LightDM configuration files are located in /usr/share/lightdm and /etc/lightdm. Disabling Guest account can be easily done by adding a rule into one of the two directories. And below I made a change in /etc/lightdm:
First I created a folder inside lightdm using the command # sudo mkdir /etc/lightdm/lightdm.conf.d
Secondly I changed the working directory by entering the command # cd lightdm.conf.d
Thirdly I created a file called '50-no-guest.conf' inside the above directory and add below two lines to the newly created file. To create the file: # sudo vi 50-no-guest.conf
Then add below entries to the file [SeatDefaults] allow-guest=false
This can be done by the command in a single step. # sudo sh -c 'printf "[SeatDefaults]\nallow-guest=false\n" > /etc/lightdm/lightdm.conf.d/50-no-guest.conf'
In order to reenable the Guest account, you may use the command. # sudo rm /etc/lightdm/lightdm.conf.d/50-no-guest.conf
I wanted to convert an already configured partition to an encrypted partition. As the encryption utility, "cryptsetup" was used.
Since mine was a fresh installation, I was not worrying about loosing data on my Laptop. However if you are planning to do the same, please make sure to backup all the data before start conversion.
Below command shows you the details of available disks.
#fdisk -l
Device Start End Sectors Size Type /dev/sda1 2048 923647 921600 450M Windows recovery environment /dev/sda2 923648 1128447 204800 100M EFI System ....... ....... /dev/sda6 567171072 582795263 15624192 7.5G Linux swap /dev/sda7 582795264 781459455 198664192 94.7G Linux filesystem /dev/sda8 781459456 976771071 195311616 93.1G Linux filesystem
Using the below command also shows you the details of partitioned disk.
# df -h
I
wanted to convert /dev/sda8 partition to an encrypted partition. In
oder to view the integration of /dev/sda8 disk, fstab file details. The
fstab (/etc/fstab) (or file systems table) file is a system
configuration file on Debian systems. The fstab file typically lists all
available disks and disk partitions, and indicates how they are to be
initialized or otherwise integrated into the overall system's file
system. This conf file can be read using the command:
#cat /etc/fstab # cat /etc/fstab # /etc/fstab: static file system information. # # # / was on /dev/sda7 during installation UUID=61050990-a94f-4629-81cb-14722123d668 / ext4 errors=remount-ro 0 1 # /CERT was on /dev/sda8 during installation UUID=424bae11-5e73-44e8-9ccd-d1eb3ef44f82 /CERT ext4 defaults 0 2 # /boot/efi was on /dev/sda2 during installation UUID=E413-CC25 /boot/efi vfat umask=0077 0 1 # swap was on /dev/sda6 during installation UUID=1dd43a59-2bc7-49ce-b7b3-964ec836620f none swap sw 0 0
To encrypt the partition, I used the Disk Utility, which comes with Ubuntu 16.04. The below steps show the process of encrypting a partition.
Below figure shows the file system before the encryption.
Below figure shows the way of encrypting the partition. At this stage you need to enter a strong passphrase which complies with password security configuration best practices.
Below figure shows the file system configuration once the encryption is finished.
Finally I rebooted the system to check possible errors. After rebooting the OS, I manually mounted the encrypted partition.Below image shows a snap of manual mounting process. Passphrase needs to be entered here.
Errors encountered during the process of setting up an encrypted partition.
If you don't have already installed version of "cryptsetup". You will get the below error message when you try to create the encrypted partition.
Opz. I got the above error message and I installed cryptsetup using the below command and restarted the above encryption process. #sudo apt-get install cryptsetup
If you forgot to comment/delete the existing entry pertaining to /dev/sda8 in /etc/fstab, you will encounter an error message during reboot. Unfortunately I was experiencing the same error. :(
I was ended up with a error message saying that: "A start job is running for dev-disk-by\x....................device. "
After waiting up to 90 seconds, I found myself in emergency mode.
I order to trouble shoot, I ran the below steps.
To view the active and inactive disk units, I used the below command. #systemctl --full -a |grep x2duuid
When listing units, "-a" show all loaded units, regardless of their state, including inactive units. With the filter to show only "x2duuid", active and inactive disks could be viewed. The received output is:
The above output shows that the partition with the UUID 424bae11-5e73-44e8-9ccd-d1eb3ef44f82 is inactive. This is the the encrypted partition.
I commented the entry pertaining to above partition from fstab as show below.
# cat /etc/fstab # /etc/fstab: static file system information. # # # / was on /dev/sda7 during installation UUID=61050990-a94f-4629-81cb-14722123d668 / ext4 errors=remount-ro 0 1 # /CERT was on /dev/sda8 during installation #UUID=424bae11-5e73-44e8-9ccd-d1eb3ef44f82 /CERT ext4 defaults 0 2 # /boot/efi was on /dev/sda2 during installation
As the final step I rebooted my system and fortunately It worked for me.
After OS is booted up, you can manually mount the encrypted partition by double clicking in file explorer.
