webhost http://www.linux-mag.com/id/7297/#comment-53725 Cheap Webhost Wed, 23 Nov 2011 23:50:06 +0000 http://www.linux-mag.com/id/7297/#comment-53725 Thanks for every other informative web site. Where else may just I am getting that kind of info written in such an ideal method? I've a project that I'm just now working on, and I have been at the glance out for such info. Thanks for every other informative web site. Where else may just I am getting that kind of info written in such an ideal method? I’ve a project that I’m just now working on, and I have been at the glance out for such info.

]]> By: jrichter http://www.linux-mag.com/id/7297/#comment-6334 jrichter Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6334 This is good in that I've noticed many of these in servers I use in the past and thought they were superfluous, but Linux admin is not something I do other than when I get forced into it--just not my real job. However, I'm not sure from the article's close that this was a complete list or simply where the author ended. That would be good to know. I'm also in a bit of mystery about some of those extra users--when and under what circumstance are they needed? It also might have been helpful to illustrate a sample of the fixes to remove any lingering questions--I realize that is probably very basic for most readers, but it is critical for the reader missing that last bit of "how to" knowlege. This is good in that I’ve noticed many of these in servers I use in the past and thought they were superfluous, but Linux admin is not something I do other than when I get forced into it–just not my real job. However, I’m not sure from the article’s close that this was a complete list or simply where the author ended. That would be good to know. I’m also in a bit of mystery about some of those extra users–when and under what circumstance are they needed? It also might have been helpful to illustrate a sample of the fixes to remove any lingering questions–I realize that is probably very basic for most readers, but it is critical for the reader missing that last bit of “how to” knowlege.

]]> By: actaea http://www.linux-mag.com/id/7297/#comment-6335 actaea Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6335 I took the time to read this article because I was worried about my computer. Instead, I find a bunch of anal retentive drivel that would seriously inconvenience many desktop users. Admittedly, the article talks about Ubuntu server, and may have valid points for people installing a server. Perhaps, it should have been titled "Your Linux Server Installs Insecurely" so that it would only reach the audience interested in it. I took the time to read this article because I was worried about my computer. Instead, I find a bunch of anal retentive drivel that would seriously inconvenience many desktop users. Admittedly, the article talks about Ubuntu server, and may have valid points for people installing a server. Perhaps, it should have been titled “Your Linux Server Installs Insecurely” so that it would only reach the audience interested in it.

]]> By: edantes http://www.linux-mag.com/id/7297/#comment-6336 edantes Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6336 I doubt this article was meant for typical standalone workstations. <br /> <br /> I agree there is a concern with the open user directories, but outside educational installations, true multi-user machines are becoming rare. For instance, with my provider, I am the sole user of a virtual machine. Isn't that the rule nowadays? I doubt this article was meant for typical standalone workstations.

I agree there is a concern with the open user directories, but outside educational installations, true multi-user machines are becoming rare. For instance, with my provider, I am the sole user of a virtual machine. Isn’t that the rule nowadays?

]]> By: linmag@perd.org http://www.linux-mag.com/id/7297/#comment-6337 linmag@perd.org Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6337 This article probably shouldn't have singled out Ubuntu. Although the brief information presented is true, it is also true of other Linux Distros and other varients of UNIX. The "Open by default" approach is often taken. I've worked on Solaris, HP-UX, Linux, etc for many years and if you want to secure them you have to clean it up after it's installed. (Unless you get a pre-secured version...) This is only a couple of specific open issues - there are many many more areas. If you want to secure a system you have to start by ONLY installing and running the services you really need. Then remove/close off accounts, ports, SUID programs, etc. You will never secure a system when you just load and go. This article probably shouldn’t have singled out Ubuntu. Although the brief information presented is true, it is also true of other Linux Distros and other varients of UNIX. The “Open by default” approach is often taken. I’ve worked on Solaris, HP-UX, Linux, etc for many years and if you want to secure them you have to clean it up after it’s installed. (Unless you get a pre-secured version…) This is only a couple of specific open issues – there are many many more areas. If you want to secure a system you have to start by ONLY installing and running the services you really need. Then remove/close off accounts, ports, SUID programs, etc. You will never secure a system when you just load and go.

]]> By: matador http://www.linux-mag.com/id/7297/#comment-6338 matador Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6338 OMG. This article is crap. FYI, Ubuntu uses dovecot for imap/pop. Dovecot supports only POP3 and IMAP4rev1. netstat can't tell you what version of protocol is in use (telnet to the port and check it for your self!). bootpc/UDP - your system is runing dhclient (I guess you haven't configured network in /etc/network/interfaces). bootps/UDP - you are even funnier; you are running DHCP server on you machine. Mind you, Ubuntu server won't install dhcp server by default - it doesn't even have a task for dhcp server. Are you trying to spread FUD?<br /> <br /> 'So when any of these accounts are compromised interactive remote access is most likely the results.'<br /> <br /> LOL! /bin/false would prevent that? How? What would stop attacker of running chsh?<br /> <br /> You are totally clueless. OMG. This article is crap. FYI, Ubuntu uses dovecot for imap/pop. Dovecot supports only POP3 and IMAP4rev1. netstat can’t tell you what version of protocol is in use (telnet to the port and check it for your self!). bootpc/UDP – your system is runing dhclient (I guess you haven’t configured network in /etc/network/interfaces). bootps/UDP – you are even funnier; you are running DHCP server on you machine. Mind you, Ubuntu server won’t install dhcp server by default – it doesn’t even have a task for dhcp server. Are you trying to spread FUD?

