<p dir="ltr">Hi Roger,</p>
<p dir="ltr">Yes they are. If you don't use VNC, I would configure your upstream network to block inbound connections (NAT should do this for you indirectly).</p>
<p dir="ltr">If you don't have an upstream router, ufw can easily be setup to default deny all.</p>
<p dir="ltr">If you use VNC to remote in... I would not have it listen externally but use SSH to forward to it- only exposing SSH outside or look into Xpra (I think that's what it's called). If you go the SSH route, you'll want to make sure you're using keys or at least good passwords (and a non-standard port to cut down on logspam/brute force attempts).</p>
<p dir="ltr">Take care,</p>
<p dir="ltr">-Aaron</p>
<p dir="ltr">PS. Miss the NBLUG days, hope all my old friends and co-lug-ers are doing well.</p>
<div class="gmail_quote">On Jan 28, 2015 2:01 PM, "Roger House" <<a href="mailto:rhouse@sonic.net">rhouse@sonic.net</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">By chance I noticed that the file .xsession-errors.old in my home directory<br>
(I'm running Ubuntu 12.04) was more than a gigabyte in size. A few grep's on<br>
the file produced lines like these<br>
<br>
28/01/2015 06:27:07 AM rfbAuthPasswordChecked: password check failed<br>
debconf: DbDriver "passwords" warning: could not open /var/cache/debconf/passwords.<u></u>dat: Permission denied<br>
<br>
There were other ominous looking messages which I can't reproduce at the<br>
moment because apparently each time my system comes up, the current<br>
.xsession-errors.old is deleted, .xsession-errors is renamed to .xsession-errors.old,<br>
and a new .xsession-errors is started. Anyway, there were thousands of lines<br>
like the two above, plus others.<br>
<br>
Actually, now that I have brought my system up again, here is a sample of what appears<br>
in .xsession-errors almost immediately:<br>
<br>
** (vino-server:2183): WARNING **: Deferring authentication of '74.208.225.179' for 5 seconds<br>
** (vino-server:2183): WARNING **: VNC authentication failure from '74.208.225.179'<br>
28/01/2015 06:03:14 AM rfbAuthPasswordChecked: password check failed<br>
28/01/2015 06:03:53 AM [IPv4] Got connection from client <a href="http://static-164-148-4-96.hardin.tn.ena.net" target="_blank">static-164-148-4-96.hardin.tn.<u></u>ena.net</a><br>
28/01/2015 06:03:53 AM other clients:<br>
28/01/2015 06:03:53 AM 74.208.225.179<br>
28/01/2015 06:03:53 AM Client Protocol Version 3.3<br>
<br>
Do these indicate attempts to break into my system?<br>
<br>
A recent change to my system: Last week I installed apache in order to do local web<br>
development. Can this have led to the above messages? I am new to apache so I'm<br>
wondering if there are config files which I need to edit to prevent successful attacks.<br>
<br>
Any info will be appreciated.<br>
<br>
Roger House<br>
<br>
<br>
______________________________<u></u>_________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" target="_blank">http://nblug.org/cgi-bin/<u></u>mailman/listinfo/talk</a><br>
</blockquote></div>