How Secure Is Ubuntu

[madires]

There's a much simpler solution, simply use IPv6 and drop all ssh connections via IPv4 (maybe allow some safe networks). So far I haven't seen any dictionary attacks from IPv6 addresses.

Security by obscurity is never a good idea. However, that is useful in reducing noise in logs.

The reason you do not see attacks on IPv6 is probably because so far it’s cheaper to attack IPv4. The whole IPv4 internet can be enumerated in a matter of minutes, while IPv6 machines must be discovered one by one. But it’s a matter of probability, not a real security feature.

It reduces the attack surface. And I don't see where the obscurity should be. The point is that nearly all ssh attacks come from IPv4 addresses at the moment. So blocking IPv4 ssh connections is more efficient than running fail2ban and Co. This will change in the future when IPv4 is phased out. Anyhow, you have to make sure to keep your ssh daemon up-to-date, to use strong passwords (for direct login or the keys), and also to keep the keys safe. The goal is to make it as hard as possible for the attacker. Blocking specific IP addresses (or address family in this case) is part of that game, and not "security by obscurity".

[bostonman]

Is there a particular reason you want to build one instead of just buying a ready made system? It's still fun to build, and you can get exactly what you want, but it sounds like you don't know exactly what you want, so maybe just buy one that is already put together and guaranteed to work. The most low end crappy thing you can buy today is going to be so much faster than anything that came with XP that there is no comparison, we're talking an order of magnitude or more. You can even get good used stuff, core i3 or i5 Lenovo desktop for maybe $150. Pop in a SSD and install the OS of your choice.

I don't want to deviate from the topic of this thread, however, I don't want to blow off your question. One reason I haven't dumped my current PC is due to the amount of software I've "obtained" over the years. Keeping older versions of software doesn't make sense, but I can't obtain new versions very easily anymore (or at least I'm unfamiliar with newer methods), or, if I do obtain newer versions, I may end up visiting non-safe sites, using keygen's, etc...

The other reason is to build one that is quite powerful rather than go commercial, get loads of useless software that expires in thirty-days, etc...  and have a mediocre PC rather than something high end. I plan to do 3D graphics, PCB layout, etc... so I want a powerful machine.

[NiHaoMike]

What about redirect the attacker to a fake SSH server that accepts any login and then spew random data to try to crash the attacker?

[Monkeh]

What about redirect the attacker to a fake SSH server that accepts any login and then spew random data to try to crash the attacker?

Don't antagonize children with botnets.

[james_s]

I don't want to deviate from the topic of this thread, however, I don't want to blow off your question. One reason I haven't dumped my current PC is due to the amount of software I've "obtained" over the years. Keeping older versions of software doesn't make sense, but I can't obtain new versions very easily anymore (or at least I'm unfamiliar with newer methods), or, if I do obtain newer versions, I may end up visiting non-safe sites, using keygen's, etc...

The other reason is to build one that is quite powerful rather than go commercial, get loads of useless software that expires in thirty-days, etc...  and have a mediocre PC rather than something high end. I plan to do 3D graphics, PCB layout, etc... so I want a powerful machine.

Well you can blow away the software on a ready made system and install from scratch, that's what I've done on my laptops.

You can image your whole existing hard drive and run it in a VirtualBox VM on a new machine. You can boot the old XP install under whatever host OS you want.

[jmelson]

1.  Have an absolute minimum number of user accounts on the machine, like ONE.

That is a very bad idea. If you have only the root user, it means three things: that you are logging in as root, that the root user is accessible from internet and that you have services running as root. Triple tragedy.

No, on Ubuntu, by default, the root used cannot log in remotely.  You have to log in as a general user and then either su, ssh or sudo
from the already logged-in account.

[Monkeh]

1.  Have an absolute minimum number of user accounts on the machine, like ONE.

That is a very bad idea. If you have only the root user, it means three things: that you are logging in as root, that the root user is accessible from internet and that you have services running as root. Triple tragedy.

No, on Ubuntu, by default, the root used cannot log in remotely.  You have to log in as a general user and then either su, ssh or sudo
from the already logged-in account.

But again, consolidating every service under a single user is a catastrophically bad idea.

[Marco]

Sudo protects against accidentally deleting root or a user program bug doing it.

It also provides a trivial avenue for privilege escalation from any sudo user account. Just install a terminal with a keylogger inside the given user's environment, takes no higher privileges, and wait for them to enter their password.

[golden_labels]

No, on Ubuntu, by default, the root used cannot log in remotely.  You have to log in as a general user and then either su, ssh or sudo from the already logged-in account.

Then there are already two users, at least.

Sudo protects against accidentally deleting root or a user program bug doing it.

More importantly, it allows control over what commands may be called and keeps logs of its invocations. Unlike logging in as root, which gives unrestricted access and leaves little to no traces.

It also provides a trivial avenue for privilege escalation from any sudo user account. Just install a terminal with a keylogger inside the given user's environment, takes no higher privileges, and wait for them to enter their password.

Only if sudo is unrestricted and that is not different than the user logging in as root using su or ssh. With sudo being restricted, obtaining the password gives only limited access. Sometimes so limited that you can disable authentication for per-user setsuit-style invocation. And all this assumes passwords are used instead of key-based authentication.

[jmelson]

But again, consolidating every service under a single user is a catastrophically bad idea.

I did not do that.  There are many services that have various accounts, NONE of which will accept "logins" from outside.
The web server (apache2), pop server, SMTP server, etc. all have their own accounts, with appropriate privileges.

But, there is ONLY ONE account that will accept an ssh login.  The issue I had many years ago was to have multiple people who could set dumb passwords like "joe" or "bob".  That is just asking for password guessing and then they have a beachhead to mount a brute-force attack on the passwords.

Jon

[grumpydoc]

But, there is ONLY ONE account that will accept an ssh login.  The issue I had many years ago was to have multiple people who could set dumb passwords like "joe" or "bob".  That is just asking for password guessing and then they have a beachhead to mount a brute-force attack on the passwords.

Jon

Don't allow passwords, even over ssh - insist on ssh keys. Weak passwords matter much less if you do that.

[ricard2k]

The security is not in the OS, but in the user.
If you use you ubuntu with and old browser and you visit sites of "dubious reputation", please have other PC to save your valuable data.
Also try to have the system up to date.