5 ms·

Linux security hardening and other tweaks

111 points by fonder 4y ago

fsflover 4y ago
I hardened my Linux by installing https://qubes-os.org https://qubes-os.org instead. My daily driver for years.
- triter 4y ago
- Shared404 4y ago
  What did you install it on? Qubes has tempted me for years but it's weight/lack of hardware compatibility has put me off.
  - fsflover 4y ago
    I run it on a Librem 15. For more laptops have a look here: https://forum.qubes-os.org/t/laptops-that-just-work-with-qubes-os-r4-0-4/5560 https://forum.qubes-os.org/t/laptops-that-just-work-with-qub....
    - drewlander 4y ago
      Works just fine on my Dell Precision 7540. Tried briefly to get GPU passthrough to work but failed. I lack the time to seriously try. Otherwise, it works great.
matthews2 4y ago
> Sandboxing is a way to limit the potential damage a compromised process can do. Firejail is the tool I like the most for this task. Note that Firejail is a suid binary that has had a reasonable number of vulnerabilities in it, so it may hurt more than it helps. https://www.cvedetails.com/product/36171/Firejail-Project-Firejail.html?vendor_id=16191 https://www.cvedetails.com/product/36171/Firejail-Project-Fi...
- fonder 4y ago
  > it may hurt more than it helps. If we use a web browser as an example, what are the odds that a compromised website is going to try to exploit the browser itself vs. exploiting an external sandbox application? Clearly the former. Sandboxing a web browser will prevent many more classes of attack than it exposes you to. Also worth noting that the suid binary you mention will refuse to run at all if the executing user isn't in its whitelist. It's not like you can pop a shell on some ftp user and run firejail as root.
  - insanitybit 4y ago
    You're assuming escaping the browser sandbox wouldn't also escape the firejail sandbox. The bypasses are likely the same.
icare_1er 4y ago
I'd also recommend checking any sudo commands you would like to put, in GTFObins first. You'd be surprised how many executables can actually permit running commands.
readingnews 4y ago
You know, I rarely think about this: # chmod -R go-rwx /home/* Why are most default homes setup with a mode other than 700 directories 600 files? I know, it is because of the default mask system wide, but it seems to make sense to do this to homes, unless I am missing something?
- nerdponx 4y ago
  I have the same question. And why not go a step further? Set a default ACL on the home directory.
- technion 4y ago
  Possibly a legacy of websites with tilde home directories being the norm at one time.
- doublepg23 4y ago
  Funny enough Ubuntu didn’t even make that change until 2021 https://news.itsfoss.com/private-home-directory-ubuntu-21-04/ https://news.itsfoss.com/private-home-directory-ubuntu-21-04...
- Arnavion 4y ago
  Before UPGs, every user would have `users` or something similarly generic as their primary group, and it was intentional that everyone's homedir allowed read access to that group for the purpose of sharing files between users. With UPGs, every user will have a bespoke primary group, so having group access to the homedir is not a problem. Whether the distro still keeps the other-readable bit is up to the distro. For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp. The default UPG usage and homedir permissions are controlled by USERGROUPS_ENAB and HOME_MODE in login.defs (under /etc or /usr/etc, depending on your distro).
  - rascul 4y ago
    > For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp. When was this? 15.4 doesn't have user per group by default, nor does it have 0700 on $HOME by default. I have several fairly recent installs around I checked. Something in Tumbleweed perhaps? My last Tumbleweed install was last year sometime and does not have user per group nor 0700 $HOME.
suprjami 4y ago
Linux has randomised TCP Timestamps per-connection since v4.10 so there's no longer any need to disable them: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a22caee396cef0bb2ca8fafdd82966a49367bb https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
nerdponx 4y ago
It's great to have guides like this, but there are a lot of recommendations in here, and I don't understand the implications of all of them, individually or together. The author seems opposed to disabling security mitigations for performance reasons, but what are the trade-offs? What if you use your workstation for 3D rendering or machine learning, and you really do want to maximize the performance of your hardware?
- KingMachiavelli 4y ago
  Most of the options don't have much or any performance impact. The few that do e.g. the spectre/meltdown related ones provide improve security far more than they impact performance on a recent-year CPU. If these security options make or break your ability to do certain kinds of work - then you'd probably benefit most from using a more modern and faster CPU. If anything some of these options are more likely to break the occasional application completely e.g. some applications use user-namespaces.
Genghis_9000 4y ago
linux is such garbage security-wise that it had to be a niche "hardening patch" to make processes not be able to see the argv of other processes. this normally wouldnt be a problem, except for the fact that linux and its proponents claim that it and other unixes have ultra secure user separation facilities
- Eleison23 4y ago
  I'm not sure who's ever claimed that. From the get-go, Unix design philosophy was simplicity, and it was in opposition to Multics and other complex multi-user OSes that had a lot of security and compartmentalization baked-in. I remember during my first job discovering that SunOS had C2 security available and trying to enable that, then realizing it messed up a lot of stuff and trying to disable it by hand... what a nightmare. I was fascinated by compartmentalized security type stuff but I really had no idea. That sort of security will really hamper user productivity and collaboration. You need to spec it out, because otherwise an OS is going to default to the latter.
  - pjmlp 4y ago
    No wonder how we got C instead of PL/I.
  - Genghis_9000 4y ago
KingMachiavelli 4y ago
I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and kernels from non-vfat partitions anyway. Just make a 5GB boot+EFI partition so you can store plenty of kernels or even a recovery image. For security, I recommend following Madaidan's Insecurities Linux hardening guide, it has good explanations of most of the same sysctl options and kernel flags. [1] The only option that may be best left disabled is `init_on_free=0` since this is one of the few options that has a measurable performance impact (besides the normal spectre/meltdown related options). For NTP, systemd-timesyncd works fine and is probably the default for any modern distro. Desktop security is still a nightmare, if you use a Wayland based desktop environment and Pipewire for audio/video streams then maybe in 10 years you'll a secure clipboard and no unauthorized keyloggers. [1] https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...
- Arnavion 4y ago
  And if 5GiB seems too dear to lose, I use a 128MiB EFI partition that's still big enough to hold three UKIs, since each UKI is ~30 MiB.
- hotcoffeebear 4y ago
  > wayland & pipewire Is there something desktop users can do? Fedora seem to use both by default. Reading it through now, pulseaudio might be the way. Now i am in github rabbithole…
  - unaindz 4y ago
    pipewire is replacing pulseaudio. Besides reducing latency it tries to manage permission for audio and video streams.
stigz 4y ago
This article starts with an Arch-based system. I think it should be noted that the Arch wiki also has its own recommendations for hardening. [1] [1] https://wiki.archlinux.org/title/Security https://wiki.archlinux.org/title/Security

