caw's questions

I’m turning GNOME animations off via the following command in the terminal:

gsettings set "org.gnome.desktop.interface" "enable-animations" "false"

This works the very first time. After that, after every fresh boot, the effect is gone. I have to repeat changing the setting. And that’s not even enough:

Just repeating the same command is not sufficient. I first have to invert the setting, then put in the setting that I actually want again:

gsettings set "org.gnome.desktop.interface" "enable-animations" "true"
gsettings set "org.gnome.desktop.interface" "enable-animations" "false"

The above is what I need after every boot. Why is that?

How I see the results? In the “gedit” text editor, smooth scrolling depends on animations being enabled.

Edit 1: Where can I see the (lack of) effect from this option after a reboot? In gedit (long text document) and Nautilus (longer list of folders and files in default view), smooth scrolling is disabled immediately after setting the option, but is enabled again after a reboot. On the contrary, in the “Applications” list opened from the dock, the open/close animation for the list remains disabled after a reboot, and smooth scrolling in the list remains disabled as well.

Using NetHogs on an Ubuntu 16.04 (web) server, i.e. on a machine where no consumer applications or web browsers are installed, besides traffic that is to be expected (HTTP and SSH)

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
5266 www-data /usr/sbin/apache2                                 eth0      15.142       2.924 KB/sec
4698 <ME>     sshd: <ME>@pts/0                                  eth0       0.899       0.071 KB/sec

I’m also seeing quite a few suspicious connections that look like this:

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
   ? root     <SERVER_IP_V4>:515-122.228.XXX.XXX:43652                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:4946-92.118.XXX.XXX:44243                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1703-94.177.XXX.XXX:51820                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1433-123.207.XXX.XXX:45628                    0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:34568-223.71.XXX.XXX:40922                    0.000       0.011 KB/sec
   ? root     <SERVER_IP_V4>:9444-51.91.XXX.XXX:46170                      0.000       0.000 KB/sec
   ? root     unknown TCP                                                  0.000       0.000 KB/sec

So they have no associated process ID [1], are all run by root, seem to be outgoing connections from random-looking ports to other random-looking ports (i.e. no outgoing HTTP requests [2] [3]), have no associated device, and all have little to no traffic [4].

The geographic origins of the destination addresses seem to be China, Russian Federation and Seychelles, among others, as per whois.

My firewall rules, as per ufw status verbose, should actually block any incoming traffic except for SSH and HTTP(S). So these outgoing connections would have to be caused by malicious programs running on the host, right?

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  

Is this indeed suspicious or perhaps even evidence of malicious traffic, or are these some false positives (for some reason I may not be seeing)?

Or is the order of the two IP addresses in each pair not relevant [5] [6], so that these might in fact be incoming connections? If so, how can this happen if UFW has been configured to block such connections, and how can one of these connections even have data transferred?

On my Ubuntu 16.04 machine, I have configured UFW like this:

$ sudo apt-get install ufw

$ sudo ufw limit 22/tcp
$ sudo ufw allow 80/tcp
$ sudo ufw allow 443/tcp

$ sudo ufw enable

Now if I run sudo ufw status verbose, the output is the following:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  
22/tcp (v6)                LIMIT IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443/tcp (v6)               ALLOW IN    Anywhere (v6)

Which looks good, as far as I can see: It allows SSH (throttled) and also HTTP and HTTPS. Which is what was desired.

But after a few days, looking into /var/log/ufw.log reveals quite a few entries like the following examples:

Jan 1 00:00:00 <SERVER_NAME> kernel: [<UPTIME>] [UFW BLOCK] IN=eth0 OUT= MAC=<41_CHARACTERS> SRC=<IP_V4> DST=<IP_V4> LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=1234 DF PROTO=TCP SPT=17708 DPT=443 WINDOW=0 RES=0x00 RST URGP=0

Jan 2 23:59:59 <SERVER_NAME> kernel: [<UPTIME>] [UFW BLOCK] IN=eth0 OUT= MAC=<41_CHARACTERS> SRC=<IP_V4> DST=<IP_V4> LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=23456 DF PROTO=TCP SPT=29199 DPT=443 WINDOW=1061 RES=0x00 ACK FIN URGP=0

As per DPT=443, is UFW blocking some HTTPS requests? Why is that? HTTPS (i.e. port 443 via TCP) is explicitly allowed in the UFW configuration, as seen above, isn’t it? What other reasons could there be for UFW to block these requests?

(UFW clearly doesn’t block all HTTPS requests, as I can open my website via HTTPS in the browser when I try it.)

