- luv-beginners - luv.asn.au

Re: [luv-beginners] Computer security questions
by Peter Wolf 05 Jan '20

05 Jan '20

n 19/12/19 10:48 am, Piers Rowan via luv-beginners wrote: > > On 19/12/19 9:43 am, Piers Rowan wrote: >> >>> Very likely they are and have been.I have strong evidence of this >>> such as the following - >>> >>> - computer slow during startup,shutdown and general operation >>> compared to just after a fresh install >>> >>> ,I can tell because the fastest computer I normally use is a dual >>> core and have found these run quicker than hacked >>> >>> quad and 6 core computers for many /most applications when dual core >>> not hacked. >> >> >> How old it the computer? If you have dust in CPU fan then it will >> overheat and throttle the CPU so it doesn't overheat. (I just >> re-lifed a PC yesterdau for this reason). >> My computers are 10-20 years old and not overheating except for maybe 1 or 2 out of 20-30 computers. >> >>> >>> - After visiting dodgy websites that create dozens of connections to >>> residential computers with Firefox, >> >> >> Multiple connections are standard fare for advert laden sites. >> >>> >>> software updates no longer work and a change of password stops linux >>> Mint from starting up at all. >> >> >> That is strange. >> >> >>> >>> A check shows almost every file has had its permissions changed. >>> >>> - When apparently hacked ,some of my data (such as old important >>> looking photos) has mysteriously gone missing. >>> >>> - Firefox stops working with many websites when apparently hacked >>> and slows down dramatically. >>> >>> - excessive hard drive activity after I visit some websites,like a >>> search is going on. >>> >>> >>> - Once I found the "find" command running on one of my computers >>> using the command htop.It was taking a large chunk of CPU usage.I >>> never started the "find" command and it was running constantly. >>> >>> >> OK I'm guessing the HDD could be the issue - bad sectors would cause >> this behavior. >> >> Is it an old disk or a new SSD? >> >> I'm getting mostly the same thing on multiple computers (more than >> 10),they do have old hard (disk) drives.(5-15 years old) The above >> trouble has 90% gone after using my custom software to "stop the >> hacking".It's an interesting suggestion and although I very much >> doubt it is the cause, I can't definitively say that it's not.So I'll >> make a point of checking my hard drives. Thanks. > Thanks > _______________________________________________ luv-beginners mailing list luv-beginners(a)luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners

5 5

Re: [luv-beginners] Computer security questions
by Piers Rowan 19 Dec '19

19 Dec '19

On 19/12/19 9:43 am, Piers Rowan wrote: > >> Very likely they are and have been.I have strong evidence of this >> such as the following - >> >> - computer slow during startup,shutdown and general operation >> compared to just after a fresh install >> >> ,I can tell because the fastest computer I normally use is a dual >> core and have found these run quicker than hacked >> >> quad and 6 core computers for many /most applications when dual core >> not hacked. > > > How old it the computer? If you have dust in CPU fan then it will > overheat and throttle the CPU so it doesn't overheat. (I just re-lifed > a PC yesterdau for this reason). > > >> >> - After visiting dodgy websites that create dozens of connections to >> residential computers with Firefox, > > > Multiple connections are standard fare for advert laden sites. > >> >> software updates no longer work and a change of password stops linux >> Mint from starting up at all. > > > That is strange. > > >> >> A check shows almost every file has had its permissions changed. >> >> - When apparently hacked ,some of my data (such as old important >> looking photos) has mysteriously gone missing. >> >> - Firefox stops working with many websites when apparently hacked and >> slows down dramatically. >> >> - excessive hard drive activity after I visit some websites,like a >> search is going on. >> >> >> - Once I found the "find" command running on one of my computers >> using the command htop.It was taking a large chunk of CPU usage.I >> never started the "find" command and it was running constantly. >> >> > OK I'm guessing the HDD could be the issue - bad sectors would cause > this behavior. > > Is it an old disk or a new SSD? > > > Thanks >

