13 ms·

Desktop Linux Hardening (2022)

289 points by pabs3 3y ago

zzbn00 3y ago
Very useful. One practical thing to add: enabling automatic snapshots (e.g. with https://github.com/openSUSE/snapper https://github.com/openSUSE/snapper), ideally backing them up separately (e.g., with borg) might help recovery.
rrdharan 3y ago
The link near the top of the article that goes to a separate page explaining security problems with Desktop Linux is quite interesting. The article itself starts off much more focused on privacy than on security though it does have a fair bit of content on both topics.
guy98238710 3y ago
I am nuts into linux desktop security, but I cannot imagine recommending this to even other developers, let alone non-dev users. There are just too many usability tradeoffs, the whole thing is a major time waster, and you have to deal with a lot of breakage. Making basic security measures easy to implement is what's going to help in the long run.
- hospitalJail 3y ago
  >I am nuts into linux desktop security What things do I need to worry about? I'm about to make the switch from Windows to Linux. Is it general 'dont run things you don't trust'? keep things updated? Use good passwords?(do I need to change a setting to prevent brute forcing?) Am I missing anything?
  - smoldesu 3y ago
    "read scripts before you run them" is a good bit of advice. Some little things can help you protect your GUI apps if you're extra paranoid (eg. Wayland is more secure, Flatpak offers additional sandboxing with bubblewrap) but not everything is necessary. If you use a mainstream distro like Fedora or Ubuntu, its default configuration should be safe enough to use like Windows. Just remember that there isn't really any antivirus or Microsoft Defender to save you if you really mess up. I do offline backups of important work on all my devices, for this reason partially.
    - hospitalJail 3y ago
      >Some little things can help you protect your GUI apps if you're extra paranoid Can you explain this? What are the exploits? Is it the equivalent of running a .exe or .jar on windows, but with an extra layer of protection? (Or am I trying to shove my windows ideas into linux?)
      - smoldesu 3y ago
        > Can you explain this? What are the exploits? Traditional desktop Linux allows different apps to more-or-less freely communicate with each other (called the x11 protocol). This works really well for old apps (and admittedly not too bad for new ones) but is very slow and exposes a lot of bugs. On top of this, you have potential exploits in your filesystem from loosely permissioning important settings and identity files. So, the attack surface for a traditional Linux distro is relatively large. > Is it the equivalent of running a .exe or .jar on windows, but with an extra layer of protection? Kinda! Linux software is distributed as packages, which contains a binary (the exe/jar portion), a dependency manifest and whatever static content it needs. A sandbox like Flatpak will take those packages and put it into a sandbox, to prevent hostile interprocess communication and filesystem exploits. None of these mitigations are perfect per-se (nor are they on Mac/Windows), so use them wisely if you intend to use them at all. I have used a non-sandboxed system to run old 90s Windows games for years though, and haven't picked up any significant issues. YMMV, it is Linux after all :P
        hospitalJail 3y ago
        >Traditional desktop Linux allows different apps to more-or-less freely communicate with each other (called the x11 protocol). Oh gosh. I'm getting heart palpitations :P Is this a common attack vector then? Seems like an easy way to get an overflow error, or elevate privilege's.
        bombolo 3y ago
        Not common at all. Because most software comes from distributions, not from warez.exe. Sandbox comes with a heavy usability price, so they are lax by default. For example you protect your files, but then you can't load your photos to facebook because your browser doesn't have access.
  - mecsred 3y ago
    All three of those are great things to do. The fact that you know to mention them makes me think you don't need to worry much. When Linux people say they're into security, it usually means research level computer science, not "I don't want my laptop to get malware".
    - hospitalJail 3y ago
      The only caveat I'd like to say, I think we shouldnt assume every user isnt a VIP. I'm not a VIP, but I have some huge huge huge secrets that are worth at least a million dollars, maybe 10s of millions of dollars, that I need to access with a computer. Malware means potentially losing millions or tens of millions of dollars. I'm so afraid of those secrets, I don't even access them on my windows computers unless necessary. I'd love to be comfortable doing this, but given anyone can seemingly make a python keylogger, I'm not really comfortable using my computer(windows or linux) for this purpose. Gaming/updating my website/etc... all of that, who cares if I'm hacked, I got backups. I just havent found a great way to keep secrets that need to go online.
      - mecsred 3y ago
        I'd recommend not taking any security advice from internet forums at all if millions are on the line, regardless of OS. I'd hire a professional to harden the computer I want to use for that and wouldn't use it for anything else. An apple device would probably be my go-to there over any Linux system.
  - dannymi 3y ago
    If you run programs that you can't trust (for example because the source is unavailable and/or nobody reads it, no one is a gatekeeper of program updates etc), then you are opening yourself to attack because the default unix security model is just as bad as the Windows one. (The Windows one used to be much worse, but it isn't anymore, now they are the same badness) Nowadays, the web browser is used as a platform to run programs on and so it has a lot of access to weird things (multiple monitors, local filesystem, ...) so one has to be careful what you enable there--since you probably run a lot of Javascript written by shady people you don't know. The Linux desktop security model has user accounts, and then files have permissions for those users (yeah, there are also user groups, whatever). That means if you have a misbehaving (or malicious) program, it can read stuff in your home directory since that's owned by the same user account--so it can read your saved passwords, delete all your photos, figure out your banking info--but hey, at least it can't remove your printer (since for the latter you need to use the root user account :P) /s . There are mitigations against that and the easiest (and crappiest) one is containerization: just run each program in an isolated virtual-machine-like-thing and they can't access other program's data (i.e. the rest of YOUR data) in the first place. Then there's SELinux which flips this entire thing on its head. By default, nobody can do anything (that's the first very good decision!). If a process wants to do things, there has to be a policy installed that mentions that specific thing to be allowed and when. Otherwise no go. This way of working is much safer, BUT someone has to maintain those policies! And it must not be the program's author since he could just add whatever line he wants to have to the policy--and that's obviously bad. So who does it? Usually the Linux distribution's maintainer. Or, more commonly, nobody--so there's no policy for your favorite program and so it won't work.
    - anthk 3y ago
      Containers are not virtual machines.
      - egberts1 3y ago
        But container is a form of virtualization.
  - guy98238710 3y ago
    The core three tenets are drive encryption (easy), regular wipes (10h/year), and sandboxing (crazy expensive at the moment). That gives you decent security.
    - bojo 3y ago
      What is the 10h/year metric?
    - PhilipRoman 3y ago
      If you have a basic understanding of mounts, sandboxing a program in bubblewrap is pretty easy. And of course there are pre-made solutions like firejail.
      - mrob 3y ago
        >sandboxing a program in bubblewrap is pretty easy It's not easy. Just getting the mounts right is not sufficient. You also need to consider syscalls. E.g. TIOCSTI is permitted by default and allows an easy sandbox escape. See [0]CVE-2017-5226. TIOCLINUX can also allow sandbox escapes. This can be prevented with the --new-session option, but that breaks interactive terminals, e.g. it causes ctrl-C to restore input to the parent shell while simultaneously running the child shell on the same terminal with the same inputs, which makes it unusable. The alternative is compiling a seccomp BPF program to filter the syscalls, and loading it with the --seccomp option, but even this is non-trivial, e.g. see [1]CVE-2019-10063. This is also a case of "enumerating badness"; there's no guarantee that other syscalls are not also exploitable. [0] https://nvd.nist.gov/vuln/detail/CVE-2017-5226 https://nvd.nist.gov/vuln/detail/CVE-2017-5226 [1] https://nvd.nist.gov/vuln/detail/CVE-2019-10063 https://nvd.nist.gov/vuln/detail/CVE-2019-10063
