Ubuntu Security :: Remotely Deleting A Router Log?
Nov 10, 2010
I have recently been the victim of identify theft and have coincidentally noticed that my router has been under attack for the past few days. I've been monitoring the log on my router (a D-Link DI-624+A) and suddenly while I was on Skype, my wireless connection was lost. I reconnected and found that the router's log had been erased. It appears from the log that the hacker has so far been unsuccessful. I have already done a 'whois' on several of the IPs this hacker has been using and have notified the respective ISPs.
Is it possible to remotely delete a router log?
Here's an example of my log before and after the delete:
Code:
Wed Nov 10 18:00:24 2010 Unrecognized attempt blocked from 221.136.83.1:40245 to xxx.xxx.xxx.xxx TCP:8080
Wed Nov 10 18:08:24 2010 Unrecognized attempt blocked from 60.173.26.168:6000 to xxx.xxx.xxx.xxx TCP:9415
[Code]....
View 1 Replies
ADVERTISEMENT
Nov 11, 2010
As it stands I have a small home network operating behind my modem/router. Some of the ports on this are forwarded to my PS3 for gaming but I was looking at forward some for my file server.
At the moment I've forwarded port xxx22 to port 22 on my server for SSH for instance. ANd similarly 21 for FTP (although it doesnt seem to want to connect for any more than a few seconds using that). What I was thinking of doing was placing a small website for a handful of ppl to use on the server too and port forward again - xxx80 to 80. It works just fine but I'm a little concerned on the security front.
As I've moved the port to something different from the outside world I'm presuming I will have already cut the potential for malicious folks to wander in but is there anything else I should be doing? At the moment there's no firewall operating on the server, usually as its hidden behind the modem/router. But if I open this thign up more permanently what should I be doing? I've read a few articles on it but I'm always left with the overwhelming thought of "Thats if theres no firewall in my router" as they just seem to do the same.
View 5 Replies
View Related
Aug 11, 2010
I installed avast anti-virus on my 10.04 T42p thinkpad. It immediately slowed to a walk! and the registration number did not work and caused an error message. I tried to reinstall the program with no improvement/same result. then tried to remove the program from the machine with dpkg. Seemed to get rid of it but some of the folders it created are still there and won't let me trash them. The machine still seems slow, so how do I get rid of all traces of avast?
View 3 Replies
View Related
Jan 9, 2010
What are all the ways you could think of that someone could view your browsing history, upstream from your machine? They don't have physical access, there's nothing on the computer itself and the person trying to hack has skill so I'm thinking like monitoring a proxy somehow, using the ip address somehow, compromising the modem in some way, possibly having access to google account etc. I am new to ubuntu and have really dug it so far but I want to figure how this is/was being done
View 9 Replies
View Related
Feb 10, 2010
Is there anyway to prevent a user from being able to logon at a machine (Terminal and XWindows) but allow that user to logon remotely using SSH? This user is for remote capture of logs only - on a private network (no internet access).
View 1 Replies
View Related
Mar 25, 2010
I am at my own desktop and I have root access on my own desktop.
I also have root access on a Desktop Ubuntu system (192.168.5.10) on the LAN. I need to create another desktop user account on that 192.168.5.10 system.
So I logged into that system with: ssh -Y myself@192.168.5.10
Then I did: sudo users-admin
This brings up the Users Settings but the Add User and Unlock buttons are disabled. How do I enable these buttons?
View 5 Replies
View Related
Apr 6, 2010
properly set up ssh to only allow one IP address to login remotely
View 2 Replies
View Related
Jun 14, 2011
I have a computer running Fedora 14 and when I installed it, I chose to encrypt the drive.
I've recently changed the way I have things set up and don't want the encryption any more. From what I've read there is no way to simply and easily remove the encryption, so what I would like to do is input the pass phrase remotely.
so, Is there anyway I can type in the pass phrase remotely, or remove the encryption?
