Updating Ubuntu

How can I make sure in the terminal that my Ubuntu updates are from the real source?

I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok. I think it was DNS hijacking.

How does a TPM inform me that someone has tampered with the BIOS under Linux / Ubuntu?

I read guides on how to set up a TPM but none of them tells me how a TPM actually works in practice (under Linux/Ubuntu which I use).

My understanding is that a TPM can inform me whether any of the components which load before the main operating system (Bios, bootloader, firmware) have changed in any way since the TPM was activated.

But how exactly would I know whether something has actually changed? If someone (an attacker) has tampered with with the BIOS or some firmware component, will the next boot process simply not complete? If that is correct, will the system boot successfully again, if I manage to put the BIOS back into the state that is known to the TPM?

Master – Master setup on Postgresql 10 + Ubuntu 18.04 + Pgpool II

Does anybody have experience in configuring Pgpool II with Postgresql 10 on Ubuntu 18.04?

I am trying to setup Master – Master setup on Postgresql 10 + Ubuntu. I am trying to use Pgpool II

I will have two or more mater DB servers running on different IPs and my objective is synced with each other.

I am looking for an open-source solution/s Your thoughts, suggestion and experiences are kindly welcome. Cheers

Fully-secured screen lock in Ubuntu with encryption

I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be very secured.

I wish to protect against:

  1. mechanisms that bypass screen lock (I have disabled SysRq, but there might be other ways too)
  2. cold boot attacks
  3. attacks through DMA, network, WiFi/Ethernet, physical ports, etc

What’s the best way to proceed? Can I have a home encryption on top of full disk encryption, and set the screen lock such that the same password will unlock and decrypt the home drive (I don’t want to enter two passwords)?

Is there any secure screen lock (no bug, no vulnerability against X11 crashes, etc)?

The OS + encryption should be able to protect the system 100 percent (except for cold boot attacks which mostly aren’t practical: the data rapidly deteriorates).

Thanks!

Ubuntu Server SSH configuration file help

This is my sshd_config file settings I can connect to my server with my pc using public key but I can also connect from another pc with the password of sudo user account. How can make the login possible only with public key in SSH and SFTP? Thanks a lot

# This is the sshd server system-wide configuration file.  See # sshd_config(5) for more information.  # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin  # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented.  Uncommented options override the # default value.  #Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress ::  #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key  # Ciphers and keying #RekeyLimit default none  # Logging #SyslogFacility AUTH #LogLevel INFO  # Authentication:  LoginGraceTime 1m PermitRootLogin without-password #StrictModes yes MaxAuthTries 3 #MaxSessions 10  PubkeyAuthentication yes  # Expect .ssh/authorized_keys2 to be disregarded by default in future. #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2  #AuthorizedPrincipalsFile none  #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody  # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes  # To disable tunneled clear text passwords, change to no here! PasswordAuthentication no PermitEmptyPasswords no  # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no  # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no  # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no  # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication.  Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM no  #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes PrintMotd no #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none  # no default banner path #Banner none  # Allow client to pass locale environment variables AcceptEnv LANG LC_*  # override default of no subsystems Subsystem   sftp    /usr/lib/openssh/sftp-server  # Example of overriding settings on a per-user basis #Match User anoncvs #   X11Forwarding no #   AllowTcpForwarding no #   PermitTTY no #   ForceCommand cvs server 

Emitir Audio que proviene de line in por salida hdmi en ubuntu

Tengo una ubuntu 16.04 que tengo conectado a un proyector por hdmi, he configurado el sonido seleccionado el output para el hdmi,

como en esta web https://itsfoss.com/how-to-fix-no-sound-through-hdmi-in-external-monitor-in-ubuntu/

el caso es que si reproduzco video de youtube o cual otra aplicación el audio se reproduce por el proyector pero lo que quiero es

enviar al proyector el audio que entra por el line in de la tarjeta de sonido y eso no puedo. Si selecciono los speakers, el audio que entra por el line in

si se reproduce correctamente. El caso es que los vumeters de configuracón de las entradas si se mueven por lo que si entra el audio, el problema es no sale por el hdmi.

He mirado el alsamixer y parece que está ok, ¿Puede ser problema del driver de la tarjeta grafica que es la que tiene la salida hdmi? El sistema está recien instalado y por defecto. La tarjeta de sonido es integrada en placa base. He Probado con una tarjeta USB sencilla y lo mismo.

Alguna idea? (El mismo equipo en windows lo hace bien.)

Gracias.

Black Screen with cursor blinking when started Ubuntu on VirtualBox

Ubuntu on my Virtual Machine was running fine when I restarted then suddenly it starts showing a black screen. I googled and tried multiple solutions like:

  1. by disabling the “Enable 3D acceleration” on virtualBox settings
  2. Enabling the “Intel Virtualization Technology” from BIOS

Please note, when I used backup Ubuntu, it works fine. My host system is Ubuntu 18.04.3 LTS. VirtualBox Version 6.0.12, Ubuntu guest OS in VirtualBox is 18.04.2.

I will appreciate if you can help to address the issue