Upgrading problems for Intel Graphic owners to Ubuntu 10.04 Lucid Lynx...

I am usually one of the first few people to upgrade my Ubuntu installation every time Canonical releases a new build of Ubuntu. However, I had noticed a few users having problems with their upgrades and decided to "wait and see".

There are now quite a few users reporting that Intel Graphic owners have problems with the KMS (Kernel Mode Switch) with the new kernels. I strongly suggest owners to wait until this problem is resolved and stick with Karmic Koala until then. You can find out more about this issue at the ubuntuforums.org site with a Google query here.

I've read some websites saying that there is a quick fix to the problem where the kernel switches off KMS on known problematic graphic chipsets. Though this makes it easier to move from Karmic to Lucid, I'm personally going to wait until the problem is fixed (fixed with functionality, not fixed by switching the function off on problem machines). You can read about this workaround here.

Upgrading from Karmic Koala to Lucid Lynx...

Now that Ubuntu 10.04 (Lucid Lynx) is out, I am sure most users will want to upgrade their Ubuntu 9.10 (Karmic Koala) to the new and improved. My advise to new users or those unfamiliar with the terminal bash shell to wait for other more experienced users to upgrade and see if they encounter any problems. If they have a similar setup or hardware as you have, then read or wait till the problem is solved. You can quickly check how by using Google and doing a query like this.

For the power users and those familiar with the workings of Ubuntu, you most probably also use a lot of PPAs (Personal Package Archives) either from Launchpad or some other repository. In case you didn't know, upgrading your Karmic to Lucid will result in:

1. The upgrade will disable all non-Ubuntu repositories from your source.list file or source.list.d folder.
   
2. The applications/packages that you have already installed may not work correctly, break, and/or damage your setup after the upgrade due to architecture differences or dependencies.

The easiest way for a Karmic user to ensure that their upgrade to Lynx is successful, is to first make a backup copy of their source.list file and sources.list.d folder. Then remove all software installed by the PPA and reinstall the same software from the Ubuntu repositories.

This used to be quite a laborious task as this was usually done manually. Now, you can use a program called ppa-purge which you can get for Karmic only here. Once you have installed this, simply type:

ppa-purge ppa:ubuntu-mozilla-daily/ppa

Replace "ppa:ubuntu-mozilla-daily/ppa" with the PPAs that you use. This will remove the installed applications from the said repository, remove the repository reference from Ubuntu and then reinstall the official supported version of the same application from Ubuntu's repository.

Once you have cleaned up all your PPAs, you can safely upgrade to Lucid Lynx. Once there, you can simply enable your favorite PPAs from your source.list and source.list.d folder and replace the keyword karmic with lucid. Before doing so, I strongly suggest you visit each developer's PPA page to see if they have a better version of the same software that the Ubuntu repositories has before upgrading to the PPA version.

I am not giving detailed steps for this post as this post is meant for power users who should know what I am talking about.

Ubuntu 10.04 Lucid Lynx is now available...

Ubuntu 10.04 (Lucid Lynx) LTS (Long Term Support) is now available. I know I may seem to be two days late with this news, but on the eve of release, a critical bug (bug #570765) was found in the final build. This resulted in the Ubuntu team having to fix the bug, re-test and rebuild the ISO images.

Anyway, the bug has been fixed and 10.04 is now ready for the masses. Go get your copy here. If you have a very slow internet connection or need to install/upgrade Ubuntu at a location that is without internet access, you can order a copy of 10.04 disc (it's free) from here.

Nessus 4.2.2 released today...

Took the below from an email I got today.

----------------------------------------------


Nessus 4.2.2 has been released today. This release contains the following fixes:

Nessus-fetch:

- Proxy issues have been resolved

NASL:

- Fixed a memory leak in the NASL xmlparse() function

Networking:

- Fixed IPv6 routing when talking to a remote host (FreeBSD, Mac OS X)

- Packet forgery was not always working on ES5 64 bits

Packaging:

- Fixed the Debian /etc/rc init script

- Upgraded OpenSSL to version 0.9.8n (Windows, Solaris)

Stability:

- Fixed a possible crash when using a badly written custom plugin

- Fixed a possible crash when running out of BPFs on Windows

Installing OpenVAS 3.0.x on Ubuntu Linux...

This is a follow-up to my earlier article on Installing OpenVAS 2.0.x on Ubuntu Linux...