View 2 Replies
View Related
Apr 26, 2011
I just got an email from google saying my site contained malware. It has a line in it: "<script src='http://whitepix.info/3'></script>". I've noticed its recursively in all my .html and .txt files in my website. Can I make a linux script to run that will go through all my .html and txt files recursively and delete that line from them? I don't know how it got in all of them.
View 6 Replies
View Related
Apr 1, 2011
I have an Ubuntu 10.04 machine at home and apache setup on it (files are located in a Truecrypt volume). The reason for the web server being that I wanted to access my files wherever I'm at (i.e. hotel, work, hotspots, etc...). So far, it's worked out great for me seeing as a I can http download my files (or stream media files). However, I am often on a public hotspot and I know it's a matter of time before someone finds the webserver on my computer. I have the machine firewalled and password protected (via .htaccess), but either way I don't want people looking in on my computer.
The problem: I have used Truecrypt for a long time and completely trust using the program to encrypt/unencrypt a volume container to store my files. Usually, I would remote desktop into my computer and mount/unmount the volume when I needed it. However, after time it get's really annoying to do this. So I eventually figured out how to setup a bash script to automatically do this for me (which I put on the usb part of my phone). What I wanted to do was to be able send the bash script to my Ubuntu machine (via ftp from my phone) and have Ubuntu automatically run the script. Is this possible? What programs do I need on Ubuntu?
I was thinking about using something like cron, but that is for scheduled times. I don't really have a set time in which I need my files, it's pretty sporadic depending on how much I travel. Thus the need for being able to remotely mount the volume when I need it.
Summary: I need a way for Ubuntu to read a folder every minute or so to check for bash scripts to run. I want to be able to send the bash script via ftp from my phone, have Ubuntu run the script, then delete itself (so as to not store the password). I already know the script in which to mount the Truecrypt volume and how to send the file via ftp from my phone. It's really a matter of what program to use in Ubuntu to find and run the script.
View 8 Replies
View Related
Sep 11, 2010
i need to find a way to securely authenticate a decryption mechanism of some sort where the authentication is provided remotely without any user-interaction. Right now i have a number of boxes that all inform a central server when they are online. When they do this an OpenVPN connection is set up between them and the server.
However, i have been given the task to ensure that the scripts involved in this process are encrypted by default. This requires some form of self-decryption, which to my mind kind of goes against the whole idea of encryption/authentication in the first place. I need some way to leave decrypted the bare essentials required to boot a box and securely connect to the central server automatically. Then the server would automatically send a key/passphrase and the rest of the files on the box would then be decrypted on the fly.
View 4 Replies
View Related
Oct 5, 2010
I've read that using your computer behind a router is a must for security because of the NAT+SPI firewall so naturally I became interested in getting one. The thing is, I don't need the other features routers have because I don't do wireless, & I only use one computer. So do I really need one? Do the security benefit(s) gained from using a router warrant spending $50+?? Wouldn't using UFW with default deny rule offer the same level of protection?
Also I want to use my Playstation3 online. What security risks will I be taking if I connect it straight to my modem, instead of through a router?
View 9 Replies
View Related
Jan 4, 2011
Does anyone know or recommend some software or a script to remotely power on a PC from standby to on, or even better from completely off?
I guess the completely OFF to ON is much more complicated - would probably require an extra piece of hardware(?)
View 2 Replies
View Related
Jun 29, 2011
I'm not terribly new to Linux, but I am new to the forums, so hear me out! I am in the process of creating an electronic mapwall for our meteorology program, and have designed the computing system from scratch. I have two Linux Boxes, each with capabilities for 6 attached monitors...a total of 12 displays driven from two machines. My intention is to have one machine be the master...it has a touchpanel control. The inputs to the touchpanel will then trigger events for the both the master and the slave machine to display. Each of them has a specific IP address (DNS entry), and are not on a subnet.
Now...is there a way to remotely login to the slave machine and have it display on it's OWN monitors? The code is Java and which works on the master machine to animate directories of .gifs for each of the master's attached monitors. I will most likely have Java execute shell commands for the remote login (ssh), but I believe the answer lies somewhere in the X-configuration. Do I have the machines in an adverse configuration (creation of a subnet would be better)? Lots of questions...lots of desire...few answers!
