Yes Anton, very safe. But like any system, you need to be proactive. For eg: never use your name/password combination for logins. Most hackers have a huge list of names with possible passwords to try and gain access to your machine. Services like SSH, webmin, apache, vnc in Linux or RDP, IIS, filesharing in Windows are all great tools, however, you need to protect yourself and your network every which way you can. Also, many people inadvertently install software in Linux but don't always understand the ramifications. eg. Installing MYSQL and opening its port to the internet...Where anyone that is IP and port scanning will pick it up and start attacking. So, what does this all mean. Protect yourself. Hilton Gibson below has given a link wrt more information If you need help....to confirm your security setup...Ask us.... Mike <div class="gmail_quote">On Tue, Jul 6, 2010 at 6:36 PM, Anton Binedell <<a href="mailto:binedella@telkomsa.net">binedella@telkomsa.net</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> -------------------------------------------------- From: "Anton Binedell" <<a href="mailto:binedella@telkomsa.net" target="_blank">binedella@telkomsa.net</a>> Sent: Tuesday, July 06, 2010 6:23 PM To: <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Subject: Re: ubuntu-za Digest, Vol 58, Issue 5 <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Re: My Ubuntu 9.10 has been hacked. Need help Hello, I am a bit confused here. I was under the impression that Linux can't be hacked and are a very secure OS. Guy's please tell me that I am safe using Linux? -------------------------------------------------- From: <<a href="mailto:ubuntu-za-request@lists.ubuntu.com" target="_blank">ubuntu-za-request@lists.ubuntu.com</a>> Sent: Tuesday, July 06, 2010 4:13 PM To: <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Subject: ubuntu-za Digest, Vol 58, Issue 5 <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Send ubuntu-za mailing list submissions to <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> To subscribe or unsubscribe via the World Wide Web, visit <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> or, via email, send a message with subject or body 'help' to <a href="mailto:ubuntu-za-request@lists.ubuntu.com" target="_blank">ubuntu-za-request@lists.ubuntu.com</a> You can reach the person managing the list at <a href="mailto:ubuntu-za-owner@lists.ubuntu.com" target="_blank">ubuntu-za-owner@lists.ubuntu.com</a> When replying, please edit your Subject line so it is more specific than "Re: Contents of ubuntu-za digest..." Today's Topics: 1. Re: My Ubuntu 9.10 has been hacked. Need help (Wesley) 2. Re: My Ubuntu 9.10 has been hacked. Need help (Jason Plank) 3. Re: My Ubuntu 9.10 has been hacked. Need help (Hilton Gibson) 4. Re: My Ubuntu 9.10 has been hacked. Need help (Mike Purves) 5. Re: My Ubuntu 9.10 has been hacked. Need help (Alf Stockton) 6. Re: Nvidia FX5500 with 10.04 (Andre Rossouw) ---------------------------------------------------------------------- Message: 1 Date: Tue, 6 Jul 2010 12:10:42 +0000 From: "Wesley" <<a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help To: "Ubuntu South African Local Community" <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Message-ID: <637040835-1278418241-cardhu_decombobulator_blackberry.rim.net-1874170468-@bda049.bisx.produk.on.blackberry> Content-Type: text/plain My thoughts exactly Robert. Jason to get the IP of the machine you're browsing from, go to <a href="http://www.whatismyip.com" target="_blank">http://www.whatismyip.com</a> but that could just show your proxy's IP if you are behind one. [Sent via my BB:21F7F343] -----Original Message----- From: Robert <<a href="mailto:robket@gmail.com" target="_blank">robket@gmail.com</a>> Sender: <a href="mailto:ubuntu-za-bounces@lists.ubuntu.com" target="_blank">ubuntu-za-bounces@lists.ubuntu.com</a> Date: Tue, 6 Jul 2010 14:02:26 To: Ubuntu South African Local Community<<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Reply-To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> ------------------------------ Message: 2 Date: Tue, 6 Jul 2010 14:14:12 +0200 From: Jason Plank <<a href="mailto:plank.jason@gmail.com" target="_blank">plank.jason@gmail.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help To: <a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a>, Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Message-ID: <<a href="mailto:AANLkTilKoe1SB0bDWLs5f4GX9LIFq2TWNx9vrqEuGecm@mail.gmail.com" target="_blank">AANLkTilKoe1SB0bDWLs5f4GX9LIFq2TWNx9vrqEuGecm@mail.gmail.com</a>> Content-Type: text/plain; charset="utf-8" Hi there The address it gives just goes to our ADSL router. I don't know how the guy was getting to the pc as it definitely isn't an internal person. At the moment, things seem ok, but I'll keep checking. It would stay fine for a while, then he would do something :-( Jason On Tue, Jul 6, 2010 at 2:10 PM, Wesley <<a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> My thoughts exactly Robert. Jason to get the IP of the machine you're browsing from, go