[ubuntu-za] Fw: ubuntu-za Digest, Vol 58, Issue 5

Mike Purves michael.purves at gmail.com
Tue Jul 6 18:20:31 BST 2010 

Yes Anton, very safe. But like any system, you need to be proactive.

For eg: never use your name/password combination for logins.  Most hackers
have a huge list of names with possible passwords to try and gain access to
your machine.

Services like SSH, webmin, apache, vnc in Linux or RDP, IIS, filesharing in
Windows are all great tools, however, you need to protect yourself and your
network every which way you can.

Also, many people inadvertently install software in Linux but don't always
understand the ramifications. eg. Installing MYSQL and opening its port to
the internet...Where anyone that is IP and port scanning will pick it up and
start attacking.

So, what does this all mean.  Protect yourself. Hilton Gibson below has
given a link wrt more information

If you need help....to confirm your security setup...Ask us....

Mike


On Tue, Jul 6, 2010 at 6:36 PM, Anton Binedell <binedella at telkomsa.net>wrote:

>
>
> --------------------------------------------------
> From: "Anton Binedell" <binedella at telkomsa.net>
> Sent: Tuesday, July 06, 2010 6:23 PM
> To: <ubuntu-za at lists.ubuntu.com>
> Subject: Re: ubuntu-za Digest, Vol 58, Issue 5
>
>  Re:  My Ubuntu 9.10 has been hacked. Need help
>>
>> Hello,
>>
>> I am a bit confused here. I was under the impression that Linux can't be
>> hacked and are a very secure OS. Guy's please tell me that I am safe using
>> Linux?
>>
>> --------------------------------------------------
>> From: <ubuntu-za-request at lists.ubuntu.com>
>> Sent: Tuesday, July 06, 2010 4:13 PM
>> To: <ubuntu-za at lists.ubuntu.com>
>> Subject: ubuntu-za Digest, Vol 58, Issue 5
>>
>>  Send ubuntu-za mailing list submissions to
>>> ubuntu-za at lists.ubuntu.com
>>>
>>> To subscribe or unsubscribe via the World Wide Web, visit
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>> or, via email, send a message with subject or body 'help' to
>>> ubuntu-za-request at lists.ubuntu.com
>>>
>>> You can reach the person managing the list at
>>> ubuntu-za-owner at lists.ubuntu.com
>>>
>>> When replying, please edit your Subject line so it is more specific
>>> than "Re: Contents of ubuntu-za digest..."
>>>
>>>
>>> Today's Topics:
>>>
>>>  1. Re:  My Ubuntu 9.10 has been hacked. Need help (Wesley)
>>>  2. Re:  My Ubuntu 9.10 has been hacked. Need help (Jason Plank)
>>>  3. Re:  My Ubuntu 9.10 has been hacked. Need help (Hilton Gibson)
>>>  4. Re:  My Ubuntu 9.10 has been hacked. Need help (Mike Purves)
>>>  5. Re:  My Ubuntu 9.10 has been hacked. Need help (Alf Stockton)
>>>  6. Re:  Nvidia FX5500 with 10.04 (Andre Rossouw)
>>>
>>>
>>> ----------------------------------------------------------------------
>>>
>>> Message: 1
>>> Date: Tue, 6 Jul 2010 12:10:42 +0000
>>> From: "Wesley" <wesley.werner at gmail.com>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>> To: "Ubuntu South African Local Community"
>>> <ubuntu-za at lists.ubuntu.com>
>>> Message-ID:
>>>
>>> <637040835-1278418241-cardhu_decombobulator_blackberry.rim.net-1874170468- at bda049.bisx.produk.on.blackberry
>>> >
>>>
>>> Content-Type: text/plain
>>>
>>> My thoughts exactly Robert.
>>>
>>> Jason to get the IP of the machine you're browsing from, go to
>>> http://www.whatismyip.com but that could just show your proxy's IP if
>>> you
>>> are behind one.
>>> [Sent via my BB:21F7F343]
>>>
>>> -----Original Message-----
>>> From: Robert <robket at gmail.com>
>>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>>> Date: Tue, 6 Jul 2010 14:02:26