View 2 Replies
View Related
Mar 7, 2011
I installed Ubuntu 10.10 64 on my laptop with the entire 500gb setup as encrypted LVM. This has worked well for several months with no problems. During this time i have been backing up the data to an external usb drive (1tb) on a regular basis. The usb drive was not encrypted. So, I thought it would be a good idea to encrypt the backup drive too. I wiped out the backup drive and set it up as one large encrypted lvm and mbr. This seemed to work fine but immediately afterwards I decided to erase that and set it up as encrypted lvm guid instead of mbr. I couldn't delete it while logged into my desktop so i decided to do it from a bootable gparted usb stick. In gparted i erased the 1TB backup drive once again and planned on setting it up the way I wanted once I was logged back into my ubuntu desktop. Now I cant boot into my desktop with the following errors:
cryptsetup: evms_activate is not available b0d) does not begin with /dev/mapper/
Then after waiting for a few minutes I get an error followed by (initramfs)
When booting from a live version of ubuntu the 250MB boot patition is recognized and 500 partion is there but it is labeled as empty/unused.
Also, I did choose to use the exact same passphrase as what is used on the main bootable drive when I set up the encrypted partition on the external 1TB drive.
View 9 Replies
View Related
Feb 14, 2010
I have problems connecting to several things while ufw is enabled, with the most important beeing my router(10.0.0.1) and KGpg key upload. I tried to allow all incoming traffic from 10.0.0.1 but it didn't help. With ufw disabled i can connect to the routerI use wicd and wicd-client for connection and the "cant connect to access point" errorBelow are the output of ufw status numbered and portsentry(dunno if its needed)
Code:
To Action From
-- ------ ----
[code]....
View 3 Replies
View Related
Feb 15, 2011
I want to have a firewall that is connected to my modem and router and have it function as just a firewall no dhcp no routing is that possible?
View 3 Replies
View Related
Apr 1, 2011
Rather than use pfsense, etc I decided to create my own router/proxy etc based on an atom base with 2 nics.Proxy/routing/dns/etc all working fine, I now though want to lockdown the fw rules.ETH1 is the WAN NICETH2 is the LAN NICI'm guessing i want to allow anything out of ETH1, but only allow incoming to ETH1 when its established or related... What about ETH2 though? Any ideas pls? Am used to configuring iptables on single nic, certainly not a router.
Code:
Chain INPUT (policy ACCEPT 18535 packets, 10M bytes)
pkts bytes target prot opt in out source destination
[code]....
View 8 Replies
View Related
Oct 23, 2010
So for ive changed the dns on my home router to Opendns and ive added this What does a dns attack look like? how would i know is my dns was poisoned or if i was under a kaminsky style attack?
View 9 Replies
View Related
Apr 5, 2011
In an effort to learn more about firewalls and iptables I have left behind gui set-up tools and have setup a firewall using iptables that logs to its own file. The firewall is as follows:
Code:
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:TCP - [0:0]
[Code]...
View 8 Replies
View Related
Jan 1, 2010
I installed Ubuntu 9.10 netbook remix on my Acer Aspire One D250 computer. The broadcom wireless NIC succeeds in connecting to the network but only if I remove the WPA-PSK security in the Netgear router settings. What do I need to change in order to be able to secure my network?
View 2 Replies
View Related
Dec 19, 2010
I've recently been taking a look at my router settings and I've realized i have my vnc port open for some reason. I don't know how or why it got opened because I've only used vnc within my private lan. Anyway, the problem is I couldn't figure out how to close that port on my router, so I just uninstalled all the vnc software from my computer so it wouldn't act like a vnc server for anybody trying to access it from the outside. So, effectively, I cannot vnc into my computer from outside my private lan, but when i port scan my public ip, the vnc port still appears open.
I'm wondering if there's something i'm missing. I'm sure it must be something in the router that I haven't figured out... something that's keeping port 5900 open.