111 points by fonder 4y ago

fsflover 4y ago

I hardened my Linux by installing https://qubes-os.org https://qubes-os.org instead. My daily driver for years.

triter 4y ago
Shared404 4y ago
What did you install it on? Qubes has tempted me for years but it's weight/lack of hardware compatibility has put me off.
- fsflover 4y ago
  I run it on a Librem 15. For more laptops have a look here: https://forum.qubes-os.org/t/laptops-that-just-work-with-qubes-os-r4-0-4/5560 https://forum.qubes-os.org/t/laptops-that-just-work-with-qub....
  - drewlander 4y ago
    Works just fine on my Dell Precision 7540. Tried briefly to get GPU passthrough to work but failed. I lack the time to seriously try. Otherwise, it works great.

matthews2 4y ago

> Sandboxing is a way to limit the potential damage a compromised process can do. Firejail is the tool I like the most for this task. Note that Firejail is a suid binary that has had a reasonable number of vulnerabilities in it, so it may hurt more than it helps. https://www.cvedetails.com/product/36171/Firejail-Project-Firejail.html?vendor_id=16191 https://www.cvedetails.com/product/36171/Firejail-Project-Fi...

fonder 4y ago
> it may hurt more than it helps. If we use a web browser as an example, what are the odds that a compromised website is going to try to exploit the browser itself vs. exploiting an external sandbox application? Clearly the former. Sandboxing a web browser will prevent many more classes of attack than it exposes you to. Also worth noting that the suid binary you mention will refuse to run at all if the executing user isn't in its whitelist. It's not like you can pop a shell on some ftp user and run firejail as root.
- insanitybit 4y ago
  You're assuming escaping the browser sandbox wouldn't also escape the firejail sandbox. The bypasses are likely the same.

icare_1er 4y ago

I'd also recommend checking any sudo commands you would like to put, in GTFObins first. You'd be surprised how many executables can actually permit running commands.

readingnews 4y ago

You know, I rarely think about this: # chmod -R go-rwx /home/* Why are most default homes setup with a mode other than 700 directories 600 files? I know, it is because of the default mask system wide, but it seems to make sense to do this to homes, unless I am missing something?