        PhilipRoman 3y ago
        Ah it sure does feel good to be humbled. Glad to know my personal setups are not affected as they do not give access to the outer tty but at the same time - WTF is going on inside developers heads!? I've noticed a trend of adding N deeply intertwined features which then interact in N! different ways and no one bothers to define rigorous semantics for them. And then you have to get a PhD in Linux just to understand whether your system is vulnerable when you use POSIX message queues inside a FUSE filesystem inside an unprivileged user namespace inside chroot inside setarch running in 9 nested terminal sessions. I think I'm starting to understand why some people swear by the BSDs. Edit: just checked and OpenBSD has indeed removed TIOCSTI in 2017.
- vidyesh 3y ago
  I feel every privacy & security measure taken be it on your system or just your browser config needs to be understood properly before applying. So I think there is value in recommending such articles to everyone interested, as it would open them to understanding attack/leak vectors and be aware of those. The fallacy that anything that isn't Windows is safe needs to come with a caveat that blind trust with the basic security policies can lead to disaster.
- kelvie 3y ago
  Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on Framework, where I set this up from scratch. Anyone can say what they want about chromeOS not being a real OS (I disagree, that's off-topic), but it was built to be secure-by-default -- at least with regard to basically everything in this article. Even with a stock, up-to-date linux kernel (I use arch BTW), there are a ton of gotchas, such as the fact that lockdown mode disables hibernate (!)-- I needed to patch the kernel to tell it I know better (there are some good LWN articles on why they did it, it's cause there are far too many gotchas): https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1350 https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1... Chromebook on Framework actually seems like a great value prop in this regard, but of course you have to sell your metadata to big G.
  - 7speter 3y ago
    Most people disable hibernate because they use ssd’s for boot disks, no?
    - kogir 3y ago
      Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.
      - patrick451 3y ago
        Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.
    - kelvie 3y ago
      It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect: 1. The laptop to sleep 2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend 3. When I fire it up on monday, whatever I was working on is still there. It's hard to do this without hibernate (or a _really_ efficient sleep). You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).
- JohnFen 3y ago
  All security (computer or otherwise) is a balance between being usable and being secure. The ideal balance point is a very individual thing.
asylteltine 3y ago
I used to be a Linux fanatic (arch, i3-gaps, etc) but then I tried mac. It’s like Linux, but it just works. Highly recommend just getting an M1/2 laptop and enjoying yourself.
guy98238710 3y ago
I think the main limitation is currently in Flatpak sandbox. Lots of apps assume control over the whole computer (IDEs, Rust, Android tooling). Lots of apps still rely on X11, which allows trivial sandbox escape. And then a lot of apps just ask for full access to your home folder or even to the whole filesystem, just so that they can open documents. Even if you try to restrict it manually, you can only make an access blacklist, not a whitelist. It's like trying to plug holes in a sieve. You are one update away from Flatpak poking another hole in the sandbox at the request of the app developer.
- dizhn 3y ago
  And the various portals are used to satisfy user consent implicitly. If you are clicking something in the open file portal the permission is granted. I found this pretty weird when I first encountered it.
- 5e92cb50239222b 3y ago
  JFYI, firejail can do all of that. It can start each application in a separate xserver (giving you a choice from several implementations), deny access to everything with whitelisting (or do the reverse — your choice). The profiles are really easy to read and write, and it already covers a lot of popular stuff.
  - lima 3y ago
    Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to use denylists vs. allowlists. Firejail is a setuid binary with tons of attack surface and has had a number of privescs itself[1], unlike something like the lower-level Bubblewrap tool. I'm glad it exists, though - it's the only mature solution other than Flatpak that has proper dbus filtering, among other things. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-16191/Firejail-Project.html https://www.cvedetails.com/vulnerability-list/vendor_id-1619...
- Timber-6539 3y ago
  > And then a lot of apps just ask for full access to your home folder or even to the whole filesystem, just so that they can open documents. Therein lies IMO the biggest problem with application security on desktop Linux. Just like selinux, apparmor and other similar security tools *someone* has to globally deny access to permissions, break things in the process and find the minimum number of permissions required for the app to function. Many users are not going to do this and (lazy or uninterested?) developers (package maintainers?) don't want to do that work either.
contingencies 3y ago
Security is a process not a product. Reduce your attack surface and practice defense in depth. Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. On any modern machine, just disable swap. It's not useful unless you want to suspend on mobile.
- deleted 3y ago
  [deleted]
- 5e92cb50239222b 3y ago
  It is useful, unless you have an absolute crapton of memory, several times what you actually need. The swap is trivial to encrypt if you're paranoid (the key doesn't need to be persisted and can be generated from /dev/urandom on each boot). https://chrisdown.name/2019/07/18/linux-memory-management-at-scale.html https://chrisdown.name/2019/07/18/linux-memory-management-at... https://haydenjames.io/linux-performance-almost-always-add-swap-space/ https://haydenjames.io/linux-performance-almost-always-add-s... https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption
  - contingencies 3y ago
    absolute crapton of memory, several times what you actually need Err, you mean every rack-mount system since around 2000s? Seriously, the commissioning overhead for virtually anything exceeds the "max out the ram" tax. Unless you're a cloud provider commissioning autonomously and operating at excessive scale seeking some particular unit cost optimization ... and even then not maxing out RAM (to some current definition of effective price:performance maxima) would be odd.
- zokier 3y ago
  > Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. Having timely zero-effort updates from distros is far, far more valuable for security than the reduction of attack surface from custom kernel.
DethNinja 3y ago
This is a pretty good guide. I also recommend manually reading/checking the the BIOS EEPROM and re-installing the OS from scratch at least every 6 months. This should mostly eliminate most of the advanced threats. You can setup an ansible script to re-install everything so it can automated.
- effie 3y ago
  How does re-installing the OS from scratch every 6 months "eliminate most of the advanced threats"? The malware has up to 6 months to do its work. OS re-install may delete the malware, but the next visit to bad link may re-install the malware as well.
  - DethNinja 3y ago
    It is just a precaution measure, some of the malware like DDOS Bots might persist more than 6 months. Honestly, an immutable OS would be more ideal but it isn’t very realistic. If you are adventurous, it would also be possible to setup a system where host image gets rebuild every night and persistent data gets pulled from a git repo.
aborsy 3y ago
Linux security is surprisingly weak, and a mess. Are users expected to search for hardening guides, spend time learn all these pieces and implement them securely? Even the system administrators may not know tools such as SeLinux, let alone the end users. It takes a lot of time to learn write SeLinux or AppArmor policies. We need an operating system that is already hardened, preconfigured with secure defaults, and can be a daily driver. It should not need the user “harden” it. I don’t mean OpenBSD: it’s secure because it doesn’t enable much.
- 5e92cb50239222b 3y ago
  You either get a mess like iOS/Android that take everything away from user in the name of "safety", or yet another complicated beast like Qubes that has its own tradeoffs.
  - egberts1 3y ago
    https://www.qubes-os.org/ https://www.qubes-os.org/
- seanw444 3y ago
  > I don’t mean OpenBSD: it’s secure because it doesn’t enable much. If you want it easy for the average joe, it's going to be measurably more insecure. If you want it secure, it's going to be barebones by virtue of intentionally having reduced attack surface. That's just how it goes. Unfortunately, I will concede that default Linux is in an awkward spot of being too insecure to be considered "secure enough", and too difficult for newbies to configure properly.