View 6 Replies
View Related
Mar 1, 2011
This morning I was looking at the router's log file and noticed a certain IP address was able to gain LAN access on port 2222. That just happens to be the port my SSH server is listening on! A whois search revealed that IP address is in Germany. As soon as I found this out I stopped forwarding all ports to this machine in my router.
how to tell what had happened, what information this person was able to obtain, and if he left any goodies behind that could hurt me? I've read through some of the logs on my computer and haven't been able to find much at all. I did have some personal information on the hard drives, but that information is encrypted. I'm thinking if they were able to get my SSH password then that information probably isn't safe either (assuming they have some of it).
View 7 Replies
View Related
Aug 11, 2011
My 2Wire router/modem I got from AT&T for my DSL has port 3479 TCP open and I can't figure out how to close it. It's open to the entire internet. From a quick google search it's some port AT&T can use to update the modem's firmware or something.Consider how in bed AT&T is with government agencies it seems like a easy way for the government to get into my home network just by using what seems to me a backdoor put there by AT&T. Anyway to close this or secure it. Right now I'm using the hardware as my main router for my home network. I have Linsys I modded with DD-WRT. I'm thinking of re-configuring my network to use the DD-WRT router as the main router and the 2wire just as a modem. The 2wire is a hybrid modem/router and I'm kind of lazy and don't feel like re-configuring my entire network if I can just close the port.
View 9 Replies
View Related
Aug 8, 2010
I get all my traffic from my router, as this computer seldom moves. So is there a use for a firewall?I am not sure, because when I scan my IP address with nmap, no matter what the changes I make in the firewall, it is always the same scan...cannot fingerprint OS...and all closed ports.The all closed ports thing only changes when i torrent, then i get a wide open port.
View 14 Replies
View Related
Mar 9, 2011
I am trying to setup a firewall using Centos 5.5. The machine has 2 NICs, one connecting to the ISP/Modem and the other connected to a DIR-655 wireless router. The nic is connecting to the internet port on the router.
I do not want DHCP on the Firewall machine but on the wireless router.
[ISP/Modem]<--->[machine eth0]<--->[machine eht1]<--->[DIR-655 internet port]
IP from ISP Dynamic 192.168.1.1 192.168.1.2
IP's on the DIR-655 LAN will be 124.168.0.0/24 network lets say.
I have setup routes on the eth0 192.168.0.0/24 and 124.168.0.0/24
and added 124.168.0.0/24 to eth1.
I can ping eth0 and eth1 but cannot ping 192.168.1.2.
this setup is not actually connected to the internet so I disabled iptables to try testing the ping and still no good.
View 1 Replies
View Related
Apr 20, 2011
There are routers with firewalls which you cannot configure - you just use those routers and get some protection from Internet attacks. Is it possible to configure iptables on GNU/Linux machine so that you'll get better protection than the protection you get from those kind of routers?
View 4 Replies
View Related
Oct 28, 2010
I need to use an older router, which doesnt use wi-fi protected set-up, but I dont want anyone to be able to sniff the set-up.If I connect my laptop to the router with an ethernet cable, go into set up, turn off the wireless signal, then change the router password, and set the WPA2 password, then turn wireless signal back on, that should be just as secure, shouldnt it?
View 8 Replies
View Related
Mar 25, 2010
I was wondering whether or not it is possible/advisable to install and run Snort on a single laptop with a wireless router (firewall enabled)? Does Snort require root privileges and are there any other issues one needs to be aware of when installing and running software like this?
View 6 Replies
View Related
Apr 22, 2010
I have my router configured so that it drops outgoing telnet connections (and other protocols I don't use). It's a 2wire gateway. 192.168.1.65 is the internal IP of my ubuntu box.I'm trying to figure out what normal network traffic looks like and whether I should be worried by this log entry. At the time this happened I was testing out TOR (just navigating to a few sites (dell, ubuntu forums, etc.) nothing all that interesting.)
View 2 Replies
View Related
