3 ms·
Security is a high priority to me but I'm also optimizing with respect to a lot of factors. I decided on NixOS. The defaults start out locked down. The firewa
by aaronchall 5y ago
Security is a high priority to me but I'm also optimizing with respect to a lot of factors.
I decided on NixOS.
The defaults start out locked down. The firewall has only port 22 open, so give your root user a decent password, and immediately set up your user with a public/private key, test it works then turn off root login via ssh and password logins.
NixOS also only installs what you configure, and remove what you don't, so if you like utils that are considered standard, like 'which', be sure to include them in your configuration.
With NixOS I feel like I know exactly what's on my system at any given time, and nothing should be there that I didn't put there by declaring I want it there.
I have my system set up to update daily so it gets security fixes immediately.
I also have a reproducible system built on a functional build tool called Nix. I can replicate the system easily. If I want lockfile level reproducibility (like rust or npm), I can use flakes.
Are there other distributions more focused solely on optimizing security? Maybe, but the core NixOS development are extremely security conscious and I trust them more than any other group of core distribution group.
- 1MachineElf 5y agoNixOS can be an excellent choice here although it's worth adding that real proficiency with Nix has a leaning curve. It's worth it in the long run, but starting out with something like Gentoo for a secure system might be easier in the beginning.
- aaronchall 5y agoCan you give any reasoning for why Gentoo would be an optimal easy approach, as opposed to maybe, SELinux for example? When I am in an advisory role, with my own reputation at stake, I must always recommend the hard choice known for superior long-run results over the easy thing with fast but inferior long-run results. Doing the hard but superior thing builds competency in doing the hard but superior thing, which makes it easier to do the hard but superior thing over the long run. Contrariwise, doing the easy but inferior thing builds competency in doing the easy but inferior thing, which makes it easier to get stuck doing the easy but inferior thing over the long run. Pardon what may seem like hyperbole, but recommending inferior solutions to others because it's easy feels like, to me, malicious incompetence.
- 1MachineElf 5y agoFWIW I think you're coming from the right place on recommending SELinux and NixOS too. Using SELinux as an example, with Gentoo there are significantly more resources on how to use it compared to what NixOS currently has. I would still recommend NixOS for software development and probably more things down the road as support for things like SELinux improves. https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux https://nixos.wiki/wiki/Workgroup:SELinux https://nixos.wiki/wiki/Workgroup:SELinux