‘So when any of these accounts are compromised interactive remote access is most likely the results.’

LOL! /bin/false would prevent that? How? What would stop attacker of running chsh?

You are totally clueless.

]]> By: kmdennis http://www.linux-mag.com/id/7297/#comment-6339 kmdennis Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6339 actaea- I agree with you 100%. In fact I was looking for something mature,instead what we get is rather disingenious in the least. This is supposed to be a server. To share files and serve sevices to users. This would normally be installed by an Administrator, unless it is for home use. Since it allows you to chose you password or leave it blank, that is your choice. And I agree. Because in a test environment, where the system does not have internet access, that can work wonders easily. I happen to have set up some servers on a test network and I know that in a real network I use secure pass phrase wherever possible. But I DO NOT want the hassel of entering a password everytime. Because I have no need for security at that level. And the services that are installed by default more than likely are a result of user response to beta testing etc. For your security purposes you would hae turned off these services. But for the general use, they may be required by others. These are suposed to be multi use systems and are a cheaper alternative to vmware. On the upside you can create a secure distro and post it. And it seems with most systems, that you will definitely need to make them secure before deploying them. Right? actaea- I agree with you 100%. In fact I was looking for something mature,instead what we get is rather disingenious in the least. This is supposed to be a server. To share files and serve sevices to users. This would normally be installed by an Administrator, unless it is for home use. Since it allows you to chose you password or leave it blank, that is your choice. And I agree. Because in a test environment, where the system does not have internet access, that can work wonders easily. I happen to have set up some servers on a test network and I know that in a real network I use secure pass phrase wherever possible. But I DO NOT want the hassel of entering a password everytime. Because I have no need for security at that level. And the services that are installed by default more than likely are a result of user response to beta testing etc. For your security purposes you would hae turned off these services. But for the general use, they may be required by others. These are suposed to be multi use systems and are a cheaper alternative to vmware. On the upside you can create a secure distro and post it. And it seems with most systems, that you will definitely need to make them secure before deploying them. Right?

]]> By: rawler http://www.linux-mag.com/id/7297/#comment-6340 rawler Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6340 I basically agree that all of these points have some validity. <br /> <br /> But most of this are really _very_ shallow/ambiguous problems. I.E:<br /> * is Non-TLS:ed pop3 really allowed? As matador mentioned, you can't know that it allows plaintext, just because it's port 110. Modern TLS handshakes often run on the same port as the older versions.<br /> * While the shared-home-dir would be a problem on a company server, I would probably consider it a feature on a family-desktop or a home-server. Ubuntu is a Desktop for many uses you know. However, I agree that it should be an informed choice during installation. Cookie-stealing and whatnot. And who have never accidentally managed to write some sensitive info to the wrong files? An Inotify on the relvant files of your friends, and you could propably harvest for some mischief.<br /> * As matador says. Buffer overflow in any service would not in any way be rescued by whatever etc/passwd says. The only added security would be in combination with a bad admin, setting a weak password when password on services that shouldn't have password. Only in this particular instance would passwd even matter.<br /> * Also, I wonder how you managed to install the dhcpd? If that was unclear during install, that's a general usability-issue, not only a security-issue (also may cause problems on network, consume needless resources and all kinds of bad). Same mostly goes for dhclient, should not be running if you've really configured statically, for many more reasons than just security.<br /> <br /> But what about the _really_ interesting stuff? Things I'd REALLY find interesting for security in a server (and I have no idea of Ubuntu Server, never tried it):<br /> * Is stack and heap-randomization enabled in the -server kernel?<br /> * Is iptables configured with careful defaults?<br /> * Is apparmor/selinux configured at all? (Sadly, this is one of the things I'm often forced by time to remove from CentOS-installs just because it breaks some apps and I don't have the time to dig enough to learn and fix it properly.)<br /> * What binaries are installed setuid?<br /> * Is there any IDS pre-configured?<br /> * Even simple things like denyhosts?<br /> <br /> So, all in all, while all your points hold some validity, they wouldn't exactly turn me away from Ubuntu Server by themselves. I basically agree that all of these points have some validity.