Updating your Ubuntu Setup

Before we begin, it is best that we update our Ubuntu libraries and applications to the latest versions by typing the following in a terminal:

sudo apt-get update
sudo apt-get upgrade


Installing the libraries that OpenVAS uses

Once you have updated your machine, we will need to install the following libraries and applications to compile and install OpenVAS. Again, in the terminal:

sudo apt-get install cmake build-essential libgtk2.0-dev libglib2.0-dev libssl-dev htmldoc libgnutls-dev libpcap0.8-dev bison libgpgme11-dev libsmbclient-dev snmp pnscan


Downloading the source code and compiling them

Now that the machine is ready to work with the OpenVAS sources, you then need to download the following source codes from the OpenVAS website. You can find the sources at URL http://wald.intevation.org/frs/?group_id=29

Download the latest version of the following:

openvas-libraries (latest v3.0.x, I used 3.0.4)
openvas-scanner (latest v3.0.x, I used 3.0.2)
openvas-client (latest v3.0.x, I used 3.0.0)

You will need to install OpenVAS in the above listed order. To install each component, you will need to do the following:

tar -zxvf [filename of .tar.gz file]
cd [sub-folder of same name as .tar.gz file]
./configure
make
sudo make install
cd ..

If you are using the 64-bit version of Ubuntu, you may get an error message ("/usr/bin/ld: cannot find -lcrypto") when you 'make' the openvas-client. You can fix this by typing:

sudo ln -s /usr/lib/libcrypto.so.0.9.8 /usr/lib/libcrypto.so

Once all three components are compiled and installed, you will then need to let Ubuntu know about the new libraries you have just compiled before the can be used by typing in:

sudo ldconfig -v


First time OpenVAS users

For the first time use of OpenVAS, you will need to create a new cert and add in the first user that can login into the OpenVAS server by running both:

sudo openvas-mkcert
sudo openvas-adduser


Updating the latest plug-ins

Periodically (I usually run it once every day, or just before I am about to use OpenVAS), you will need to update the plugins that OpenVAS uses to detect newer vulnerabilities which are found everyday. You can do that by typing:

sudo openvas-nvt-sync

Note: There is a bug in the update script and you will get an error message (as of today, 11-Apr-2010). A quick look at the OpenVAS forums showed a typo made by one of the developers and the way to fix this is do the following (in a terminal):

gksu gedit /usr/local/sbin/openvas-nvt-sync

Search for the string (my script had it on line 63):

SYNC_TMP_DIR='mktemp -d openvas-nvt-sync'

and change it to:

SYNC_TMP_DIR='mktemp -d openvas-nvt-sync.XXXXXXXXXX -t'

To start the OpenVAS server, activate the server by typing in:

sudo openvassd

And running the OpenVAS client by typing:

sudo OpenVAS-Client

If you want to learn or know more about OpenVAS, visit them at http://www.openvas.org/

Note: Tested on Ubuntu 9.10, and I assume you are doing all this with user access (that is why, some root only commands have the "sudo" command in front of them) and am running the kernel in i386 (32-bit) mode. Also, as I did not test this on a 64-bit system, the 64-bit only error/solution mentioned in my article comes from the forums and I have not tested them myself.

Installing Firefox 3.6 into Ubuntu 9.10 (Karmic)

If you are like me and constantly want the latest version of everything in your Ubuntu installation, you will most probably want to install Firefox 3.6 into your Ubuntu installation. You first have the add in the Mozilla Team's firefox-stable repository by typing the following in a terminal shell:

sudo add-apt-repository ppa:mozillateam/firefox-stable

Once you have that entry in your source.list file, you will need to update the available installers with the command:

sudo apt-get update

Now you can simply get firefox 3.6 installed with the command:

sudo apt-get install firefox-3.6

Warning, this will remove your current installation of Firefox.

:::::::::::: For older Ubuntu users :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

If you are a Jaunty, Intrepid or Hardy user, you will need to edit the source.list file by typing the following into the terminal shell:

gksudo gedit /etc/apt/sources.list

You then need to add in the following two lines at the end of the file:

deb http://ppa.launchpad.net/mozillateam/firefox-stable/ubuntu BUILDNAME main
deb-src http://ppa.launchpad.net/mozillateam/firefox-stable/ubuntu BUILDNAME main

Remember to replace the name BUILDNAME, with jaunty, intrepid or hardy (depending on which version of Ubuntu you have installed).

You will then need to import the correct public key so that Ubuntu will trust the repository. To do that, please read my earlier post on Getting the public key of a Ubuntu repository.

Again, once you have done the above, you will need to issue the command for Ubuntu to update and install the repository data and install Firefox 3.6:

sudo apt-get update
sudo apt-get install firefox-3.6

You now have Firefox 3.6 installed. :)

Securing your Apache 2 web server...

I have done a lot of server security testing and one of the most common mistakes I see in most web server implementation of customer's web server is:

1. The server banner of the web server displays the product and version number of the seb server application.

2. The web server has the debug command TRACE enabled by default in the production environment.

When you install Apache 2 in a Ubuntu box (may be similar for other Linux distros), the above two options are by default enabled.

The easiest way to remove TRACE and obfuscate the server banner version is to add the following commands into apache2.conf found in the /etc/apache2/ folder. They are:

ServerTokens ProductOnly
ServerSignature Off
TraceEnable Off

The commands are self explainatory and you really should google for them...