- bamfly 3y ago
  > We need an operating system that is already hardened, preconfigured with secure defaults, and can be a daily driver. It should not need the user “harden” it. It'll look like macOS does out-of-the-box. I think everybody here who's not already on macOS hates that, judging from what people post about it. Even though you can disable most of that stuff if you need to. Probably nigh-impossible to get such a thing working with decent UX all the way up through the GUI layer, on Linux. Too fragmented. The pieces are there, but no-one can say "THIS is how it works". I think we're stuck with the current situation, until/unless RedHat decides to create & push something for this that further cements their control over the Linux userspace (which... yeah, that actually might happen, and it'll probably be pretty bad because they seem to have really poor taste when it comes to software design, but we'll all end up stuck with it regardless). Maybe we'll see most distros shipping and enabling "systemd-security" when RH gets around to making it, and ensures that Gnome is extremely hard to package without it.
5e92cb50239222b 3y ago
I would throw hardware security keys in there. I use for two things (in the context of UNIX security): local PAM authentication through pam-u2f, and the SSH *-sk key types. The first one allows me to almost never type in my local password (and use a 7-word diceware that is impractical to bruteforce). This should prevent many local privilege escalation scenarios by things like shitty npm packages. I used a trivial password for years because it was tiresome to type in dozens of times a day. Now I just type `sudo -i` and tap the hardware key. (I already use containers and firejail to prevent them from accessing my personal files, so this only leaves zero days). https://wiki.archlinux.org/title/Universal_2nd_Factor https://wiki.archlinux.org/title/Universal_2nd_Factor The second one provides a second factor for my SSH keys that makes them completely useless without a corresponding hardware key. You need OpenSSH 8.2 or later on both sides. `ssh 1.2.3.4` and tap the key (or `ssh-add` it to the key agent — but it's less secure). https://gist.github.com/Kranzes/be4fffba5da3799ee93134dc68a4c67b https://gist.github.com/Kranzes/be4fffba5da3799ee93134dc68a4... https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...
- derefr 3y ago
  Do you believe that using an external hardware key is actually more secure than using an internal TPM whose short-period unlock is triggered by direct hardware signals (from e.g. a fingerprint reader) that software can't simulate, for your use-case? Personally, I could only see the security benefit if the hardware key and the laptop are stored separately — if e.g. a three-letter agency robbed my house, they'd get both anyway. But that's entirely impractical if the HSK is used for every PAM auth, rather than just to do "special" actions (in the way that e.g. hardware crypto wallets are used.)
  - ivanhoe 3y ago
    In reality they're probably good enough for most of users - but in theory any SW based solution can theoretically get exploited, so external key that requires user action is certainly more secure (and not significantly more inconvenient to use - you need to press something in both cases).
pca006132 3y ago
Wondering if there is something that can allow programs to access files in certain directory lists, and require explicit permission from the user to access anything elsewhere.
_arsr 3y ago
Not a pro but I'd like to point how that privsec is part of the PrivacyGuides/GrapheneOS mob. I don't want to put them down in any way but that group causes a lot of drama. They are Tommy_Tran/B0risGrishenko and moderator of r/PrivacyGuides. Accusations have been made about them and by them regarding other privacy advocates. None of that has anything to do with the quality of the post, but all sides of that drama seem to be very stubborn and immature when it comes to criticism which is a red flag in my book and takes all credibility away from them and suggestion they would make.
- TommyTran732 3y ago
  Are you TAJ? The only people who refer to me as B0risGrishenko (my old Reddit account for a few months) are either TAJ or the crazy people on r/privatelife who have no idea what they are talking about. Quite frankly, anyone looking at that subreddit will know that it's just a bunch of incompetent and incoherent rambling from a few guys with quite literally no technical understanding. They been doing this for years now, spreading terrible privacy and security advice and spearing developers with these cheap shots when they cannot argue on the technical front. PrivSec is not a part of either PrivacyGuides or GrapheneOS. I am currently a moderator on GrapheneOS, and have not been associated with PrivacyGuides for almost a year now.
GartzenDeHaes 3y ago
> You should make sure your system receives microcode updates to get fixes and mitigations for CPU vulnerabilities like Meltdown and Spectre. These cause a 10%-20% performance drop and I see no reason to enable them on a desktop. They can be turned off using mitigations=off on your grub command line.
- lima 3y ago
  A modern desktop has all kinds of sandboxes and other privilege boundaries including the browser, system services restricted using seccomp, various application level sandboxes like Flatpak/Firejail/...
- anotherhue 3y ago
  They were shown to be exploitable by JS (though I think V8 had a mitigation, WASM probably not?) Anyway, modern chips have hardware fixes, these microcode updates and kernel retpolines etc. should be less impactful if your CPU was made post-meltdown.
  - GartzenDeHaes 3y ago
    I seen these claims, but I've never seen a publicly available demonstration of these exploits. Converting random bits into meaningful data would seem to be the sticky point.
    - fullspectrumdev 3y ago
      I’ve seen a handful of proof of concept exploits over the years for the speculative execution bugs, none of them really worth caring about. The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company. There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.
      - 3y ago
nubinetwork 3y ago
> swap on zram If I'm going to use memory that I don't have as swap, I might as well just use no swap and take the OOM if I use too much memory.
- _piif 3y ago
  Not sure I understand. Zram allows you to store pages in a compressed fashion to memory to prevent or at least delay until the OOM kicks in and to keep hold of cached files for longer to prevent needless disk reads. Considering the tradeoff is a marginal amount of CPU resources it seems like free extra space and a no-brainer to enable if swap on disk isn't desired, at least in my mind. I remember having issues with system starvation if it started to make excessive use of zram but that has been pretty much levitated with the introduction of MGLRU.
- fruitreunion1 3y ago
  swap on zram is awesome, I get quite good ratios with zstd. Though its effectiveness will obviously depend on what's in memory. If it's a bunch of already compressed stuff then it won't get a good ratio on that.
talhah 3y ago
Would also like to add in this resource which is pretty in-depth. https://theprivacyguide1.github.io/linux_hardening_guide https://theprivacyguide1.github.io/linux_hardening_guide
egberts1 3y ago
If you want a hardened Linux desktop right out the starting gate, give QubeOS a try. Your privacy is already secured for the most part and keeps your work and personal stuff separate. It is what i use to ensure that Firefox is started with empty data cache/file-store but populated with bookmarks. https://www.qubes-os.org/ https://www.qubes-os.org/
- mtlmtlmtlmtl 3y ago
  Yeah, Qubes feels just a few versions away from being really very nice to use too. But there's still quite a few pain points for me, most notably anything GPU related. And also a general lack of detailed documentation that's quite frustrating. The default security can be improved a lot too. Running a full-blown linux distro in net-vm and firewall-vm is sort of silly, really. Leaves a lot of unnecessary attack surface, and wastes a bunch of memory too. There's also qubsd which is a qubes like thing for Freebsd, leveraging zfs, jails and bhyve. Looks really promising, but is still in a lot of dev flux. Definitely gonna switch to it when it's solid enough though. Because it looks like a better way to set up your own custom qubes-like setup.
  - mtreis86 3y ago
    I've been daily driving it for 5 years now on an old Lenovo Thinkpad. No major issues the whole time. I think people solve the GPU issue by using multiple GPUs, that way one can be dedicated to dom0 and the other can be passed through to an HVM OS. People play games in a windows vm, within qubes, so it is do-able. I don't have the hardware to test this out myself, all my machines are single GPU.