nerdponx 4y ago
I have the same question. And why not go a step further? Set a default ACL on the home directory.
technion 4y ago
Possibly a legacy of websites with tilde home directories being the norm at one time.
doublepg23 4y ago
Funny enough Ubuntu didn’t even make that change until 2021 https://news.itsfoss.com/private-home-directory-ubuntu-21-04/ https://news.itsfoss.com/private-home-directory-ubuntu-21-04...
Arnavion 4y ago
Before UPGs, every user would have `users` or something similarly generic as their primary group, and it was intentional that everyone's homedir allowed read access to that group for the purpose of sharing files between users. With UPGs, every user will have a bespoke primary group, so having group access to the homedir is not a problem. Whether the distro still keeps the other-readable bit is up to the distro. For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp. The default UPG usage and homedir permissions are controlled by USERGROUPS_ENAB and HOME_MODE in login.defs (under /etc or /usr/etc, depending on your distro).
- rascul 4y ago
  > For example, OpenSUSE used to be in the pre-UPG 0755 camp, but switched some time ago to the UPG 0700 camp. When was this? 15.4 doesn't have user per group by default, nor does it have 0700 on $HOME by default. I have several fairly recent installs around I checked. Something in Tumbleweed perhaps? My last Tumbleweed install was last year sometime and does not have user per group nor 0700 $HOME.

suprjami 4y ago

Linux has randomised TCP Timestamps per-connection since v4.10 so there's no longer any need to disable them: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a22caee396cef0bb2ca8fafdd82966a49367bb https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

nerdponx 4y ago

It's great to have guides like this, but there are a lot of recommendations in here, and I don't understand the implications of all of them, individually or together. The author seems opposed to disabling security mitigations for performance reasons, but what are the trade-offs? What if you use your workstation for 3D rendering or machine learning, and you really do want to maximize the performance of your hardware?

KingMachiavelli 4y ago
Most of the options don't have much or any performance impact. The few that do e.g. the spectre/meltdown related ones provide improve security far more than they impact performance on a recent-year CPU. If these security options make or break your ability to do certain kinds of work - then you'd probably benefit most from using a more modern and faster CPU. If anything some of these options are more likely to break the occasional application completely e.g. some applications use user-namespaces.

Genghis_9000 4y ago

linux is such garbage security-wise that it had to be a niche "hardening patch" to make processes not be able to see the argv of other processes. this normally wouldnt be a problem, except for the fact that linux and its proponents claim that it and other unixes have ultra secure user separation facilities

Eleison23 4y ago
I'm not sure who's ever claimed that. From the get-go, Unix design philosophy was simplicity, and it was in opposition to Multics and other complex multi-user OSes that had a lot of security and compartmentalization baked-in. I remember during my first job discovering that SunOS had C2 security available and trying to enable that, then realizing it messed up a lot of stuff and trying to disable it by hand... what a nightmare. I was fascinated by compartmentalized security type stuff but I really had no idea. That sort of security will really hamper user productivity and collaboration. You need to spec it out, because otherwise an OS is going to default to the latter.
- pjmlp 4y ago
  No wonder how we got C instead of PL/I.
- Genghis_9000 4y ago

KingMachiavelli 4y ago

I'd stick to having a unified vfat boot+EFI partition mounted at /boot. systemd-boot is the simplest bootloader and it doesn't support loading it's config and kernels from non-vfat partitions anyway. Just make a 5GB boot+EFI partition so you can store plenty of kernels or even a recovery image. For security, I recommend following Madaidan's Insecurities Linux hardening guide, it has good explanations of most of the same sysctl options and kernel flags. [1] The only option that may be best left disabled is `init_on_free=0` since this is one of the few options that has a measurable performance impact (besides the normal spectre/meltdown related options). For NTP, systemd-timesyncd works fine and is probably the default for any modern distro. Desktop security is still a nightmare, if you use a Wayland based desktop environment and Pipewire for audio/video streams then maybe in 10 years you'll a secure clipboard and no unauthorized keyloggers. [1] https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...

Arnavion 4y ago
And if 5GiB seems too dear to lose, I use a 128MiB EFI partition that's still big enough to hold three UKIs, since each UKI is ~30 MiB.
hotcoffeebear 4y ago
> wayland & pipewire Is there something desktop users can do? Fedora seem to use both by default. Reading it through now, pulseaudio might be the way. Now i am in github rabbithole…
- unaindz 4y ago
  pipewire is replacing pulseaudio. Besides reducing latency it tries to manage permission for audio and video streams.

stigz 4y ago

This article starts with an Arch-based system. I think it should be noted that the Arch wiki also has its own recommendations for hardening. [1] [1] https://wiki.archlinux.org/title/Security https://wiki.archlinux.org/title/Security