1 0

Computer security questions
by Peter Wolf 19 Dec '19

19 Dec '19

Hello, I'm still having major problems with computer security of Linux Mint 19 MATE.I believe that with default settings ,this version of linux is unusable as it gets hacked in a few minutes by bots,mainly via firefox. I have not found any security measures to prevent this and have had to write custom software to stop the hacking or mostly stop it. I've found that the previously mentioned "firehol" firewall program doesn't stop the hacking,it maybe delayed it by a few days at first.The same goes for ufw,but maybe I'm not using it correctly.The default apparmor profile for firefox simply does nothing or close to nothing to protect the computer.I've written my own firefox apparmor profile which has worked reasonably well for weeks/months but is still not complete .I've also written my own active firewall program that blocks connections from all residential computers (which are probably mostly hacked and used as bots to hack other computers) and rented servers.This combination of programs as well as a few others not written by me ,like snort and fail2ban have mostly stopped the hacking but not completely.I haven't had to reinstall linux for a month or so on any of my machines.Unfortunately,recently, I've discovered that snort and fail2ban have been disabled on many of my machines and that the logviewer seems to not be working properly.So my questions are - what is the command to run the linux mint logviewer? (I normally run it from the menu) - is it normal for the linux mint logviewer to automatically switch viewing logs after a few seconds? (I strongly suspect not) regards Peter

3 3

computer security questions
by Peter Wolf 08 Oct '19

08 Oct '19

Hello, This is a follow up email in the hope that someone as confused as me might find it useful. I have solved my computer security issues for now using the following script. ----------------------------------------------------------------------------------------------- #!/bin/sh sudo apt install -y apparmor sudo apt install -y apparmor-profiles sudo apt install -y apparmor-profiles-extra sudo apt install -y apparmor-utils sudo aa-enforce /etc/apparmor.d/* fireholpath="/usr/sbin/firehol" sudo apt remove -y ufw sudo apt install -y firehol sudo crontab -u root -l > temp.txt if grep 'firehol' temp.txt; then echo "no need to update crontab" else echo "updating crontab" echo "@reboot $fireholpath start" >> temp.txt sudo crontab -u root temp.txt fi sudo firehol start --------------------------------------------------------------------------------------------- I don't know how smart the above script is , but it works for me.I found that the default firewall with linux mint (ufw) was not working effectively.At least with the default settings it comes with.My computers were getting hacked through using firefox with attackers gaining root access in about 20 minutes no matter how strong the password was.In such times, changing the hostname and password helped things temporarily. Enjoy your linux. regards Peter

3 2

Important
by Andrew Pam 28 Sep '19

28 Sep '19

From: Benjamin Conway <bjnconsulting(a)outlook.com> Date: 28/9/19, 1:13 am Dear Members of Linux users Victoria Hi, My name is Benjamin & I would really love some support. I would love to become a member. I am a Windows 7 user who runs a business through various computers. Although as I am sure you are aware Windows 7 support is finishing soon. I would like to ask if someone you know (perhaps even yourself), could assist me to install a linux system. For over 5 years I have avoided migrating to windows 10 as I hate it and I like Mac Hardware but I am not too savy with the software. I prefer to build my own computers and I have being using windows almost everyday since 1997, (I still have an old Windows 97 computer which still works). I used to use Linux in the 1990’s as a kid although now I am using Zorin OS 15 as a transition to a linux based OS, Based on my extensive research I believe I would be suited to either Fedora 20 or 30 or Pop_OS 19. I would really appreciate some help to install one of these OS systems onto my desktop. Sincerely, Benjamin J. Conway Principle Director BJN Consulting tel. 0451 480 462 e-bjnconsulting(a)outlook.com

