LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu
User Name
Password
Ubuntu This forum is for the discussion of Ubuntu Linux.

Notices


Reply
  Search this Thread
Old 04-30-2013, 09:38 AM   #1
markyd
LQ Newbie
 
Registered: Dec 2011
Location: Shepperton - UK
Distribution: Lubuntu & Puppy ... mostly ;-)
Posts: 25
Blog Entries: 16

Rep: Reputation: Disabled
Upgrading to 13.10 stole another PC credentials and password!


(Obviously I mean upgrade to 13.04)

This is a strange one, I have a bunch of PC's all running Lubuntu. Using the ISO I got off the web I built an Asus X101CH (named X101) from scratch all went well. This is my test / play machine.

As all went well I decided to upgrade my main office desktop, a Dell E4300 called "Queeg", this followed the upgrade process from 120.10 to 13.04 with no dramas ... until it was rebooted and presented itself as X101 and not Queeg ............ I had to log on using the X101 credentials not Queeg's!

Doing a shutsown / start it comes up as "Queeg" then rebooting it appears as "X101".

From a security perspective how on earth did my profiles jump machines? The are on the same LAN yes but one was built from an ISO the other upgraded from 12.10, my only explanation is that X101's credentials were stored in "Ubuntu Land" for what ever reason snd during the rebuild of Queeg got used by mistake ... perhaps same NAT address to outside world?

.../also posted in Security over at Ubuntu Forums http://ubuntuforums.org/showthread.php?t=2140320

Last edited by markyd; 05-01-2013 at 01:30 AM.
 
Old 04-30-2013, 06:30 PM   #2
BeaverusIV
Member
 
Registered: Oct 2004
Location: New Zealand
Distribution: Arch Linux 2010.05
Posts: 133

Rep: Reputation: 18
Was it upgraded using the ISO you built? Was it on a USB stick?
 
Old 04-30-2013, 08:39 PM   #3
Steve R.
Member
 
Registered: Jun 2009
Location: Morehead City, NC
Distribution: Ubuntu 16.04
Posts: 316

Rep: Reputation: 59
Pretty good trick, since Ubuntu 13.10 has not yet been released. I suspect that you may be referring to Ubuntu 12.10. For me the upgrade to 12.10 was a "disaster". The upgrade to 13.04 seems to have gone well. Only time will tell.
 
Old 05-01-2013, 01:33 AM   #4
markyd
LQ Newbie
 
Registered: Dec 2011
Location: Shepperton - UK
Distribution: Lubuntu & Puppy ... mostly ;-)
Posts: 25
Blog Entries: 16

Original Poster
Rep: Reputation: Disabled
OK yes it was an upgrade to 13.04

X101 was built from a fresh ISO download burned to CD

Queeg was later "upgraded" online

Queeg assumed a dual identity one of which was X101 including usernames and password.
 
Old 05-01-2013, 04:49 AM   #5
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 6,864

Rep: Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960
When you say it took on another identity, what does hostname return on Queeg? Could it be just that it is asking for the password you used with the other machine for use with Ubuntu One? Still odd if it is, but not quite as odd.
 
Old 05-01-2013, 05:29 AM   #6
markyd
LQ Newbie
 
Registered: Dec 2011
Location: Shepperton - UK
Distribution: Lubuntu & Puppy ... mostly ;-)
Posts: 25
Blog Entries: 16

Original Poster
Rep: Reputation: Disabled
After I Queeg was updated to 13.04 from 12.10 Lubuntu the hostname displayed was X101 and not Queeg. The password from Queeg did not work but the one from X101 did ... how on earth is this possible?

X101 was built from a CD I burnt from an ISO download the day before.
 
Old 05-01-2013, 06:31 AM   #7
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 6,864

Rep: Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960
That doesn't sound possible. Are you sure you're not somehow remotely logging on to X101 rather than logging on to Queeg?
Hopefully somebody here or on the Ubtuntu forum will be able to shed light on this as the implications could be very serious indeed.
 