>>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>>> Reply-To: Ubuntu South African Local Community
>>> <ubuntu-za at lists.ubuntu.com>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>
>>> --
>>> ubuntu-za mailing list
>>> ubuntu-za at lists.ubuntu.com
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>>>
>>>
>>>
>>> ------------------------------
>>>
>>> Message: 2
>>> Date: Tue, 6 Jul 2010 14:14:12 +0200
>>> From: Jason Plank <plank.jason at gmail.com>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>> To: wesley.werner at gmail.com, Ubuntu South African Local Community
>>> <ubuntu-za at lists.ubuntu.com>
>>> Message-ID:
>>> <AANLkTilKoe1SB0bDWLs5f4GX9LIFq2TWNx9vrqEuGecm at mail.gmail.com>
>>> Content-Type: text/plain; charset="utf-8"
>>>
>>> Hi there
>>>
>>> The address it gives just goes to our ADSL router. I don't know how the
>>> guy
>>> was getting to the pc as it definitely isn't an internal person. At the
>>> moment, things seem ok, but I'll keep checking. It would stay fine for a
>>> while, then he would do something :-(
>>>
>>> Jason
>>>
>>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com> wrote:
>>>
>>>  My thoughts exactly Robert.
>>>>
>>>> Jason to get the IP of the machine you're browsing from, go to
>>>> http://www.whatismyip.com but that could just show your proxy's IP if
>>>> you
>>>> are behind one.
>>>> [Sent via my BB:21F7F343]
>>>>
>>>> -----Original Message-----
>>>> From: Robert <robket at gmail.com>
>>>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>>>> Date: Tue, 6 Jul 2010 14:02:26
>>>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>>>> Reply-To: Ubuntu South African Local Community
>>>> <ubuntu-za at lists.ubuntu.com
>>>> >
>>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>>
>>>> --
>>>> ubuntu-za mailing list
>>>> ubuntu-za at lists.ubuntu.com
>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>>
>>>> --
>>>> ubuntu-za mailing list
>>>> ubuntu-za at lists.ubuntu.com
>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>
>>>
>>> --
>>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up
>>> everything else and count it all as garbage. All I want is Christ -
>>> Philippians 3:8 CEV
>>> -------------- next part --------------
>>> An HTML attachment was scrubbed...
>>> URL:
>>>
>>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/c1ff7d2d/attachment-0001.htm
>>>
>>> ------------------------------
>>>
>>> Message: 3
>>> Date: Tue, 06 Jul 2010 14:18:45 +0200
>>> From: Hilton Gibson <hilton.gibson at gmail.com>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>> To: ubuntu-za at lists.ubuntu.com
>>> Message-ID: <4C331F25.6050709 at gmail.com>
>>> Content-Type: text/plain; charset="iso-8859-1"
>>>
>>> Hi Jason
>>>
>>> Also check this:
>>> http://www.ubuntu.sun.ac.za/wiki/index.php/NetworkSafety
>>>
>>> Cheers
>>>
>>> hg
>>>
>>> On 06/07/2010 14:14, Jason Plank wrote:
>>>
>>>> Hi there
>>>>
>>>> The address it gives just goes to our ADSL router. I don't know how
>>>> the guy was getting to the pc as it definitely isn't an internal
>>>> person. At the moment, things seem ok, but I'll keep checking. It
>>>> would stay fine for a while, then he would do something :-(
>>>>
>>>> Jason
>>>>
>>>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com
>>>> <mailto:wesley.werner at gmail.com>> wrote:
>>>>
>>>>    My thoughts exactly Robert.
>>>>
>>>>    Jason to get the IP of the machine you're browsing from, go to
>>>>    http://www.whatismyip.com but that could just show your proxy's IP
>>>>    if you are behind one.
>>>>    [Sent via my BB:21F7F343]
>>>>
>>>>    -----Original Message-----
>>>>    From: Robert <robket at gmail.com <mailto:robket at gmail.com>>