    - mtlmtlmtlmtl 3y ago
      Yeah, I've been trying to set something like this up with a combination of iGPU and dGPU, which theoretically should be possible, but I certainly haven't gotten it to work as yet, and the documentation(and maybe the tooling too) leaves a lot to be desired. It offers ways to do some things, but very little in terms of more general explanation of all the steps, and the steps don't always apply as given(in my case, since I have pretty new hardware, they rarely apply at all). So I just have to sort of laboriously figure everything out. And it's quite a bit of dicking around to set up custom PVHs and such, again with lacking documentation. I like Qubes quite a lot. But there's still a lot of friction if you're doing anything not supported by default.
talhah 3y ago
In addition to this site, I'd also highly recommend this resource. https://theprivacyguide1.github.io/linux_hardening_guide https://theprivacyguide1.github.io/linux_hardening_guide
GabrieleR 3y ago
Thank you! This is an extremely good hardening guide. Next weekend is set on this
alekq 3y ago
I went this rabbit hole roughly 2 years ago and I just quit at the very end, because my focus went from using the OS for something productive to maintaining it, securing it and becoming home sys admin. Since then, I’m simply “ignorant” and sane - use it, update it regularly, use official software sources (so official distros repos and Flatpaks), FDE, SecureBoot, do not run random net stuff (like scripts, “Git” etc.), try to stay as default as possible and use a VM to experiment if I really need to. I am curious - how many of you regular desktop Linux users actually had security issues (or at least suspected something shady)?
- 2devnull 3y ago
  It’s hard to prove a security issue but “shady” describes my experience with most all modern OS’s. I trust Linux the least but it’s my daily driver. I just assume it’s comp’d because at some level (NSA at least) it is. I also try to reinstall a fresh distro at least quarterly, but even on a fresh install don’t trust it. If I can’t trust all of the devices on my network (I don't) then I also don’t trust my network. If that’s true then no device on the network can be trusted. Until I own and administer every device on my network, there’s no way around that. Even if I did trust all the devices I also have to trust the isp and the router manufacturer (which I certainly don’t).
  - funcDropShadow 3y ago
    How do you work with a computer you don't trust?
- Arnavion 3y ago
  As great as flatpaks are for providing sandboxing, the problem with them is that they are upstream software. When Audacity added telemetry it only affected binaries downloaded from them, not distro-compiled binaries. When firefox stops you from loading your own extensions, that's because you're using a binary downloaded from them, not distro-compiled binaries. A decade ago I used to think distro package maintainers were unnecessary middlemen who were just introducing failure points (like the Debian openssl fuckup), but today they are truly the last line of defence from malicious upstreams. Even if something sneaks into a distro package it's possible to convince the distro package maintainer to disable it, because the maintainer's interests are aligned with you and not upstream.
Arnavion 3y ago
>Most Linux distributions have an option within its installer for enabling LUKS full disk encryption. If this option isn’t set at installation time, you will have to backup your data and re-install, as encryption is applied after disk partitioning but before filesystem creation. If you have a live CD and enough spare disk space, you can create a new LUKS partition and dd / filesystem-specific-backup-restore your existing partition into it. You don't have to backup and reinstall. If you're already using systemd-gpt-auto-generator to auto-detect the root partition, you just have to make sure the new partition has the expected UUID. Depending on your setup you might have to regenerate the initramfs though, say because it didn't already contain `/usr/bin/cryptsetup` etc. >openSUSE uses a unique ID to count systems, which can be disabled by deleting the /var/lib/zypp/AnonymousUniqueId file. Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead. >Encrypted /boot [...] >- openSUSE uses LUKS1 instead of LUKS2 for encryption. >- GRUB supports PBKDF2 key derivation only, not Argon2 (the LUKS2 default). Yes, the first point is because of the second point. There isn't a security difference between LUKS1 and 2 when using PBKDF2, so sticking with LUKS1 means you can't accidentally switch to non-PBKDF2 and end up with an unbootable system. But yes, switching away from grub as the next point talks about is ideal. And if you switch to UEFI boot with UKIs in /efi then you won't need a separate encrypted /boot anyway.
- TommyTran732 3y ago
  > Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead. Interesting. Are you sure about this? The Wiki says it can be deleted and I did not see it coming back during my time with openSUSE. I can check it again later though.
  - Arnavion 3y ago
    Yes I'm sure, since I went through the same process of discovering it myself some months ago. I just tested it again to be sure. It's also covered in https://forums.opensuse.org/t/zypper-uuid/135752 https://forums.opensuse.org/t/zypper-uuid/135752
    - 3y ago
spoonfeeder006 3y ago
One security expert a while back recommended grsecurity. From what I gather, it prevents permission exploitation in the first place and does so in a way that is pretty robust (can't remember the principle on how it does so) Otherwise, I'd say forget about trying to secure Linux and just go with QubesOS unless you need 3D graphics acceleration Edit: QubesOS allows you to run at least some conventional brands of Linux out of the box, but it allows memory efficient VM isolation between them, and some other really cool features, overall making securing stuff much simpler than installing a bunch of of random tools from different parties
- Krisjohn 3y ago
  I nuked my Ubuntu Mate laptop and installed Qubes, just to get a feel for it. It's significantly more maintenance than a vanilla distro, because of all the separated environments, but if I ever wanted to return to Linux on the desktop as my main OS, I'd absolutely use it. It's the only BYOD/WFH solution I've found that feels even close to secure enough if you don't want to run physically separate PCs.
  - spoonfeeder006 3y ago
    Security wise, QubesOS is better than separate PCs since (at least in part) isolating the network card into a separate VM prevents it from having direct memory access to the whole system (I think devices do have DMA?) It also provides a better way to communicate between VMs through simple RPC commands rather than hoping USB device drivers are not malicious In terms of maintenance, I'm pretty sure you could have only one templateVM for everything, which means you only have to update dom0 and that templateVM. So in terms of maintenance thats really not that much more I guess? I think I might try that myself actually If you need persistence in the root filesystem, that could mean a standalone VM or a new VM. Last I tried I had trouble with their AppVM solution on that
bandrami 3y ago
The supply-chain problems that come with using flatpak so completely outweigh the minimal gains from sandboxing that I find it difficult to take this seriously.
nathants 3y ago
outbound firewalls like littlesnitch are bypassable, but at another layer of depth. visual prompt for unknown network attempt is probably good. would be nice to have similar prompts for the filesystem.
unsungNovelty 3y ago
This is why you have Arch wiki - https://wiki.archlinux.org/title/Security https://wiki.archlinux.org/title/Security. It is a living and breathing document which is updated and maintained for a long time now. It also has proper warning on usability and practicality effects. And how to do it. Everything mentioned here should be attainable in any Linux distro. Linux is like Firefox. Just like how Firefox comes with Google as the default search engine and other bad defaults. It is also the most configurable browser when it comes providing privacy to end users. Linux defaults sucks. But it is also the most configurable when it comes to security. And anyone recommending ChromeOS or MacOS are trading off privacy for security. Especially if you are recommending ChromeOS. Motivation and agenda > technical merit. Linux provides a good balance here.
drpixie 3y ago
Unfortunately the article fails to mention the most import aspect of security ... WHAT IS YOUR THREAT MODEL? Who/what are you protecting against? Without a clear answer to that, you're probably wasting your time. And check out Bruce Schneier for intelligent advice. https://www.schneier.com/ https://www.schneier.com/
lofaszvanitt 3y ago
Someone tell me how often threat actors or the angry neighbor poke in your swap partition to fish out things...
lenkite 3y ago
Really wish there are a wizard that did all this for you. Just click "harden" and wait till progress bar reaches 100%