On my Ubuntu 16.04 Desktop, I regularly (usually multiple times per week) check for updates via the update manager GUI and install all updates that are shown as available.

Today, and this was definitely not the case yesterday, an update was offered for “iproute2” (“networking and traffic control tools”).

Sometimes when an update is available, as today, I go to packages.ubuntu.com to check the detailed changelog and its history (which is not accessible in the GUI).

When I checked the package entry from xenial, the changelog said that the last update was released in 2016. So I checked the entry from xenial-updates instead, and indeed, there was an item at the top describing version “4.3.0-1ubuntu3.16.04.4” which I just received today via the update manager GUI.

Yet the date for that update was given as September 18, 2018. That’s already two full months back! How can this happen? Updates may be delivered to the GUI as part of staged roll-outs, but two full months is quite a long time for a “medium” urgency update to arrive in the update manager GUI after release, isn’t it?

When I have connected to my Ubuntu 16.04 LTS server via SSH, I am greeted with the welcome message and MOTD.

Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0 ...)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

0 packages can be updated.
0 updates are security updates.

New release '18.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

In the last two lines, there’s a prompt to upgrade to the next LTS version, 18.04.1, which has been available for some time now.

But that prompt is not always there. Often, it’s not shown.

This doesn’t seem to be related to the availability of other updates (mentioned in the lines above). It doesn’t seem to depend on the type of user signed in (part of administrator group or not), either. I can’t seem to find any pattern of when it is shown and when it isn’t.

Is there any reasonable way that Ubuntu decides whether this should be shown or not? Or is it just shown or hidden randomly?

For users of my web service running on Ubuntu Server 16.04 or 18.04, I’d like to integrate features from such useful programs as ImageMagick. For example, I’d like to crop their profile pictures or create thumbnails.

But because software in general has bugs, and especially ImageMagick has a lot of them [1] [2], it would obviously best to isolate the execution of ImageMagick from the rest of the server, right?

So what’s the best way to isolate ImageMagick from a security perspective, taking into account that the setup should be as simple as possible and that ImageMagick will have to run every few seconds (or even multiple times per second at peak times)? Ideally, ImageMagick would not only be isolated from the host machine, but ImageMagick executions (with the data they operate on) would be isolated from each other as well.

I guess one can use a VM or containers (e.g. Docker) for this? Are containers better-suited because they are faster to set up and tear down again?

Moreover, what’s a good way to get started? I have taken a look at various manuals, but don’t know where exactly to start and which components I need.

What I have so far is the following. Though I don’t know if that’s actually secure, and the costly installation of packages should only be done once, if possible. Moreover, I’m not sure if this actually allows for parallel execution by multiple users.

Dockerfile:

FROM ubuntu:16.04

RUN apt-get update
RUN apt-get install -y imagemagick

VOLUME ["/my-images"]
WORKDIR /my-images

ENTRYPOINT ["convert"]

Initialization:

docker build -t my-imagemagick .

Usage:

docker run --rm --volume=$(pwd):/my-images:rw my-imagemagick -resize 500 /my-images/input.jpg /my-images/output.jpg

In /etc/apache2/apache2.conf, I have the following configuration for Apache with regard to the /var/www directory:

<Directory /var/www/>
    Options -Indexes -Includes -ExecCGI
    AllowOverride All
    Require all granted
</Directory>

In /etc/apache2/sites-enabled/example.com.conf then, this is how I've set up my virtual host for example.com:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin [email protected]
    DocumentRoot /var/www/example.com/public

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Everything is working fine so far.

But as soon as I edit the <Directory /var/www/> part (see above) from

Options -Indexes -Includes -ExecCGI

to

Options -Indexes -FollowSymLinks -Includes -ExecCGI

the website stops working and responds with a 403 error instead.

Why is this happening? Nowhere did I use any symbolic links, at least not consciously. So is Apache using them internally when working with virtual hosts?

I don't see any reason why that option should break the setup. The website is actually stored in /var/www/example.com/public, that's not a symbolic link, either.

My Ubuntu 16.04 machine has 4 CPU cores, and one of them (which one exactly varies) always has a load of 90% to 100%.

This is true no matter what I'm doing, and even when I'm not doing anything at all, with no window open. It's happening right after boot or hours into work.

I've read the two popular related questions here and here, but these didn't help, unfortunately.

During the major part of my working time, my productivity is not affected by this problem. The only reasons I know about the problem then is that the fans are always working at their maximum power and Ubuntu's system monitoring says that one of the cores is under heavy load.

But perhaps 10% of my working time is affected by incredibly bad responsiveness, as an additional manifestation.