to <a href="http://www.whatismyip.com" target="_blank">http://www.whatismyip.com</a> but that could just show your proxy's IP if you are behind one. [Sent via my BB:21F7F343] -----Original Message----- From: Robert <<a href="mailto:robket@gmail.com" target="_blank">robket@gmail.com</a>> Sender: <a href="mailto:ubuntu-za-bounces@lists.ubuntu.com" target="_blank">ubuntu-za-bounces@lists.ubuntu.com</a> Date: Tue, 6 Jul 2010 14:02:26 To: Ubuntu South African Local Community<<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Reply-To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> > Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> </blockquote> -- Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up everything else and count it all as garbage. All I want is Christ - Philippians 3:8 CEV -------------- next part -------------- An HTML attachment was scrubbed... URL: <a href="https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/c1ff7d2d/attachment-0001.htm" target="_blank">https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/c1ff7d2d/attachment-0001.htm</a> ------------------------------ Message: 3 Date: Tue, 06 Jul 2010 14:18:45 +0200 From: Hilton Gibson <<a href="mailto:hilton.gibson@gmail.com" target="_blank">hilton.gibson@gmail.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help To: <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> Message-ID: <<a href="mailto:4C331F25.6050709@gmail.com" target="_blank">4C331F25.6050709@gmail.com</a>> Content-Type: text/plain; charset="iso-8859-1" Hi Jason Also check this: <a href="http://www.ubuntu.sun.ac.za/wiki/index.php/NetworkSafety" target="_blank">http://www.ubuntu.sun.ac.za/wiki/index.php/NetworkSafety</a> Cheers hg On 06/07/2010 14:14, Jason Plank wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Hi there The address it gives just goes to our ADSL router. I don't know how the guy was getting to the pc as it definitely isn't an internal person. At the moment, things seem ok, but I'll keep checking. It would stay fine for a while, then he would do something :-( Jason On Tue, Jul 6, 2010 at 2:10 PM, Wesley <<a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a> <mailto:<a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a>>> wrote: My thoughts exactly Robert. Jason to get the IP of the machine you're browsing from, go to <a href="http://www.whatismyip.com" target="_blank">http://www.whatismyip.com</a> but that could just show your proxy's IP if you are behind one. [Sent via my BB:21F7F343] -----Original Message----- From: Robert <<a href="mailto:robket@gmail.com" target="_blank">robket@gmail.com</a> <mailto:<a href="mailto:robket@gmail.com" target="_blank">robket@gmail.com</a>>> Sender: <a href="mailto:ubuntu-za-bounces@lists.ubuntu.com" target="_blank">ubuntu-za-bounces@lists.ubuntu.com</a> <mailto:<a href="mailto:ubuntu-za-bounces@lists.ubuntu.com" target="_blank">ubuntu-za-bounces@lists.ubuntu.com</a>> Date: Tue, 6 Jul 2010 14:02:26 To: Ubuntu South African Local Community<<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <mailto:<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>>> Reply-To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <mailto:<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <mailto:<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <mailto:<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> -- Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up everything else and count it all as garbage. All I want is Christ - Philippians 3:8 CEV </blockquote> -- Hilton Gibson Systems Administrator JS Gericke Library Room 1025D Stellenbosch University Private Bag X5036 Stellenbosch 7599 South Africa Tel: +27 21 808 4100 | Cell: +27 84 646 4758 -------------- next part -------------- An HTML attachment was scrubbed... URL: <a href="https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/67fd43ce/attachment-0001.htm" target="_blank">https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/67fd43ce/attachment-0001.htm</a> ------------------------------ Message: 4 Date: Tue, 6 Jul 2010 14:23:15 +0200 From: Mike Purves <<a href="mailto:michael.purves@gmail.com" target="_blank">michael.purves@gmail.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Message-ID: <<a href="mailto:AANLkTilYRpJq-ldCKD1e1nLDEt4eMYouFXqvv1yDINiq@mail.gmail.com" target="_blank">AANLkTilYRpJq-ldCKD1e1nLDEt4eMYouFXqvv1yDINiq@mail.gmail.com</a>> Content-Type: text/plain; charset="iso-8859-1" What about wifi access. Someine in the vacinity has connected to your work and has found that linux box...perhaps even opened up a back door for himself.... Check the users on that machine...perhaps you should acitivate the root user with a strong password...Check your wifi settings, dont use WEP etc etc The person is gaining access a limited number of ways...Need to check them one by one. Regards MP75 On Tue, Jul 6, 2010 at 2:14 PM, Jason Plank <<a href="mailto:plank.jason@gmail.com" target="_blank">plank.jason@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Hi there The address it gives just goes to our ADSL