289 points by pabs3 3y ago

Very useful. One practical thing to add: enabling automatic snapshots (e.g. with https://github.com/openSUSE/snapper https://github.com/openSUSE/snapper), ideally backing them up separately (e.g., with borg) might help recovery.

rrdharan 3y ago

The link near the top of the article that goes to a separate page explaining security problems with Desktop Linux is quite interesting. The article itself starts off much more focused on privacy than on security though it does have a fair bit of content on both topics.

guy98238710 3y ago

I am nuts into linux desktop security, but I cannot imagine recommending this to even other developers, let alone non-dev users. There are just too many usability tradeoffs, the whole thing is a major time waster, and you have to deal with a lot of breakage. Making basic security measures easy to implement is what's going to help in the long run.

hospitalJail 3y ago
>I am nuts into linux desktop security What things do I need to worry about? I'm about to make the switch from Windows to Linux. Is it general 'dont run things you don't trust'? keep things updated? Use good passwords?(do I need to change a setting to prevent brute forcing?) Am I missing anything?
- smoldesu 3y ago
  "read scripts before you run them" is a good bit of advice. Some little things can help you protect your GUI apps if you're extra paranoid (eg. Wayland is more secure, Flatpak offers additional sandboxing with bubblewrap) but not everything is necessary. If you use a mainstream distro like Fedora or Ubuntu, its default configuration should be safe enough to use like Windows. Just remember that there isn't really any antivirus or Microsoft Defender to save you if you really mess up. I do offline backups of important work on all my devices, for this reason partially.
  - hospitalJail 3y ago
    >Some little things can help you protect your GUI apps if you're extra paranoid Can you explain this? What are the exploits? Is it the equivalent of running a .exe or .jar on windows, but with an extra layer of protection? (Or am I trying to shove my windows ideas into linux?)
    - smoldesu 3y ago
      > Can you explain this? What are the exploits? Traditional desktop Linux allows different apps to more-or-less freely communicate with each other (called the x11 protocol). This works really well for old apps (and admittedly not too bad for new ones) but is very slow and exposes a lot of bugs. On top of this, you have potential exploits in your filesystem from loosely permissioning important settings and identity files. So, the attack surface for a traditional Linux distro is relatively large. > Is it the equivalent of running a .exe or .jar on windows, but with an extra layer of protection? Kinda! Linux software is distributed as packages, which contains a binary (the exe/jar portion), a dependency manifest and whatever static content it needs. A sandbox like Flatpak will take those packages and put it into a sandbox, to prevent hostile interprocess communication and filesystem exploits. None of these mitigations are perfect per-se (nor are they on Mac/Windows), so use them wisely if you intend to use them at all. I have used a non-sandboxed system to run old 90s Windows games for years though, and haven't picked up any significant issues. YMMV, it is Linux after all :P
      - hospitalJail 3y ago
        >Traditional desktop Linux allows different apps to more-or-less freely communicate with each other (called the x11 protocol). Oh gosh. I'm getting heart palpitations :P Is this a common attack vector then? Seems like an easy way to get an overflow error, or elevate privilege's.
        bombolo 3y ago
        Not common at all. Because most software comes from distributions, not from warez.exe. Sandbox comes with a heavy usability price, so they are lax by default. For example you protect your files, but then you can't load your photos to facebook because your browser doesn't have access.
- mecsred 3y ago
  All three of those are great things to do. The fact that you know to mention them makes me think you don't need to worry much. When Linux people say they're into security, it usually means research level computer science, not "I don't want my laptop to get malware".
  - hospitalJail 3y ago
    The only caveat I'd like to say, I think we shouldnt assume every user isnt a VIP. I'm not a VIP, but I have some huge huge huge secrets that are worth at least a million dollars, maybe 10s of millions of dollars, that I need to access with a computer. Malware means potentially losing millions or tens of millions of dollars. I'm so afraid of those secrets, I don't even access them on my windows computers unless necessary. I'd love to be comfortable doing this, but given anyone can seemingly make a python keylogger, I'm not really comfortable using my computer(windows or linux) for this purpose. Gaming/updating my website/etc... all of that, who cares if I'm hacked, I got backups. I just havent found a great way to keep secrets that need to go online.
    - mecsred 3y ago
      I'd recommend not taking any security advice from internet forums at all if millions are on the line, regardless of OS. I'd hire a professional to harden the computer I want to use for that and wouldn't use it for anything else. An apple device would probably be my go-to there over any Linux system.
- dannymi 3y ago
  If you run programs that you can't trust (for example because the source is unavailable and/or nobody reads it, no one is a gatekeeper of program updates etc), then you are opening yourself to attack because the default unix security model is just as bad as the Windows one. (The Windows one used to be much worse, but it isn't anymore, now they are the same badness) Nowadays, the web browser is used as a platform to run programs on and so it has a lot of access to weird things (multiple monitors, local filesystem, ...) so one has to be careful what you enable there--since you probably run a lot of Javascript written by shady people you don't know. The Linux desktop security model has user accounts, and then files have permissions for those users (yeah, there are also user groups, whatever). That means if you have a misbehaving (or malicious) program, it can read stuff in your home directory since that's owned by the same user account--so it can read your saved passwords, delete all your photos, figure out your banking info--but hey, at least it can't remove your printer (since for the latter you need to use the root user account :P) /s . There are mitigations against that and the easiest (and crappiest) one is containerization: just run each program in an isolated virtual-machine-like-thing and they can't access other program's data (i.e. the rest of YOUR data) in the first place. Then there's SELinux which flips this entire thing on its head. By default, nobody can do anything (that's the first very good decision!). If a process wants to do things, there has to be a policy installed that mentions that specific thing to be allowed and when. Otherwise no go. This way of working is much safer, BUT someone has to maintain those policies! And it must not be the program's author since he could just add whatever line he wants to have to the policy--and that's obviously bad. So who does it? Usually the Linux distribution's maintainer. Or, more commonly, nobody--so there's no policy for your favorite program and so it won't work.
  - anthk 3y ago
    Containers are not virtual machines.
    - egberts1 3y ago
      But container is a form of virtualization.
- guy98238710 3y ago
  The core three tenets are drive encryption (easy), regular wipes (10h/year), and sandboxing (crazy expensive at the moment). That gives you decent security.
  - bojo 3y ago
    What is the 10h/year metric?
  - PhilipRoman 3y ago
    If you have a basic understanding of mounts, sandboxing a program in bubblewrap is pretty easy. And of course there are pre-made solutions like firejail.
    - mrob 3y ago
      >sandboxing a program in bubblewrap is pretty easy It's not easy. Just getting the mounts right is not sufficient. You also need to consider syscalls. E.g. TIOCSTI is permitted by default and allows an easy sandbox escape. See [0]CVE-2017-5226. TIOCLINUX can also allow sandbox escapes. This can be prevented with the --new-session option, but that breaks interactive terminals, e.g. it causes ctrl-C to restore input to the parent shell while simultaneously running the child shell on the same terminal with the same inputs, which makes it unusable. The alternative is compiling a seccomp BPF program to filter the syscalls, and loading it with the --seccomp option, but even this is non-trivial, e.g. see [1]CVE-2019-10063. This is also a case of "enumerating badness"; there's no guarantee that other syscalls are not also exploitable. [0] https://nvd.nist.gov/vuln/detail/CVE-2017-5226 https://nvd.nist.gov/vuln/detail/CVE-2017-5226 [1] https://nvd.nist.gov/vuln/detail/CVE-2019-10063 https://nvd.nist.gov/vuln/detail/CVE-2019-10063
      - PhilipRoman 3y ago
        Ah it sure does feel good to be humbled. Glad to know my personal setups are not affected as they do not give access to the outer tty but at the same time - WTF is going on inside developers heads!? I've noticed a trend of adding N deeply intertwined features which then interact in N! different ways and no one bothers to define rigorous semantics for them. And then you have to get a PhD in Linux just to understand whether your system is vulnerable when you use POSIX message queues inside a FUSE filesystem inside an unprivileged user namespace inside chroot inside setarch running in 9 nested terminal sessions. I think I'm starting to understand why some people swear by the BSDs. Edit: just checked and OpenBSD has indeed removed TIOCSTI in 2017.
vidyesh 3y ago
I feel every privacy & security measure taken be it on your system or just your browser config needs to be understood properly before applying. So I think there is value in recommending such articles to everyone interested, as it would open them to understanding attack/leak vectors and be aware of those. The fallacy that anything that isn't Windows is safe needs to come with a caveat that blind trust with the basic security policies can lead to disaster.
kelvie 3y ago
Completely agree. I also went through this exercise, having switched from a Chromebook (RIP pixelbook, probably my favourite computer until it died) to Linux on Framework, where I set this up from scratch. Anyone can say what they want about chromeOS not being a real OS (I disagree, that's off-topic), but it was built to be secure-by-default -- at least with regard to basically everything in this article. Even with a stock, up-to-date linux kernel (I use arch BTW), there are a ton of gotchas, such as the fact that lockdown mode disables hibernate (!)-- I needed to patch the kernel to tell it I know better (there are some good LWN articles on why they did it, it's cause there are far too many gotchas): https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1350 https://gist.github.com/kelvie/917d456cb572325aae8e3bd94a9c1... Chromebook on Framework actually seems like a great value prop in this regard, but of course you have to sell your metadata to big G.
- 7speter 3y ago
  Most people disable hibernate because they use ssd’s for boot disks, no?
  - kogir 3y ago
    Hibernate is usually used to allow the computer to shut down completely and not remain in standby, saving battery. It’s not about boot speed anymore.
    - patrick451 3y ago
      Yeah, mine too. Getting to hte grub menu takes probably 90 seconds. Booting from there takes about 10. I'd love to know why that is.
  - kelvie 3y ago
    It's not really boot speed that's the issue, it's just that, like on my work Macbook, when I close my laptop's lid on Friday to catch the train, I expect: 1. The laptop to sleep 2. After some time, it'll hibernate so it doesn't drain the entire battery over the weekend 3. When I fire it up on monday, whatever I was working on is still there. It's hard to do this without hibernate (or a _really_ efficient sleep). You actually have to configure sleep-then-hibernate on systemd for this to work right. Again, I still think chromeOS is the future of the linux desktop (again, if you don't mind Google watching over).
JohnFen 3y ago
All security (computer or otherwise) is a balance between being usable and being secure. The ideal balance point is a very individual thing.