Especially the UI (during animations and when reacting to clicks) is super slow. That lead me to the idea that, perhaps, the CPU is doing the GPU's work as well. But that was probably an unfounded belief only, and the data below seems to contradict as well.

My concern is whether this problem, if I can't fix it, will have a (significant) impact on my computer's lifetime or not. I don't know what a constant load of >90% does to a CPU over months or years.

Anyway, here's the data that I could collect from my machine, which may be related or helpful:

top:

 PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND  
 415 root      20   0       0      0      0 R  97,3  0,0   1:39.30 kworker/2:2                                                                                       
2442 john      20   0  663828  38704  29852 S   3,3  0,5   0:00.90 gnome-terminal-                                                                                   
1194 root      20   0  335728  69900  48392 S   2,3  0,9   0:08.36 Xorg                                                                                              
1821 john      20   0 1423440 114660  77600 S   1,3  1,5   0:03.77 compiz                                                                                            
6 root         20   0       0      0      0 D   0,3  0,0   0:00.84 kworker/u8:0                                           

grep . -r /sys/firmware/acpi/interrupts/:

/sys/firmware/acpi/interrupts/sci:        36
/sys/firmware/acpi/interrupts/error:       0
/sys/firmware/acpi/interrupts/gpe00:       0   invalid
/sys/firmware/acpi/interrupts/gpe01:       0   invalid
/sys/firmware/acpi/interrupts/gpe02:       0   invalid
/sys/firmware/acpi/interrupts/gpe03:      36   enabled
/sys/firmware/acpi/interrupts/gpe04:       0   invalid
(...)
/sys/firmware/acpi/interrupts/gpe1F:       0   disabled
/sys/firmware/acpi/interrupts/sci_not:     0
/sys/firmware/acpi/interrupts/ff_pmtimer:  0   invalid
/sys/firmware/acpi/interrupts/ff_rt_clk:   0   disabled
/sys/firmware/acpi/interrupts/gpe_all:    36
/sys/firmware/acpi/interrupts/ff_gbl_lock: 0   enabled
/sys/firmware/acpi/interrupts/ff_pwr_btn:  0   enabled
/sys/firmware/acpi/interrupts/ff_slp_btn:  0   invalid

uname -a:

Linux my-host-name 4.4.0-47-generic #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

cat /proc/cmdline:

BOOT_IMAGE=/vmlinuz-4.8.0-28-generic.efi.signed root=/dev/mapper/ubuntu--vg-root ro quiet splash vt.handoff=7

lspci -v:

00:00.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1576
    Subsystem: Hewlett-Packard Company Device 81f9
    Flags: bus master, fast devsel, latency 0

00:00.2 IOMMU: Advanced Micro Devices, Inc. [AMD] Device 1577
    Subsystem: Hewlett-Packard Company Device 81f9
    Flags: bus master, fast devsel, latency 0, IRQ 24
    Capabilities: <access denied>

00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Carrizo (rev ca) (prog-if 00 [VGA controller])
    DeviceName: ATI EG BROADWAY
    Subsystem: Hewlett-Packard Company Carrizo
    Flags: bus master, fast devsel, latency 0, IRQ 227
    Memory at e0000000 (64-bit, prefetchable) [size=256M]
    Memory at f0800000 (64-bit, prefetchable) [size=8M]
    I/O ports at 4000 [size=256]
    Memory at f0500000 (32-bit, non-prefetchable) [size=256K]
    Expansion ROM at f0580000 [disabled] [size=128K]
    Capabilities: <access denied>
    Kernel driver in use: amdgpu
    Kernel modules: amdgpu

...

00:08.0 Encryption controller: Advanced Micro Devices, Inc. [AMD] Device 1578
    Subsystem: Hewlett-Packard Company Device 81f9
    Flags: bus master, fast devsel, latency 0, IRQ 255
    Memory at f0540000 (64-bit, prefetchable) [size=128K]
    Memory at f0300000 (32-bit, non-prefetchable) [size=1M]
    Memory at f0570000 (32-bit, non-prefetchable) [size=4K]
    Memory at f056a000 (32-bit, non-prefetchable) [size=8K]
    Capabilities: <access denied>

...

