After the recent upgrade to 12, I notice permanent connections to canonical servers.
Running netstat -tp gives:
Foreign Address State PID/Program name
mulberry.canonical:http CLOSE_WAIT 6537/ubuntu-geoip-p
alkes.canonical.co:http CLOSE_WAIT 6667/python
alkes.canonical.co:http CLOSE_WAIT 6667/python
Why are there permanent connections and how could I stop this behavior?
And if this is intentional, who is responsible?
I would like to understand why this was done because to me it seems like a bad idea.
One is a Ubuntu GeoIP Provider and the others are scopes.
To list what services are connecting to IP addresses try
sudo lsof -n -P -i +c 15Ubuntu GeoIp Provider
I don't know what the geoip provider connection is for, what it does, or why we've been told we need it. I can find little information about it, and any attempted explanations about what it is for are ambiguous, at best.
This is the only rogue connection I have left.What I do know, is that geoip calls home every time you connect to the internet, and also at seemingly arbitrary times too. In 12.10 these connections increase.
What is the value of this connection? Who knows. Ubuntu, in its infinite wisdom, obviously feels there is a value. Why else would they implement a connection that always calls home, is enabled by default, and does not have an option to disable?
Changing
Settings > Time & Date > Automatically from the internet -> Manuallywill not stop geoip connections.For more on ubuntu-geoip-provider read Is ubuntu-geoip geoclue used for tracking. Apparently if you want to disable it you can do so by removing the datetime indicator.
-- update -- I seemed to have stumbled upon a way to disable this connection. * **
$ dconf-editorcom/ubuntu/geoipoptiongeoip-urlto nothing"".or
Done. Happy days, no more geoip connections.
* Disclaimer: I don't know if there any negative effects of disabling geoip provider connections in the way described above.
** This may only apply to 12.10
Scopes
A scope is essentially a data provider. Example, open your dash, then click on the video icon (Super+v), then search for a video. If you have a video scope installed, you will see an "Online Videos" section in the results that are displayed. Those results are from your video scope! The video scope has queried its video data provider and returned videos relevant to your search.
You may have other scopes, e.g. music (super+m), photos, amazon, ebay, etc.
A scope is used with a lens.
For more information: What exactly is a lens and What's the difference between a lens & scope.
To check what scopes and lens are currently installed you can use
dpkgwithgrep:dpkg -l | grep scopedpkg -l | grep lensExample:
To see what scopes and lens you can install search the Software Center for Unity Lens & unity Scope, or use apt-get:
Removing Scopes
You can remove scopes with no problems, after all, they are just data providers.
I removed the video scope and I don't have any
PID/pythonconnections anymore. I can't search for online videos from the dash, but I never used that feature anyways.Scopes in 12.10
12.10 introduces an option to disable network connections when seaching in the dash. To disable go to System Settings > Privacy > Search Results and turn off the option "When searching in Dash: Include online search results."
This does not disable geoip connections, which are not part of the dash.
There's now a legal notice about this data collection. You'll find a link to it in the bottom right of the dash. I figure I'll post the notice here in full for posterity (see notes section) and here's the part I always love best:
Notes on updating to 12.10
On updating to 12.10 I found a new scope installed
unuty-scope-gdocsand several new lenses, one of which I guess triggered the introduction of the option to disable connections:unity-lens-shopping.You might want to uninstall some these — the shopping lens for a start [rolls eyes].
Searching in the dash - Legal notice - 21 Oct 2012
Remote Login Service
When LightDM starts it pings
uccs.landscape.canonical.comto make sure the service exists and is usable before prompting the user to interact with it. To disable this feature (and remote login profile storage access in general) you can edit/etc/remote-login-service.confand remove theCanonicalentry from the list of servers in theRemote Login Servicegroup. The original looks like:The edited version should look like:
The connections to
alkes.canonical.co:httpmay be the Video and Music lenses connecting to the internet. You can try removing them to see:You can uninstall these lenses with the following:
Alternatively, you can use this command to remove the packages and any unused dependencies associated with them:
A third option to try for users of 12.10 is to turn off the Dash's ability to connect to the internet. This is accomplished by going into the System Systems > Privacy center and setting the internet connectivity option to Off.
The mulberry connection is as other answers indicate, the geoip package, which the provided link explains.
It sounds like they are associated with setting your timezone and being able to search for online videos by searching for something in the launcher and clicking the "video" button to search online for videos.
According to one bug report, it sounds like there is no plan to remove these connections even if you don't need/use them: https://bugs.launchpad.net/ubuntu/+bug/944251
You should not uninstall python, as many Ubuntu programs rely on it.
Already answered here.
I don't know.
I don't think Zeitgeist sends personal identifiable information.
There is a "quick fix" for most of this... A utility that rids you of zeitgeist and whoopsie and restricts the geo-ip traffic without breaking anything. Also, it provides some basic hardening against external attacks and turns off IP forwarding. See http://foxtrot7security.blogspot.com/2013/04/ubuntu-linux-improving-privacy-and.html or get the code from http://code.google.com/p/pangolin-lockdown-utility. It is a simple shell script so it is not like you are downloading a random executable. You can read it and modify as you see fit.