But most of this are really _very_ shallow/ambiguous problems. I.E:
* is Non-TLS:ed pop3 really allowed? As matador mentioned, you can’t know that it allows plaintext, just because it’s port 110. Modern TLS handshakes often run on the same port as the older versions.
* While the shared-home-dir would be a problem on a company server, I would probably consider it a feature on a family-desktop or a home-server. Ubuntu is a Desktop for many uses you know. However, I agree that it should be an informed choice during installation. Cookie-stealing and whatnot. And who have never accidentally managed to write some sensitive info to the wrong files? An Inotify on the relvant files of your friends, and you could propably harvest for some mischief.
* As matador says. Buffer overflow in any service would not in any way be rescued by whatever etc/passwd says. The only added security would be in combination with a bad admin, setting a weak password when password on services that shouldn’t have password. Only in this particular instance would passwd even matter.
* Also, I wonder how you managed to install the dhcpd? If that was unclear during install, that’s a general usability-issue, not only a security-issue (also may cause problems on network, consume needless resources and all kinds of bad). Same mostly goes for dhclient, should not be running if you’ve really configured statically, for many more reasons than just security.

But what about the _really_ interesting stuff? Things I’d REALLY find interesting for security in a server (and I have no idea of Ubuntu Server, never tried it):
* Is stack and heap-randomization enabled in the -server kernel?
* Is iptables configured with careful defaults?
* Is apparmor/selinux configured at all? (Sadly, this is one of the things I’m often forced by time to remove from CentOS-installs just because it breaks some apps and I don’t have the time to dig enough to learn and fix it properly.)
* What binaries are installed setuid?
* Is there any IDS pre-configured?
* Even simple things like denyhosts?

So, all in all, while all your points hold some validity, they wouldn’t exactly turn me away from Ubuntu Server by themselves.

]]> By: mikemtnbikes http://www.linux-mag.com/id/7297/#comment-6341 mikemtnbikes Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6341 Given the issues, it seems like there's a bit o' grade inflation going on. I'd say that B or B- are more appropriate grades. Given the issues, it seems like there’s a bit o’ grade inflation going on. I’d say that B or B- are more appropriate grades.

]]> By: haroldmodesto http://www.linux-mag.com/id/7297/#comment-6342 haroldmodesto Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6342 I am missing the point of this article. Isn't it a given that a fresh install will have little to no security? Even distros like EnGarde need post-install configuration. If you want a secure system and doesn't have the know-how find someone else who does. If it's your job to secure the system you may be better off looking for another line of work. I am missing the point of this article. Isn’t it a given that a fresh install will have little to no security? Even distros like EnGarde need post-install configuration. If you want a secure system and doesn’t have the know-how find someone else who does. If it’s your job to secure the system you may be better off looking for another line of work.

]]> By: matador http://www.linux-mag.com/id/7297/#comment-6343 matador Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6343 1) There are numerous protections in kernel and during compilation of programs - http://wiki.ubuntu.com/CompilerFlags<br /> 2) There are no iptables rules by default. If you enable ufw, you get some<br /> 3) apparmor is configured (mysql, bind9, slapd...)<br /> <br /> denyhosts is available in repository, but enabled by default. Same goes to fail2ban (which might be better option than denyhosts) 1) There are numerous protections in kernel and during compilation of programs – http://wiki.ubuntu.com/CompilerFlags
2) There are no iptables rules by default. If you enable ufw, you get some
3) apparmor is configured (mysql, bind9, slapd…)

denyhosts is available in repository, but enabled by default. Same goes to fail2ban (which might be better option than denyhosts)

]]> By: matador http://www.linux-mag.com/id/7297/#comment-6344 matador Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6344 'but not enabled by default' ‘but not enabled by default’

]]> By: okhayat http://www.linux-mag.com/id/7297/#comment-6345 okhayat Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6345 That's why I use Debian, especially for servers. It's more stable, and secure. That’s why I use Debian, especially for servers. It’s more stable, and secure.

]]> By: matador http://www.linux-mag.com/id/7297/#comment-6346 matador Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6346 Bahahahaha! Linux really isn't for everybody. Bahahahaha! Linux really isn’t for everybody.

]]> By: ric http://www.linux-mag.com/id/7297/#comment-6347 ric Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6347 Those extra users are merely a placeholder and are disabled by default. It is not possible to log into these accounts without using root. Those extra users are merely a placeholder and are disabled by default. It is not possible to log into these accounts without using root.

]]> By: boban http://www.linux-mag.com/id/7297/#comment-6348 boban Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6348 What about 8.04 LTS What about 8.04 LTS

]]> By: alalcoolj http://www.linux-mag.com/id/7297/#comment-6349 alalcoolj Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6349 Yeah, what boban said. I'd be more interested in hearing about an LTS version, as those are the only ones I would ever put on a production server. Yeah, what boban said. I’d be more interested in hearing about an LTS version, as those are the only ones I would ever put on a production server.

]]> By: boban http://www.linux-mag.com/id/7297/#comment-6350 boban Wed, 30 Nov -0001 00:00:00 +0000 http://www.linux-mag.com/id/7297/#comment-6350 <p>I have this developed over time I have not updated for 8.0.4 other than DJBDNS everything will work as described</p> <p>http://slobodankrajinovic.blogspot.com/2008/02/linux-generic-server-based-on-ubuntu.html </p> I have this developed over time I have not updated for 8.0.4 other than DJBDNS everything will work as described

http://slobodankrajinovic.blogspot.com/2008/02/linux-generic-server-based-on-ubuntu.html

]]>