user1086913's questions

As of today I am not able to access IP addresses on my local network on Ubuntu 20.04. Yesterday everything was fine, obviously some updates went through and messed things up. I am using a native VPN client and I have ufw enabled with the firewall's default settings:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

Disabling VPN or ufw makes my local network accessable. It seems I need to set up a specific rule for the VPN interface, tried sudo ufw allow from 192.168.1.0/24 without any luck.

I would like to set up a strict rule allowing me to access a particular IP address on my network, let's say 192.168.1.1 when my VPN is running and ufw is enabled. Thanks.

edit: Here's the grep UFW /var/log/syslog output:

[UFW BLOCK] IN=wlp5s0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=0 DF PROTO=2

edit2: Here's the /var/log/apt/history.log output:

Start-Date: 2020-06-25  09:17:29
Commandline: apt-get upgrade
Requested-By: XYZ (1000)
Upgrade: linux-libc-dev:amd64 (5.4.0-37.41, 5.4.0-39.43), libcurl4:amd64 (7.68.0-1ubuntu2, 7.68.0-1ubuntu2.1), curl:amd64 (7.68.0-1ubuntu2, 7.68.0-1ubuntu2.1), libcurl3-gnutls:amd64 (7.68.0-1ubuntu2, 7.68.0-1ubuntu2.1), libcurl3-gnutls:i386 (7.68.0-1ubuntu2, 7.68.0-1ubuntu2.1)
End-Date: 2020-06-25  09:17:32

Start-Date: 2020-06-25  09:19:34
Commandline: aptdaemon role='role-commit-packages' sender=':1.126'
Install: linux-image-5.4.0-39-generic:amd64 (5.4.0-39.43, automatic), linux-headers-5.4.0-39:amd64 (5.4.0-39.43, automatic), linux-modules-extra-5.4.0-39-generic:amd64 (5.4.0-39.43, automatic), linux-headers-5.4.0-39-generic:amd64 (5.4.0-39.43, automatic), linux-modules-5.4.0-39-generic:amd64 (5.4.0-39.43, automatic)
Upgrade: linux-headers-generic-hwe-20.04:amd64 (5.4.0.37.40, 5.4.0.39.42), linux-image-generic-hwe-20.04:amd64 (5.4.0.37.40, 5.4.0.39.42), linux-generic-hwe-20.04:amd64 (5.4.0.37.40, 5.4.0.39.42)
End-Date: 2020-06-25  09:20:12

I'm using Yubikey's U2F feature as a second factor to login on Ubuntu 20.04 as described here: https://support.yubico.com/support/solutions/articles/15000011356-ubuntu-linux-login-guide-u2f

However, I would like to add an extra layer of security and lock users (including me as root) who fail to enter the correct password 10 times in a row. I added in /etc/pam.d/system-auth:

auth     required       pam_tally2.so deny=10 even_deny_root unlock_time=3600

To check that it's working I performed a sudo echo test which includes entering my password and authenticating with my Yubikey as a second factor. Then ran:

sudo pam_tally2 -u user

Which gave an output something like:

Login           Failures Latest   failure     From
user            1        01/01/01 11:00:00    tty1

Continued testing and found out that every successfull attempt is being logged as a failure by pam_tally2 and I do believe it is because of the Yubikey.

Is there a way to achieve my goal to lock the user who fails entering his credentials on lock screen while preserving my Yubikey as a two factor? Thanks.

I am dual booting Ubuntu 20.04 installed with a dedicated home and swap partition. I encrypted both home and swap using encryptfs after install. Since then no issues or whatsoever. After running some updates today I got a warning message at boot stating that:

cryptsetup: WARNING: Option 'size' missing in crypttab for plain dm-crypt mapping cryptswap1. Please read /usr/share/doc/cryptsetup/README.initramfs and add the correct 'size' option to your crypttab(5).

Following the suggestion in this thread I added the option size=256 to the content of /etc/crypttab:

cryptswap1 UUID=XXXXXXXXXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64,size=256

Didn't work though, the warning message at boot still persists with no noticable effect to the system.

The output of sudo cryptsetup status /dev/mapper/cryptswap1 is as following:

/dev/mapper/cryptswap1 is active and is in use.
  type:    PLAIN
  cipher:  aes-xts-plain64
  keysize: 256 bits
  key location: dm-crypt
  device:  /dev/sda4
  sector size:  512
  offset:  1024 sectors
  size:    39060480 sectors
  mode:    read/write

I will appreciate some advice here, thanks.