Once it is downloaded I entered the below command to install it. #sudo dpkg -i virtualbox-5.0_5.0.18-106667~Ubuntu~xenial_amd64.deb
However I was getting the dependency errors listed below. dpkg: dependency problems prevent configuration of virtualbox-5.0: virtualbox-5.0 depends on libqt4-opengl (>= 4:4.7.2); however: Package libqt4-opengl is not installed.
dpkg: error processing package virtualbox-5.0 (--install): dependency problems - leaving unconfigured Processing triggers for ureadahead (0.100.0-19) ... Processing triggers for systemd (229-4ubuntu4) ... Processing triggers for hicolor-icon-theme (0.15-0ubuntu1) ... Processing triggers for shared-mime-info (1.5-2) ... Processing triggers for gnome-menus (3.13.3-6ubuntu3) ... Processing triggers for desktop-file-utils (0.22-1ubuntu5) ... Processing triggers for bamfdaemon (0.5.3~bzr0+16.04.20160415-0ubuntu1) ... Rebuilding /usr/share/applications/bamf-2.index... Processing triggers for mime-support (3.59ubuntu1) ... Errors were encountered while processing: virtualbox-5.0
I assume that you might have also encounted the same error while you are trying to install VirtualBox on Ubuntu 16.04.
To resolve the above error. I tried the below list of commands. Firstly I checked for latest updates using: #sudo apt-get update
Then installed the missing packages using the command: #sudo apt-get install libqt4-opengl
At this stage you may try the below command instead of individually installing missing packages. #sudo apt-get -f install
This will fix the previously encountered error and recompile the VirtualBox and you will get the below output in your terminal. Setting up virtualbox-5.0 (5.0.18-106667~Ubuntu~xenial) ... Adding group `vboxusers' (GID 129) ... Done. Stopping VirtualBox kernel modules ...done. Recompiling VirtualBox kernel modules
...done. Starting VirtualBox kernel modules ...failed! (modprobe vboxdrv failed. Please use 'dmesg' to find out why) Processing triggers for libc-bin (2.23-0ubuntu3) ...
RPM is a great utility used to install, upgrade and verify software packages on your Red Hat system. It's the verify feature that we are most interested in as this can be
used to check our files and make sure they have not been modified or
replaced.
I was trying to check the package integrity using RPM. Unfortunately I was having hard time to read the output.
Herewith I'm sharing a way of interpreting the output of the command.
# rpm -qVa | awk '$2 != "c" {print $0}'
To explain the switches of the above command. The
first is the "-V" switch which allows you to check the integrity of all
files associated with a specific package. The output we receive may look like the above published output.
The only files that get listed are the files that fail the verification. Any files that are not listed are assumed to be OK. On the left of this output we have the reason why this particular file failed the verify check. A legend of the results would be as followed:
S = size change M = permissions change 5 = MD5 changed L = Symlink changed D = Device change U = User change G = Group change T = Date/Time change missing = file is gone
When reviewing RPM's output, keep an eye out for very strange entries like a change in the MD5 value but the date/time stamp and/or file size is reported as being the same. This could be caused by an attacker who has modified or replaced files but is trying to cover their tracks. But for other files we need to check carefully to see whether the integrity has been compromised or not.
In order to analyze the results for example, in the above output, it says the file has been modified. But for configuration files this is common and it needs to be modified to suit the requirement. But we should ensure that it has been modified correctly and they are legitimate.
Most of the servers support the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits. This is considerably easier to exploit if the attacker is on the same physical network.
Some of the such weak cipher suits are:
DES-CBC(56)
DES-CBC(40)
RC4(40)
RC2(40)
I was administering set of Windows servers and here are the steps that I followed to disable these weak cipher suits.
To enable/disable Weak Cipher Suites in Windows Server 2003:
Start Registry Editor (Regedt32.exe), and then locate the following registry key:
To enable this cipher algorithm, change the DWORD value data of the Enabled value to 0xffffffff. Or, change the DWORD value data to 0x0.
If you do not configure the Enabled value, the default is enabled. This
registry key does not apply to an exportable server that does not have
an SGC certificate.
To disable this cipher algorithm, change the DWORD value data of the Enabled value to 0x00000001.
To enable/disable Weak Cipher Suites in Windows Server 2008:
Network Level Authentication completes user authentication before you
establish a remote desktop connection and the logon screen appears. This
is a more secure authentication method that can help protect the remote
computer from malicious users and malicious software. Further this can help provide better security by reducing the risk of denial-of-service attacks.
To use Network Level Authentication, you must meet the following requirements:
The client computer must be using at least Remote Desktop Connection 6.0.
The client computer must be using an
operating system, such as Windows 7, Windows Vista, or Windows XP with
Service Pack 3, that supports the Credential Security Support Provider
(CredSSP) protocol.
The RD Session Host server must be running Windows Server 2008 R2 or Windows Server 2008.
To configure Network Level Authentication for a connection in Windows Server 2008 R2 or Windows Server 2008.
On the RD Session Host server, open Remote Desktop
Session Host Configuration. To open Remote Desktop Session Host
Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.
Under Connections, right-click the name of the connection, and then click Properties.
On the General tab, select the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.
Clikc OK
To determine whether a computer is running a version of Remote Desktop
Connection that supports Network Level Authentication, start Remote
Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase Network Level Authentication supported in the About Remote Desktop Connection dialog box.