router. I don't know how the guy was getting to the pc as it definitely isn't an internal person. At the moment, things seem ok, but I'll keep checking. It would stay fine for a while, then he would do something :-( Jason On Tue, Jul 6, 2010 at 2:10 PM, Wesley <<a href="mailto:wesley.werner@gmail.com" target="_blank">wesley.werner@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> My thoughts exactly Robert. Jason to get the IP of the machine you're browsing from, go to <a href="http://www.whatismyip.com" target="_blank">http://www.whatismyip.com</a> but that could just show your proxy's IP if you are behind one. [Sent via my BB:21F7F343] -----Original Message----- From: Robert <<a href="mailto:robket@gmail.com" target="_blank">robket@gmail.com</a>> Sender: <a href="mailto:ubuntu-za-bounces@lists.ubuntu.com" target="_blank">ubuntu-za-bounces@lists.ubuntu.com</a> Date: Tue, 6 Jul 2010 14:02:26 To: Ubuntu South African Local Community<<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Reply-To: Ubuntu South African Local Community < <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> </blockquote> -- Nothing is as wonderful as knowing Christ Jesus my Lord. I have given up everything else and count it all as garbage. All I want is Christ - Philippians 3:8 CEV -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> </blockquote> -------------- next part -------------- An HTML attachment was scrubbed... URL: <a href="https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/3d192270/attachment-0001.htm" target="_blank">https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/3d192270/attachment-0001.htm</a> ------------------------------ Message: 5 Date: Tue, 06 Jul 2010 14:47:33 +0200 From: Alf Stockton <<a href="mailto:alf@stockton.co.za" target="_blank">alf@stockton.co.za</a>> Subject: Re: [ubuntu-za] My Ubuntu 9.10 has been hacked. Need help To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Message-ID: <<a href="mailto:4C3325E5.1060800@stockton.co.za" target="_blank">4C3325E5.1060800@stockton.co.za</a>> Content-Type: text/plain; charset=UTF-8; format=flowed On 06/07/2010 12:52, Jason Plank wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Hi Guys I hope someone can help or give me some advice. I've got Ubuntu 9.10 running on one of our pc's at work as a LAMP server for joomla and I've also got virtualbox installed running NT4 workstation for a project we're working on. My problem is that some idiot has hacked the system and I can't seem to block him. I've tried turning of Remote Desktop, but he still get's in and changes settings. I've also disabled a whole bunch of startup daemons. We're also behind a DLINK DFL-210 firewall and I've set it to drop incoming RDP and telnet connections, but he still seems to be getting in. Can anyone give any ideas as to what I can do, other than format and redo the system? </blockquote> To identify who logged into my server and from where I have entered the following in my /etc/profile on my debian server. echo "Subject: Login on `hostname`" > ./logon.txt echo "by `who | awk '{print $1}'` from URL `who | awk '{print $5}'`" >> ./logon.txt /usr/sbin/sendmail -t <a href="mailto:alf@stockton.co.za" target="_blank">alf@stockton.co.za</a> < ./logon.txt -- --- Regards, Alf Stockton <a href="http://www.stockton.co.za" target="_blank">www.stockton.co.za</a> To err is human, to forgive canine. ------------------------------ Message: 6 Date: Tue, 06 Jul 2010 16:13:13 +0200 From: Andre Rossouw <<a href="mailto:andre@arnet.co.za" target="_blank">andre@arnet.co.za</a>> Subject: Re: [ubuntu-za] Nvidia FX5500 with 10.04 To: Ubuntu South African Local Community <<a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a>> Message-ID: <1278425593.10453.6.camel@pe-andrer-5> Content-Type: text/plain; charset="utf-8" Hi, thanks for the response. On Tue, 2010-07-06 at 13:09 +0200, Wesley Werner wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Which Ubuntu version are you running? Have a look here too: <a href="https://help.ubuntu.com/community/NvidiaManual" target="_blank">https://help.ubuntu.com/community/NvidiaManual</a> </blockquote> I'm using 10.04. I'll give that a go this weekend and see how it goes. -- Andre Rossouw <<a href="mailto:andre@arnet.co.za" target="_blank">andre@arnet.co.za</a>> -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: This is a digitally signed message part Url : <a href="https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/6651b13a/attachment.pgp" target="_blank">https://lists.ubuntu.com/archives/ubuntu-za/attachments/20100706/6651b13a/attachment.pgp</a> ------------------------------ -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com" target="_blank">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> End of ubuntu-za Digest, Vol 58, Issue 5 **************************************** </blockquote> </blockquote> -- ubuntu-za mailing list <a href="mailto:ubuntu-za@lists.ubuntu.com">ubuntu-za@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-za" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-za</a> </blockquote></div>