Old 05-01-2013, 08:00 AM   #8
markyd
LQ Newbie
 
Registered: Dec 2011
Location: Shepperton - UK
Distribution: Lubuntu & Puppy ... mostly ;-)
Posts: 25
Blog Entries: 16

Original Poster
Rep: Reputation: Disabled
I agree its frightening ... the implications are that the logon details of X101 were stored in "Ubuntu" land and then accidently used when Queeg was updated online ... seeing how both laptops are on my LAN behind a NAT they would have looked like the same device to 'Buntu HQ ...

... to answer you question no, X101 is almotst a virgin build with lubuntu-restricted-extras & cairo-dock that's about it at the moment.

I should take a video really as its pretty repeatable, reboot Queeg and it comes back to life as X101 ... shut it down though in does come back as Queeg .... hate to think that my favourite distro is getting big brother on me! If I video the show, where would I put it?
 
Old 05-01-2013, 10:13 AM   #9
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 6,864

Rep: Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960Reputation: 1960
A video might be a good idea though sadly I don't know where you could put it. It may wake the people at the Ubuntu forums up a bit too. Heck, if it's repeatable and you're sure it's not you (not saying it is, just being open minded) then let one of the technology news sites in on it -- my favourite is The Register but I'm sure others would like to hear of it.
 
Old 05-01-2013, 04:13 PM   #10
BeaverusIV
Member
 
Registered: Oct 2004
Location: New Zealand
Distribution: Arch Linux 2010.05
Posts: 133

Rep: Reputation: 18
Either Vimeo and mediafire or somesuch and post it around. Better people than me would have you check /etc/passwd and users/groups to see what matches up, etc.
 
Old 05-01-2013, 05:34 PM   #11
widget
Senior Member
 
Registered: Oct 2008
Location: S.E. Montana
Distribution: Debian Testing, Stable, Sid and Manjaro, Mageia 3, LMDE
Posts: 2,623

Rep: Reputation: 493Reputation: 493Reputation: 493Reputation: 493Reputation: 493
I think answering the question of what your install media was for this would be a good start.

If on a completely different box you upgraded online this would be completely strange.

If you, on the other hand, upgraded the first box from a Live Session on a USB stick set up for persistence it would be pretty normal unless you removed all contents of the partition (forget what that is labeled for Ubuntu) used for persistence. This is because you would be "upgrading" from that entire Live Session, including the users and box settings, on the stick.
 
Old 05-01-2013, 06:30 PM   #12
BeaverusIV
Member
 
Registered: Oct 2004
Location: New Zealand
Distribution: Arch Linux 2010.05
Posts: 133

Rep: Reputation: 18
@widget he has already said the first was from a CD and the desktop was via Internet.
 
Old 05-02-2013, 08:38 PM   #13
widget
Senior Member
 
Registered: Oct 2008
Location: S.E. Montana
Distribution: Debian Testing, Stable, Sid and Manjaro, Mageia 3, LMDE
Posts: 2,623

Rep: Reputation: 493Reputation: 493Reputation: 493Reputation: 493Reputation: 493
Quote:
Originally Posted by BeaverusIV View Post
@widget he has already said the first was from a CD and the desktop was via Internet.
Geeze. Really was too tired to post. Need to learn to actually listen to myself when I get that way. Sorry.
 
Old 05-03-2013, 03:35 AM   #14
markyd
LQ Newbie
 
Registered: Dec 2011
Location: Shepperton - UK
Distribution: Lubuntu & Puppy ... mostly ;-)
Posts: 25
Blog Entries: 16

Original Poster
Rep: Reputation: Disabled
Going on holiday for a week ... will video "Queeg" transforming into "X101" when I get back next week ....
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Enter LDAP Password keeps saying ldap_bind: Invalid credentials (49) Cheetara63 Linux - Newbie 2 06-04-2011 05:41 AM
mc stole my file ewt3y Linux - Software 1 06-24-2005 06:41 AM
relaxing password credentials in RH 3 ent news2me Linux - Enterprise 3 02-03-2005 10:19 AM
Fold it like you stole it!! orange400 General 2 10-28-2003 09:00 AM
help! linux stole my soundcard blistfix Linux - General 2 09-01-2001 08:54 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu

All times are GMT -5. The time now is 07:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration