1

I have installed Ubuntu 18.04 LTS for testing on a crash dummy in anticipation of upgrading my 16.04 LTS machines. So far everything is working quite well and I do like some of the changes and improvements.

One thing I noticed though is that Ubuntu seems to be "calling home" to Google web sites on a frequent, periodic basis. Wondering what that's all about. This issue was brought up on here previously regarding a similar situation in Ubuntu 17.10 but the answer and reasons for this snooping were extremely vague.

I block all outside traffic to/from my local subnet (192.168.0.0/24) and force all Internet traffic to go through my VPN. All of this works well.

Every five minutes I see five packets as follows:

[  +4.160090] [UFW BLOCK] IN= OUT=wlx00026f5a322b SRC=192.168.0.11 DST=104.198.143.177 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=10309 DF PROTO=TCP SPT=44246 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 
[  +8.192209] [UFW BLOCK] IN= OUT=wlx00026f5a322b SRC=192.168.0.11 DST=104.198.143.177 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=10310 DF PROTO=TCP SPT=44246 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0

The destination IP isn't always the same but a whois verifies that they are all owned by Google.

Updates, NTP and so on seem to be working correctly and are (I assume) properly going through my VPN. In testing this I have all apps shut down so it seems like it's something in Ubuntu itself that is causing these attempted connections. There is nothing Google-related turned on that I can see. Chrome isn't even installed.

jones@Office-Ubuntu:~$ ps -ef | grep chrome
jones 19610  1930  0 10:24 pts/0    00:00:00 grep --color=auto chrome
jones@Office-Ubuntu:~$

If I didn't have the firewall enabled I'd never even know this was going on. If I go to the web site IP it does render a (blank) page which makes me think that the purpose for these connection attempts is data collection. Since this is Google, I am naturally suspicious/paranoid that something creepy is going on.

A related question/answer on this site indicates that this might be some sort of a "keep-alive" function. If so, it is obviously not needed since I am blocking the connections in UFW and everything continues to work perfectly. I see no way to turn this off as described in the related question. And as an aside, if this is indeed some sort of a "keep-alive" "feature" there are probably better ways to implement that capability without exposing the Ubuntu community to Google's data collection warehouse. And when/why did Ubuntu start thinking it would be a good idea to collaborate with Google to collect user information surreptitiously?

My question differs from the previously asked "identical" question inasmuch as the answer there implied (apparently incorrectly) that these connections are necessary and benefit Ubuntu users (but doesn't really explain why). The primary question I am asking is this: How do I "opt-out" of this unwanted intrusion into my privacy since connecting to a Google web site every five minutes is clearly not needed to keep anything useful in Ubuntu functioning?

Zanna
  • 69,223
  • 56
  • 216
  • 327
jones0610
  • 1,776
  • 1
  • 10
  • 26
  • 1
    Are there any chrome processes running? `ps -ef | grep chrome` would reveal them. Please add your findings in your original post by clicking on edit above and to the left. – K7AAY Jul 17 '18 at 17:23
  • VTR since OP has clarified and expanded the question. @Jones0610, did you see my answer on the linked question? From an [IP info site](https://ipinfo.io/104.198.143.177), I found out that that IP has `connectivity-check.ubuntu.com`, which is hosted by Google. Looking at the settings on 18.04, it looks like you can disable it in Settings -> Privacy -> Connectivity Checking. – wjandrea Jul 19 '18 at 17:57
  • @wjandrea I did read your answer. Google's desire to spy on the entire Planet is beyond the scope of this question. However, all that's happening here is (based on the warning in privacy-> connectivity checking) is that information WILL be collected. There is zero information on what, if anything, Ubuntu will do to re-establish a connection should it drop. IMHO, this "feature" should be disabled by default as most do NOT want Google spying on them. I'm very surprised that Ubuntu would allow and even encourage this sort of privacy intrusion and collaboration with Google. – jones0610 Jul 19 '18 at 18:12
  • @wjandrea If you would like to post an answer to this question by saying this "feature" can be turned off by setting settings->privacy->connectivity checking to "OFF" I will happily credit you with a correct answer. This will hopefully help others researching this issue in the future. Many thanks again! – jones0610 Jul 19 '18 at 18:17
  • 1
    @jones0610 Read this: [How to Disable Network Connectivity Checking in Ubuntu 17.10](https://www.omgubuntu.co.uk/2017/09/disable-network-connectivity-checking-ubuntu-17-10) – wjandrea Jul 19 '18 at 18:23

0 Answers0