To disable (Alternative method):
If you want, you can disable NLA by running tsconfig.msc on your 2008 R2
server, and deselecting the "Allow connection only from computers
running Remote Desktop with Network Level Authentication" option under
the RDP service. To enable NLA in XP machines; first install XP SP3, then edit the registry settings on the XP client machine to allow NLA
Click Start, click Run, type regedit, and then press ENTER.
In the navigation pane, locate and then click the following registry
subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
In the details pane, right-click Security Packages, and then click Modify.
In the Value data box, type tspkg. Leave any data that is specific to other SSPs, and then click OK.
In the navigation pane, locate and then click the following registry
subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
In the details pane, right-click SecurityProviders, and then click Modify.
In the Value data box, type credssp.dll. Leave any data that is specific to other SSPs, and then click OK.
Exit Registry Editor.
Restart the computer.
RDP mechanisms supported on different Server OS versions
Server OS Version
Client OS
Windows Server 2000, 2003
Windows Server 2003 SP1 / R2
Windows Server 2008
Windows XP SP2 and earlier
Network Level Protection or VPN
Pure SSL/TLS
Pure SSL/TLS
Windows XP SP3*, Windows Vista, Windows Vista SP1
Network Level Protection or VPN
Pure SSL/TLS
NLA or
Pure SSL/TLS
Pure SSL/TLS is a standard mechanism that enables clients to authenticate to servers and provides a secure channel by encrypting communications. To use SSL/TLS, you must obtain certificates issued by a trusted Certificate Authority and configure them on each terminal server on which you want to have server authentication.
Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness
Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.
Solution : - Force the use of SSL as a transport layer for this service if supported, or/and - Select the 'Allow connections only from computers running Remote Desktop with Network Level Authentication' setting if it is available.
This is the most frequent vulnerability which scanners will complain about TRACE method being enabled on the web server tested. When the debuging function is enabled on web servers. TRACE and TRACK methods can be executed. Normally you will have this enabled by default, but if you want to test if it is really enabled on your server you just have to telnet on the port your web server is running and request for “TRACE / HTTP/1.0” if you get a positive reply it means TRACE is enabled on your system.
To see if TRACE is supported by your server, you can use curl $ curl -i -X TRACE http://www.example.com
To disable these methods below steps can be followed.
Apache Server: The complex mechanism involves creating a mod_rewrite rule that will disable http methods, which is also quite popular and works with ANY version of apache that supports mod_rewrite. The directives below would need to be set, which are written assuming that this is the first time use for mod_rewrite.
The first thing to do is make sure that mod_rewrite is loaded. If mod_rewrite.so is missing from your apache configuration but you have it installed, (and your install location is /usr/local/apache), then add the following statement to your httpd.conf:
Then add the following as well to your httpd.conf file: RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F]
Please note that by default, rewrite configurations are not inherited across virtual servers. Add RewriteEngine On to each virtual host.. Restart apache, re-run the steps in the Validation section, and with either method, you should receive an HTTP 405-Method Not Allowed status code back.
For newer versions (1.3.34 or later for the legacy branch, and 2.0.55 or later).
Simplest option is to add the TraceEnable directive into your httpd.conf and set the value to Off. Or else if httpd.conf is not available, Set "TraceEnable off" in /etc/apache2/apache2.conf or (if it is in Debian version) in /etc/apache2/sites-enabled/000-default
Finally restart the apache server.
IIS 6 Server:
The only supported mechanism in place for remediation is by installing URLScan from Microsoft, (version 2.5 and version 3.1 are still available). The urlscan.ini file included as part of URLScan sets by default a configuration setting "UseAllowVerbs=1". In the [AllowVerbs] section of the ini file, http methods GET, HEAD, and POST are the only ones listed, so simply by installing URLScan, you are protected from TRACE or TRACK.
II7 Server:
Refer the article http://www.iis.net/configreference/system.webserver/security/requestfiltering/verbs. This provides a detailed description. Sun GlassFish Enterprise Server: If you are using GlassFish v2, you need to set the property "traceEnabled" to "true" or "false" under . Here is the reference documentation that lists out all the property name for http-service. http://docs.sun.com/app/docs/doc/820-4338/abhcq?a=view
If you are using V3, Using Admin Console: Expand Configuration -> Network Config -> Network Listeners Click the listener name that you want to configure. You can then change the Trace-Enabled checkbox under the HTTP Tab.
Using CLI You need to find out the name of the protocol that your listener is using. The following example shows you how to get the current setting and change it to false. By default, Trace is enabled. You need the protocol name, the example below says "http-listener-1" only because the Name of the protocol is "http-listener-1".
$./asadmin get configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.trace-enabled configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.trace-enabled=true Command get executed successfully. $./asadmin set configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.trace-enabled=false configs.config.server-config.network-config.protocols.protocol.http-listener-1.http.trace-enabled=false
Command set executed successfully.
Alternative Option ot disable TRACE/TRACK on Sun Servers Change the obj.conf file in the config directory of the web server instance (i.e. not the admin-server config directory) and add the "If" below.