>>>>    Sender: ubuntu-za-bounces at lists.ubuntu.com
>>>>    <mailto:ubuntu-za-bounces at lists.ubuntu.com>
>>>>    Date: Tue, 6 Jul 2010 14:02:26
>>>>    To: Ubuntu South African Local
>>>>    Community<ubuntu-za at lists.ubuntu.com
>>>>    <mailto:ubuntu-za at lists.ubuntu.com>>
>>>>    Reply-To: Ubuntu South African Local Community
>>>>    <ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>>
>>>>    Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>>
>>>>    --
>>>>    ubuntu-za mailing list
>>>>    ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>
>>>>    https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>>
>>>>    --
>>>>    ubuntu-za mailing list
>>>>    ubuntu-za at lists.ubuntu.com <mailto:ubuntu-za at lists.ubuntu.com>
>>>>    https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given
>>>> up everything else and count it all as garbage. All I want is Christ -
>>>> Philippians 3:8 CEV
>>>>
>>>
>>> --
>>> Hilton Gibson
>>> Systems Administrator
>>> JS Gericke Library Room 1025D
>>> Stellenbosch University
>>> Private Bag X5036
>>> Stellenbosch
>>> 7599
>>> South Africa
>>>
>>> Tel: +27 21 808 4100 | Cell: +27 84 646 4758
>>>
>>> -------------- next part --------------
>>> An HTML attachment was scrubbed...
>>> URL:
>>>
>>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/67fd43ce/attachment-0001.htm
>>>
>>> ------------------------------
>>>
>>> Message: 4
>>> Date: Tue, 6 Jul 2010 14:23:15 +0200
>>> From: Mike Purves <michael.purves at gmail.com>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>>> Message-ID:
>>> <AANLkTilYRpJq-ldCKD1e1nLDEt4eMYouFXqvv1yDINiq at mail.gmail.com>
>>> Content-Type: text/plain; charset="iso-8859-1"
>>>
>>> What about wifi access.  Someine in the vacinity has connected to your
>>> work
>>> and has found that linux box...perhaps even opened up a back door for
>>> himself....
>>>
>>> Check the users on that machine...perhaps you should acitivate the root
>>> user
>>> with a strong password...Check your wifi settings, dont use WEP etc etc
>>>
>>> The person is gaining access a limited number of ways...Need to check
>>> them
>>> one by one.
>>>
>>>
>>> Regards
>>>
>>> MP75
>>> On Tue, Jul 6, 2010 at 2:14 PM, Jason Plank <plank.jason at gmail.com>
>>> wrote:
>>>
>>>  Hi there
>>>>
>>>> The address it gives just goes to our ADSL router. I don't know how the
>>>> guy
>>>> was getting to the pc as it definitely isn't an internal person. At the
>>>> moment, things seem ok, but I'll keep checking. It would stay fine for a
>>>> while, then he would do something :-(
>>>>
>>>> Jason
>>>>
>>>>
>>>> On Tue, Jul 6, 2010 at 2:10 PM, Wesley <wesley.werner at gmail.com> wrote:
>>>>
>>>>  My thoughts exactly Robert.
>>>>>
>>>>> Jason to get the IP of the machine you're browsing from, go to
>>>>> http://www.whatismyip.com but that could just show your proxy's IP if
>>>>> you
>>>>> are behind one.
>>>>> [Sent via my BB:21F7F343]
>>>>>
>>>>> -----Original Message-----
>>>>> From: Robert <robket at gmail.com>
>>>>> Sender: ubuntu-za-bounces at lists.ubuntu.com
>>>>> Date: Tue, 6 Jul 2010 14:02:26
>>>>> To: Ubuntu South African Local Community<ubuntu-za at lists.ubuntu.com>
>>>>> Reply-To: Ubuntu South African Local Community <
>>>>> ubuntu-za at lists.ubuntu.com>
>>>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>>>>
>>>>> --
>>>>> ubuntu-za mailing list
>>>>> ubuntu-za at lists.ubuntu.com
>>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> ubuntu-za mailing list
>>>>> ubuntu-za at lists.ubuntu.com
>>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>>
>>>>>
>>>>
>>>>
>>>> --
>>>> Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up