asylteltine 3y ago

I used to be a Linux fanatic (arch, i3-gaps, etc) but then I tried mac. It’s like Linux, but it just works. Highly recommend just getting an M1/2 laptop and enjoying yourself.

guy98238710 3y ago

I think the main limitation is currently in Flatpak sandbox. Lots of apps assume control over the whole computer (IDEs, Rust, Android tooling). Lots of apps still rely on X11, which allows trivial sandbox escape. And then a lot of apps just ask for full access to your home folder or even to the whole filesystem, just so that they can open documents. Even if you try to restrict it manually, you can only make an access blacklist, not a whitelist. It's like trying to plug holes in a sieve. You are one update away from Flatpak poking another hole in the sandbox at the request of the app developer.

dizhn 3y ago
And the various portals are used to satisfy user consent implicitly. If you are clicking something in the open file portal the permission is granted. I found this pretty weird when I first encountered it.
5e92cb50239222b 3y ago
JFYI, firejail can do all of that. It can start each application in a separate xserver (giving you a choice from several implementations), deny access to everything with whitelisting (or do the reverse — your choice). The profiles are really easy to read and write, and it already covers a lot of popular stuff.
- lima 3y ago
  Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to use denylists vs. allowlists. Firejail is a setuid binary with tons of attack surface and has had a number of privescs itself[1], unlike something like the lower-level Bubblewrap tool. I'm glad it exists, though - it's the only mature solution other than Flatpak that has proper dbus filtering, among other things. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-16191/Firejail-Project.html https://www.cvedetails.com/vulnerability-list/vendor_id-1619...
Timber-6539 3y ago
> And then a lot of apps just ask for full access to your home folder or even to the whole filesystem, just so that they can open documents. Therein lies IMO the biggest problem with application security on desktop Linux. Just like selinux, apparmor and other similar security tools *someone* has to globally deny access to permissions, break things in the process and find the minimum number of permissions required for the app to function. Many users are not going to do this and (lazy or uninterested?) developers (package maintainers?) don't want to do that work either.

contingencies 3y ago

Security is a process not a product. Reduce your attack surface and practice defense in depth. Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. On any modern machine, just disable swap. It's not useful unless you want to suspend on mobile.

deleted 3y ago
[deleted]
5e92cb50239222b 3y ago
It is useful, unless you have an absolute crapton of memory, several times what you actually need. The swap is trivial to encrypt if you're paranoid (the key doesn't need to be persisted and can be generated from /dev/urandom on each boot). https://chrisdown.name/2019/07/18/linux-memory-management-at-scale.html https://chrisdown.name/2019/07/18/linux-memory-management-at... https://haydenjames.io/linux-performance-almost-always-add-swap-space/ https://haydenjames.io/linux-performance-almost-always-add-s... https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption
- contingencies 3y ago
  absolute crapton of memory, several times what you actually need Err, you mean every rack-mount system since around 2000s? Seriously, the commissioning overhead for virtually anything exceeds the "max out the ram" tax. Unless you're a cloud provider commissioning autonomously and operating at excessive scale seeking some particular unit cost optimization ... and even then not maxing out RAM (to some current definition of effective price:performance maxima) would be odd.
zokier 3y ago
> Once you know how it is a small investment of time to compile a custom kernel with everything you don't use disabled. Having timely zero-effort updates from distros is far, far more valuable for security than the reduction of attack surface from custom kernel.

DethNinja 3y ago

This is a pretty good guide. I also recommend manually reading/checking the the BIOS EEPROM and re-installing the OS from scratch at least every 6 months. This should mostly eliminate most of the advanced threats. You can setup an ansible script to re-install everything so it can automated.

effie 3y ago
How does re-installing the OS from scratch every 6 months "eliminate most of the advanced threats"? The malware has up to 6 months to do its work. OS re-install may delete the malware, but the next visit to bad link may re-install the malware as well.
- DethNinja 3y ago
  It is just a precaution measure, some of the malware like DDOS Bots might persist more than 6 months. Honestly, an immutable OS would be more ideal but it isn’t very realistic. If you are adventurous, it would also be possible to setup a system where host image gets rebuild every night and persistent data gets pulled from a git repo.

aborsy 3y ago

Linux security is surprisingly weak, and a mess. Are users expected to search for hardening guides, spend time learn all these pieces and implement them securely? Even the system administrators may not know tools such as SeLinux, let alone the end users. It takes a lot of time to learn write SeLinux or AppArmor policies. We need an operating system that is already hardened, preconfigured with secure defaults, and can be a daily driver. It should not need the user “harden” it. I don’t mean OpenBSD: it’s secure because it doesn’t enable much.