1 0

computer security questions
by Peter Wolf 23 Sep '19

23 Sep '19

Hello, My questions are - how do I detect a suspicious network connection? - what sort of computer security tips do people have? Some background information regarding the above questions. Firstly as some of you may have noticed I have very little to no knowledge in this area.I am flat out running a business that is barely paying bills and probably cannot afford to buy security software, hire someone or spend much time on a computer security course. I believe my computers are getting hacked.I have noticed files being changed/added in dropbox that I definitely hadn't changed/added myself.Also at times I am no longer able to easily change my password or do updates.Also I have noticed that at such times web browsing can become very slow as well as the general speed of my computer.I am running Linux Mint 18.My solution to computer security has been to change my user password several times a day which seems to help.I do updates regularly and use relatively low spec computers (dual core machines) so that if there is a problem and someone else is using my computer I can notice it more easily.I always use regular hard drives so that any possible hacking cannot be done too quickly.I have also written a program to change the hostname on my computers and this seems to speed up my computers and web browsing for a while.When web pages start malfunctioning,changing the user password and computer hostname very often fixes it. I have noticed that problems seem to be correlated with how many network connections I see.I am thinking of writing a program to shut down any suspicious network connections as long as I know how to detect them.Buying security software may seem more cost effective but I don't trust commercial products because the seller always has a vested interest to encourage hacking etc to continue the sale of products and maintain subscriptions. Unfortunately I have no computers that can run the latest Qubes Linux. regards Peter

3 2

computer security questions
by Peter Wolf 21 Sep '19

21 Sep '19

On 20/9/19 11:04 am, Peter Wolf via luv-beginners wrote: >/Hello, />//>/ My questions are />//>/- how do I detect a suspicious network connection? />//>/- what sort of computer security tips do people have? />//>//>/Some background information regarding the above questions. />//>/Firstly as some of you may have noticed I have very little to no />/knowledge in this area.I am flat out running a business that is barely />/paying bills and probably cannot afford to buy security software, hire />/someone or spend much time on a computer security course. />//>/I believe my computers are getting hacked. /If you computer is hacked then stop there. Save your data, format everything and reinstall your operating system. You are time poor so that is the quickest option. ******* I often do that but I'm looking for something more efficient and a prevention. >/I have noticed files being changed/added in dropbox that I definitely />/hadn't changed/added myself. /There may be another explanation for this than being hacked. Are you using the Dropbox app or web interface? What are the files? Are they found on both your computer and the cloud? When using the Dropbox folder as an application data storage I have seen temporary files remain after the application exits. ****** I mainly use the dropbox app for the desktop.One file that was modified was a script to enable apparmor.It was changed so that it did ****** some weird stuff with grub files.The script was in the cloud and on my computer. >/Also at times I am no longer able to easily change my password or do />/updates.Also I have noticed that at such times web browsing can become />/very slow as well as the general speed of my computer.I am running />/Linux Mint 18.My solution to computer security has been to change my />/user password several times a day which seems to help.I do updates />/regularly and use relatively low spec /Changing your password will be of no benefit is someone has root access to your computers. >//>/computers (dual core machines) so that if there is a problem and />/someone else is using my computer I can notice it more easily.I always />/use regular hard drives so that any possible hacking cannot be done />/too quickly.I have also written a program to change the hostname on my />/computers and this seems to speed up my computers and web browsing for />/a while.When web pages start malfunctioning,changing the user password />/and computer hostname very often fixes it. />//>/I have noticed that problems seem to be correlated with how many />/network connections I see.I am thinking of writing a program to shut />/down any suspicious network connections as long as I know how to />/detect them.Buying security software may seem more cost effective but />/I don't trust commercial products because the seller always has a />/vested interest to encourage hacking etc to continue the sale of />/products and maintain subscriptions. / I have been using Linux distributions on workstations and servers for over 20 years. User accounts have been hacked in the past when users insisted on using dictionary based passwords. Each time the give away was the accounts were being used to send spam. A password reset stopped that activity. No one has ever gained root access. I hope this helps ******** Yes this helps,thanks,information is good. >//>/Unfortunately I have no computers that can run the latest Qubes Linux. />//>/regards Peter />//>/_______________________________________________ />/luv-beginners mailing list />/luv-beginners at luv.asn.au <https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners> />/https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners /

1 0

Network question
by Peter Wolf 14 Sep '19

14 Sep '19

Hello, I want to know if the following output is indicative of a healthy computer system.The command is "netstat -t" . I am worried about the apparent circular reference with localhost. Proto Recv-Q Send-Q Local Address Foreign Address State tcp 32 0 L1JDFY77FVHYMJD6O:37642 162.125.83.7:https CLOSE_WAIT tcp 0 0 localhost:60846 localhost:42012 ESTABLISHED tcp 32 0 L1JDFY77FVHYMJD6O:60696 162.125.36.1:https CLOSE_WAIT tcp 32 0 L1JDFY77FVHYMJD6O:39138 162.125.83.3:https CLOSE_WAIT tcp 0 0 L1JDFY77FVHYMJD6O:46664 134.213.52.45:https ESTABLISHED tcp 0 0 localhost:42012 localhost:60846 ESTABLISHED tcp 0 0 L1JDFY77FVHYMJD6O:46662 134.213.52.45:https ESTABLISHED tcp 32 0 L1JDFY77FVHYMJD6O:38518 162.125.83.3:https CLOSE_WAIT tcp 0 0 L1JDFY77FVHYMJD6O:57244 162.125.34.129:https ESTABLISHED tcp 32 0 L1JDFY77FVHYMJD6O:39130 162.125.83.3:https CLOSE_WAIT tcp 32 0 L1JDFY77FVHYMJD6O:59380 162.125.83.4:https CLOSE_WAIT tcp 0 0 L1JDFY77FVHYMJD6O:57852 162.125.34.129:https ESTABLISHED tcp 1 0 L1JDFY77FVHYMJD6O:41264 ec2-52-22-138-109:https CLOSE_WAIT regards Peter

2 1

Windows 10 print to Samba share
by Keith Bainbridge 12 Dec '18

12 Dec '18

Good afternoon All I'm trying to connect my better half's win10 laptop to my Samba share printer. I've tried several supposed fixes without success, including disabling the firewall (which worked for my Win7 VBox). The only thing I've read that I haven't tried is changing a key in the registry - because I am reluctant to try something potentially dangerous when nothing else has worked. I'd do it on my my own machine if necessary, but I need to know it works before I try it elsewhere. So here's the url from my debian laptop: smb://WORKGROUP/192.168.0.126/C1860-Series smbclient list for me: keith WARNING: The "syslog" option is deprecated Enter keith's password: Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Sharename Type Comment --------- ---- ------- homes Disk Home Directories print$ Disk Printer Drivers IPC$ IPC IPC Service (Samba 4.5.12-Debian) C1860-Series Printer Samsung C1860 Series keith Disk Home Directories Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Server Comment --------- ------- COMPAQ Samba 4.5.12-Debian IINETCABLE-SMB Samba 3.0.37 Workgroup Master --------- ------- WORKGROUP IINETCABLE-SMB smbclient listing for wife: anne WARNING: The "syslog" option is deprecated Enter anne's password: session setup failed: NT_STATUS_LOGON_FAILURE keith@asus3:~$ smbclient -L 192.168.0.126 -U anne WARNING: The "syslog" option is deprecated Enter anne's password: Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Sharename Type Comment --------- ---- ------- homes Disk Home Directories print$ Disk Printer Drivers IPC$ IPC IPC Service (Samba 4.5.12-Debian) C1860-Series Printer Samsung C1860 Series anne Disk Home Directories Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian] Server Comment --------- ------- COMPAQ Samba 4.5.12-Debian IINETCABLE-SMB Samba 3.0.37 Workgroup Master --------- ------- WORKGROUP IINETCABLE-SMB So, anybody got win10 to talk to Samba? please. I have read somewhere that I can share a printer over ssh, but not found any guide-lines. Would that be easier? Thanks -- Keith Bainbridge keithrbau(a)gmail.com +61 (0)447 667 468

1 0

Distro for Windows User
by Brian Dobbins 11 Dec '18

11 Dec '18

Popular/practical distro for windows users - Zorin, Mint, or orher? Thanks

5 4