>>>> everything else and count it all as garbage. All I want is Christ -
>>>> Philippians 3:8 CEV
>>>>
>>>> --
>>>> ubuntu-za mailing list
>>>> ubuntu-za at lists.ubuntu.com
>>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>>
>>>>
>>>>  -------------- next part --------------
>>> An HTML attachment was scrubbed...
>>> URL:
>>>
>>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/3d192270/attachment-0001.htm
>>>
>>> ------------------------------
>>>
>>> Message: 5
>>> Date: Tue, 06 Jul 2010 14:47:33 +0200
>>> From: Alf Stockton <alf at stockton.co.za>
>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help
>>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>>> Message-ID: <4C3325E5.1060800 at stockton.co.za>
>>> Content-Type: text/plain; charset=UTF-8; format=flowed
>>>
>>> On 06/07/2010 12:52, Jason Plank wrote:
>>>
>>>> Hi Guys
>>>>
>>>> I hope someone can help or give me some advice. I've got Ubuntu 9.10
>>>> running on one of our pc's at work as a LAMP server for joomla and I've
>>>> also got virtualbox installed running NT4 workstation for a project
>>>> we're working on. My problem is that some idiot has hacked the system
>>>> and I can't seem to block him. I've tried turning of Remote Desktop, but
>>>> he still get's in and changes settings. I've also disabled a whole bunch
>>>> of startup daemons. We're also behind a DLINK DFL-210 firewall and I've
>>>> set it to drop incoming RDP and telnet connections, but he still seems
>>>> to be getting in. Can anyone give any ideas as to what I can do, other
>>>> than format and redo the system?
>>>>
>>>>  To identify who logged into my server and from where I have entered the
>>> following in my /etc/profile on my debian server.
>>>
>>> echo "Subject: Login on `hostname`" > ./logon.txt
>>> echo "by `who | awk '{print $1}'` from URL `who | awk '{print $5}'`" >>
>>> ./logon.txt
>>> /usr/sbin/sendmail -t alf at stockton.co.za < ./logon.txt
>>>
>>>
>>> --
>>> ---
>>>
>>> Regards,
>>> Alf Stockton www.stockton.co.za
>>>
>>> To err is human, to forgive canine.
>>>
>>>
>>>
>>> ------------------------------
>>>
>>> Message: 6
>>> Date: Tue, 06 Jul 2010 16:13:13 +0200
>>> From: Andre Rossouw <andre at arnet.co.za>
>>> Subject: Re: [ubuntu-za] Nvidia FX5500 with 10.04
>>> To: Ubuntu South African Local Community <ubuntu-za at lists.ubuntu.com>
>>> Message-ID: <1278425593.10453.6.camel at pe-andrer-5>
>>> Content-Type: text/plain; charset="utf-8"
>>>
>>> Hi, thanks for the response.
>>>
>>> On Tue, 2010-07-06 at 13:09 +0200, Wesley Werner wrote:
>>>
>>>> Which Ubuntu version are you running? Have a look here too:
>>>> https://help.ubuntu.com/community/NvidiaManual
>>>>
>>>
>>> I'm using 10.04. I'll give that a go this weekend and see how it goes.
>>> --
>>> Andre Rossouw <andre at arnet.co.za>
>>> -------------- next part --------------
>>> A non-text attachment was scrubbed...
>>> Name: not available
>>> Type: application/pgp-signature
>>> Size: 198 bytes
>>> Desc: This is a digitally signed message part
>>> Url :
>>>
>>> https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/6651b13a/attachment.pgp
>>>
>>> ------------------------------
>>>
>>> --
>>> ubuntu-za mailing list
>>> ubuntu-za at lists.ubuntu.com
>>> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>>>
>>>
>>> End of ubuntu-za Digest, Vol 58, Issue 5
>>> ****************************************
>>>
>>
>>
> --
> ubuntu-za mailing list
> ubuntu-za at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-za
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/c351dff1/attachment-0001.htm

More information about the ubuntu-za mailing list