5e92cb50239222b 3y ago
You either get a mess like iOS/Android that take everything away from user in the name of "safety", or yet another complicated beast like Qubes that has its own tradeoffs.
- egberts1 3y ago
  https://www.qubes-os.org/ https://www.qubes-os.org/
seanw444 3y ago
> I don’t mean OpenBSD: it’s secure because it doesn’t enable much. If you want it easy for the average joe, it's going to be measurably more insecure. If you want it secure, it's going to be barebones by virtue of intentionally having reduced attack surface. That's just how it goes. Unfortunately, I will concede that default Linux is in an awkward spot of being too insecure to be considered "secure enough", and too difficult for newbies to configure properly.
bamfly 3y ago
> We need an operating system that is already hardened, preconfigured with secure defaults, and can be a daily driver. It should not need the user “harden” it. It'll look like macOS does out-of-the-box. I think everybody here who's not already on macOS hates that, judging from what people post about it. Even though you can disable most of that stuff if you need to. Probably nigh-impossible to get such a thing working with decent UX all the way up through the GUI layer, on Linux. Too fragmented. The pieces are there, but no-one can say "THIS is how it works". I think we're stuck with the current situation, until/unless RedHat decides to create & push something for this that further cements their control over the Linux userspace (which... yeah, that actually might happen, and it'll probably be pretty bad because they seem to have really poor taste when it comes to software design, but we'll all end up stuck with it regardless). Maybe we'll see most distros shipping and enabling "systemd-security" when RH gets around to making it, and ensures that Gnome is extremely hard to package without it.

5e92cb50239222b 3y ago

I would throw hardware security keys in there. I use for two things (in the context of UNIX security): local PAM authentication through pam-u2f, and the SSH *-sk key types. The first one allows me to almost never type in my local password (and use a 7-word diceware that is impractical to bruteforce). This should prevent many local privilege escalation scenarios by things like shitty npm packages. I used a trivial password for years because it was tiresome to type in dozens of times a day. Now I just type `sudo -i` and tap the hardware key. (I already use containers and firejail to prevent them from accessing my personal files, so this only leaves zero days). https://wiki.archlinux.org/title/Universal_2nd_Factor https://wiki.archlinux.org/title/Universal_2nd_Factor The second one provides a second factor for my SSH keys that makes them completely useless without a corresponding hardware key. You need OpenSSH 8.2 or later on both sides. `ssh 1.2.3.4` and tap the key (or `ssh-add` it to the key agent — but it's less secure). https://gist.github.com/Kranzes/be4fffba5da3799ee93134dc68a4c67b https://gist.github.com/Kranzes/be4fffba5da3799ee93134dc68a4... https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

derefr 3y ago
Do you believe that using an external hardware key is actually more secure than using an internal TPM whose short-period unlock is triggered by direct hardware signals (from e.g. a fingerprint reader) that software can't simulate, for your use-case? Personally, I could only see the security benefit if the hardware key and the laptop are stored separately — if e.g. a three-letter agency robbed my house, they'd get both anyway. But that's entirely impractical if the HSK is used for every PAM auth, rather than just to do "special" actions (in the way that e.g. hardware crypto wallets are used.)
- ivanhoe 3y ago
  In reality they're probably good enough for most of users - but in theory any SW based solution can theoretically get exploited, so external key that requires user action is certainly more secure (and not significantly more inconvenient to use - you need to press something in both cases).

pca006132 3y ago

Wondering if there is something that can allow programs to access files in certain directory lists, and require explicit permission from the user to access anything elsewhere.

_arsr 3y ago

Not a pro but I'd like to point how that privsec is part of the PrivacyGuides/GrapheneOS mob. I don't want to put them down in any way but that group causes a lot of drama. They are Tommy_Tran/B0risGrishenko and moderator of r/PrivacyGuides. Accusations have been made about them and by them regarding other privacy advocates. None of that has anything to do with the quality of the post, but all sides of that drama seem to be very stubborn and immature when it comes to criticism which is a red flag in my book and takes all credibility away from them and suggestion they would make.

TommyTran732 3y ago
Are you TAJ? The only people who refer to me as B0risGrishenko (my old Reddit account for a few months) are either TAJ or the crazy people on r/privatelife who have no idea what they are talking about. Quite frankly, anyone looking at that subreddit will know that it's just a bunch of incompetent and incoherent rambling from a few guys with quite literally no technical understanding. They been doing this for years now, spreading terrible privacy and security advice and spearing developers with these cheap shots when they cannot argue on the technical front. PrivSec is not a part of either PrivacyGuides or GrapheneOS. I am currently a moderator on GrapheneOS, and have not been associated with PrivacyGuides for almost a year now.

GartzenDeHaes 3y ago

> You should make sure your system receives microcode updates to get fixes and mitigations for CPU vulnerabilities like Meltdown and Spectre. These cause a 10%-20% performance drop and I see no reason to enable them on a desktop. They can be turned off using mitigations=off on your grub command line.

lima 3y ago
A modern desktop has all kinds of sandboxes and other privilege boundaries including the browser, system services restricted using seccomp, various application level sandboxes like Flatpak/Firejail/...
anotherhue 3y ago
They were shown to be exploitable by JS (though I think V8 had a mitigation, WASM probably not?) Anyway, modern chips have hardware fixes, these microcode updates and kernel retpolines etc. should be less impactful if your CPU was made post-meltdown.
- GartzenDeHaes 3y ago
  I seen these claims, but I've never seen a publicly available demonstration of these exploits. Converting random bits into meaningful data would seem to be the sticky point.
  - fullspectrumdev 3y ago
    I’ve seen a handful of proof of concept exploits over the years for the speculative execution bugs, none of them really worth caring about. The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company. There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.
    - 3y ago

nubinetwork 3y ago

> swap on zram If I'm going to use memory that I don't have as swap, I might as well just use no swap and take the OOM if I use too much memory.

_piif 3y ago
Not sure I understand. Zram allows you to store pages in a compressed fashion to memory to prevent or at least delay until the OOM kicks in and to keep hold of cached files for longer to prevent needless disk reads. Considering the tradeoff is a marginal amount of CPU resources it seems like free extra space and a no-brainer to enable if swap on disk isn't desired, at least in my mind. I remember having issues with system starvation if it started to make excessive use of zram but that has been pretty much levitated with the introduction of MGLRU.
fruitreunion1 3y ago
swap on zram is awesome, I get quite good ratios with zstd. Though its effectiveness will obviously depend on what's in memory. If it's a bunch of already compressed stuff then it won't get a good ratio on that.

talhah 3y ago

Would also like to add in this resource which is pretty in-depth. https://theprivacyguide1.github.io/linux_hardening_guide https://theprivacyguide1.github.io/linux_hardening_guide

egberts1 3y ago

If you want a hardened Linux desktop right out the starting gate, give QubeOS a try. Your privacy is already secured for the most part and keeps your work and personal stuff separate. It is what i use to ensure that Firefox is started with empty data cache/file-store but populated with bookmarks. https://www.qubes-os.org/ https://www.qubes-os.org/

mtlmtlmtlmtl 3y ago
Yeah, Qubes feels just a few versions away from being really very nice to use too. But there's still quite a few pain points for me, most notably anything GPU related. And also a general lack of detailed documentation that's quite frustrating. The default security can be improved a lot too. Running a full-blown linux distro in net-vm and firewall-vm is sort of silly, really. Leaves a lot of unnecessary attack surface, and wastes a bunch of memory too. There's also qubsd which is a qubes like thing for Freebsd, leveraging zfs, jails and bhyve. Looks really promising, but is still in a lot of dev flux. Definitely gonna switch to it when it's solid enough though. Because it looks like a better way to set up your own custom qubes-like setup.
- mtreis86 3y ago
  I've been daily driving it for 5 years now on an old Lenovo Thinkpad. No major issues the whole time. I think people solve the GPU issue by using multiple GPUs, that way one can be dedicated to dom0 and the other can be passed through to an HVM OS. People play games in a windows vm, within qubes, so it is do-able. I don't have the hardware to test this out myself, all my machines are single GPU.
  - mtlmtlmtlmtl 3y ago
    Yeah, I've been trying to set something like this up with a combination of iGPU and dGPU, which theoretically should be possible, but I certainly haven't gotten it to work as yet, and the documentation(and maybe the tooling too) leaves a lot to be desired. It offers ways to do some things, but very little in terms of more general explanation of all the steps, and the steps don't always apply as given(in my case, since I have pretty new hardware, they rarely apply at all). So I just have to sort of laboriously figure everything out. And it's quite a bit of dicking around to set up custom PVHs and such, again with lacking documentation. I like Qubes quite a lot. But there's still a lot of friction if you're doing anything not supported by default.