01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8101/2/6E PCI Express Fast/Gigabit Ethernet controller (rev 07)
    Subsystem: Hewlett-Packard Company RTL8101/2/6E PCI Express Fast/Gigabit Ethernet controller
    Flags: bus master, fast devsel, latency 0, IRQ 225
    I/O ports at 3000 [size=256]
    Memory at f0400000 (64-bit, non-prefetchable) [size=4K]
    Memory at f0100000 (64-bit, prefetchable) [size=16K]
    Capabilities: <access denied>
    Kernel driver in use: r8169
    Kernel modules: r8169

02:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8723BE PCIe Wireless Network Adapter
    DeviceName: Sanji2
    Subsystem: Hewlett-Packard Company RTL8723BE PCIe Wireless Network Adapter
    Flags: bus master, fast devsel, latency 0, IRQ 231
    I/O ports at 2000 [size=256]
    Memory at f1000000 (64-bit, non-prefetchable) [size=16K]
    Capabilities: <access denied>
    Kernel driver in use: rtl8723be
    Kernel modules: rtl8723be

Can anybody help?

I've set up a fresh installation of Ubuntu 16.04 and enabled full disk encryption using LUKS during installation.

Since the correct key map for my locale was not available yet, I entered a really weak password that was easy to type, with the intent of changing it after successful installation.

Now I'm starting to wonder whether this is a good idea at all. My question is about the strength of the encryption key and the effect of changing my password retroactively. Which of the following two scenarios is true?

1. The strength of the encryption key is completely unrelated to the strength of the password that the user chose. The encryption key is always of similar strength and is generated randomly, with the user's password simply acting as some kind of "salt". What attackers will try to crack is not the encryption key but the user's password. So changing the user's password from a weak one to a strong one retroactively does significantly improve security.

2. The strength of the encryption key is directly dependent on the strength of the original password that the user chose. The encryption key significantly varys in strength and is derived from the user's password (in a deterministic way). What attackers will try to crack is either the user's password or the encryption key itself. Changing the user's password from a weak one to a strong one retroactively does not really improve security because attackers will not try to crack the (now strong) password but the (still weak) encryption key whose strength didn't change through the password change and which is weak because the initial password was weak.

A while ago, I had to disable Secure Boot in UEFI in order to install a third-party driver.

Now that this third-party driver isn't required anymore (due to kernel updates), I have uninstalled it.

Having removed that unsigned driver, I thought it might be a good idea now to enable Secure Boot again. Is it? Or could malware have caused damage in the meantime, e.g. adding new Secure Boot keys, so that Secure Boot is not "secure" anymore after it has been disabled once?

On an Ubuntu 10 server (yes, not the latest version anymore), I would like to run LaTeX so that I can invoke the program via command line and pass .tex files to compile. Is this possible?

TeX Live would be one of the distributions that you can choose, right?

I can just install it with the following command, can't I?

sudo apt-get install texlive

And then? How can I invoke TeX Live via command line, without a GUI (as this is on a remote server)?

I've installed the official Oracle Java on my Ubuntu machine. For that I did the following:

1. Download the latest JRE for x64 (.tar.gz)
2. Unpacked this archive on my Windows machine
3. Uploaded the folder jre_1.7.0 to my Ubuntu machine (via FTP)
4. Used update-alternatives --install and update-alternatives --set to install Java

When I tried java -version, Ubuntu said permission denied. So I manually added the execution permission (chmod) to all files in jre_1.7.0/bin. Then, java -version worked:

java version "1.7.0_15"
Java(TM) SE Runtime Environment (build 1.7.0_15-b03)
Java HotSpot(TM) 64-Bit Server VM (build 23.7-b01, mixed mode)

For installing Openfire (XMPP Server), which did not work, I tried the following:

1. Download the latest .deb package
2. Install it via sudo dpkg -i openfire_3.8.0_all.deb

This failed due to the following dependency problem:

dpkg: regarding openfire_3.8.0_all.deb containing openfire, pre-dependency problem:
 openfire pre-depends on sun-java5-jre | sun-java6-jre | default-jre-headless | openjdk-6-jre
  sun-java5-jre is not installed.
  sun-java6-jre is not installed.
  default-jre-headless is not installed.
  openjdk-6-jre is not installed but configs remain.
dpkg: error processing openfire_3.8.0_all.deb (--install):
 pre-dependency problem - not installing openfire

Why doesn't it find Java? What am I doing wrong? Thanks in advance!

I'm running Ubuntu 11.10. I'm installing GNAT, but I want GNAT 3.40 (which came with Ubuntu 5.10), not the latest version. Is it possible to get GNAT 3.40 on an Ubuntu 11.10 machine?

I thought about this solution:

/etc/apt/preferences.d/gnat

Package: gnat
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: gcc
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libc6
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libc6-dev
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libgcc1
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libgnat
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libgnatprj4.1
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Package: libgnatvsn4.1
Pin: release v=5.10, l=Ubuntu
Pin-Priority: 1001

Or is this impossible? Maybe these version are too old to be compatible with Ubuntu 11.10? Or the changes are too extensive?