talhah 3y ago

In addition to this site, I'd also highly recommend this resource. https://theprivacyguide1.github.io/linux_hardening_guide https://theprivacyguide1.github.io/linux_hardening_guide

GabrieleR 3y ago

Thank you! This is an extremely good hardening guide. Next weekend is set on this

alekq 3y ago

I went this rabbit hole roughly 2 years ago and I just quit at the very end, because my focus went from using the OS for something productive to maintaining it, securing it and becoming home sys admin. Since then, I’m simply “ignorant” and sane - use it, update it regularly, use official software sources (so official distros repos and Flatpaks), FDE, SecureBoot, do not run random net stuff (like scripts, “Git” etc.), try to stay as default as possible and use a VM to experiment if I really need to. I am curious - how many of you regular desktop Linux users actually had security issues (or at least suspected something shady)?

2devnull 3y ago
It’s hard to prove a security issue but “shady” describes my experience with most all modern OS’s. I trust Linux the least but it’s my daily driver. I just assume it’s comp’d because at some level (NSA at least) it is. I also try to reinstall a fresh distro at least quarterly, but even on a fresh install don’t trust it. If I can’t trust all of the devices on my network (I don't) then I also don’t trust my network. If that’s true then no device on the network can be trusted. Until I own and administer every device on my network, there’s no way around that. Even if I did trust all the devices I also have to trust the isp and the router manufacturer (which I certainly don’t).
- funcDropShadow 3y ago
  How do you work with a computer you don't trust?
Arnavion 3y ago
As great as flatpaks are for providing sandboxing, the problem with them is that they are upstream software. When Audacity added telemetry it only affected binaries downloaded from them, not distro-compiled binaries. When firefox stops you from loading your own extensions, that's because you're using a binary downloaded from them, not distro-compiled binaries. A decade ago I used to think distro package maintainers were unnecessary middlemen who were just introducing failure points (like the Debian openssl fuckup), but today they are truly the last line of defence from malicious upstreams. Even if something sneaks into a distro package it's possible to convince the distro package maintainer to disable it, because the maintainer's interests are aligned with you and not upstream.

Arnavion 3y ago

>Most Linux distributions have an option within its installer for enabling LUKS full disk encryption. If this option isn’t set at installation time, you will have to backup your data and re-install, as encryption is applied after disk partitioning but before filesystem creation. If you have a live CD and enough spare disk space, you can create a new LUKS partition and dd / filesystem-specific-backup-restore your existing partition into it. You don't have to backup and reinstall. If you're already using systemd-gpt-auto-generator to auto-detect the root partition, you just have to make sure the new partition has the expected UUID. Depending on your setup you might have to regenerate the initramfs though, say because it didn't already contain `/usr/bin/cryptsetup` etc. >openSUSE uses a unique ID to count systems, which can be disabled by deleting the /var/lib/zypp/AnonymousUniqueId file. Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead. >Encrypted /boot [...] >- openSUSE uses LUKS1 instead of LUKS2 for encryption. >- GRUB supports PBKDF2 key derivation only, not Argon2 (the LUKS2 default). Yes, the first point is because of the second point. There isn't a security difference between LUKS1 and 2 when using PBKDF2, so sticking with LUKS1 means you can't accidentally switch to non-PBKDF2 and end up with an unbootable system. But yes, switching away from grub as the next point talks about is ideal. And if you switch to UEFI boot with UKIs in /efi then you won't need a separate encrypted /boot anyway.

TommyTran732 3y ago
> Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead. Interesting. Are you sure about this? The Wiki says it can be deleted and I did not see it coming back during my time with openSUSE. I can check it again later though.
- Arnavion 3y ago
  Yes I'm sure, since I went through the same process of discovering it myself some months ago. I just tested it again to be sure. It's also covered in https://forums.opensuse.org/t/zypper-uuid/135752 https://forums.opensuse.org/t/zypper-uuid/135752
  - 3y ago

spoonfeeder006 3y ago

One security expert a while back recommended grsecurity. From what I gather, it prevents permission exploitation in the first place and does so in a way that is pretty robust (can't remember the principle on how it does so) Otherwise, I'd say forget about trying to secure Linux and just go with QubesOS unless you need 3D graphics acceleration Edit: QubesOS allows you to run at least some conventional brands of Linux out of the box, but it allows memory efficient VM isolation between them, and some other really cool features, overall making securing stuff much simpler than installing a bunch of of random tools from different parties

Krisjohn 3y ago
I nuked my Ubuntu Mate laptop and installed Qubes, just to get a feel for it. It's significantly more maintenance than a vanilla distro, because of all the separated environments, but if I ever wanted to return to Linux on the desktop as my main OS, I'd absolutely use it. It's the only BYOD/WFH solution I've found that feels even close to secure enough if you don't want to run physically separate PCs.
- spoonfeeder006 3y ago
  Security wise, QubesOS is better than separate PCs since (at least in part) isolating the network card into a separate VM prevents it from having direct memory access to the whole system (I think devices do have DMA?) It also provides a better way to communicate between VMs through simple RPC commands rather than hoping USB device drivers are not malicious In terms of maintenance, I'm pretty sure you could have only one templateVM for everything, which means you only have to update dom0 and that templateVM. So in terms of maintenance thats really not that much more I guess? I think I might try that myself actually If you need persistence in the root filesystem, that could mean a standalone VM or a new VM. Last I tried I had trouble with their AppVM solution on that

bandrami 3y ago

The supply-chain problems that come with using flatpak so completely outweigh the minimal gains from sandboxing that I find it difficult to take this seriously.

nathants 3y ago

outbound firewalls like littlesnitch are bypassable, but at another layer of depth. visual prompt for unknown network attempt is probably good. would be nice to have similar prompts for the filesystem.

unsungNovelty 3y ago

This is why you have Arch wiki - https://wiki.archlinux.org/title/Security https://wiki.archlinux.org/title/Security. It is a living and breathing document which is updated and maintained for a long time now. It also has proper warning on usability and practicality effects. And how to do it. Everything mentioned here should be attainable in any Linux distro. Linux is like Firefox. Just like how Firefox comes with Google as the default search engine and other bad defaults. It is also the most configurable browser when it comes providing privacy to end users. Linux defaults sucks. But it is also the most configurable when it comes to security. And anyone recommending ChromeOS or MacOS are trading off privacy for security. Especially if you are recommending ChromeOS. Motivation and agenda > technical merit. Linux provides a good balance here.

drpixie 3y ago

Unfortunately the article fails to mention the most import aspect of security ... WHAT IS YOUR THREAT MODEL? Who/what are you protecting against? Without a clear answer to that, you're probably wasting your time. And check out Bruce Schneier for intelligent advice. https://www.schneier.com/ https://www.schneier.com/

lofaszvanitt 3y ago

Someone tell me how often threat actors or the angry neighbor poke in your swap partition to fish out things...

lenkite 3y ago

Really wish there are a wizard that did all this for you. Just click "harden" and wait till progress bar reaches 100%