Linux @lemmy.ml Pantherina @feddit.de 12 mo. ago

Security advise collection - what do you recommend?

I use Linux for quite a while and would like to gather some security advice, well known and lesser known.

Well known

Dont install random apps from the internet

This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.

So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after -i.

distrobox-create NAME -i IMAGE-NAME

This also goes for

Ubuntu PPAs
Arch AUR
Opensuse Build service repos
Fedora COPR
Random external repos

Some repos are more or less controlled, so be careful!

Some "external ones" are trusted, like:

Fedora/Derivates: rpmfusion
Flathub
Steam Fedora Repo
Google Chrome Fedora Repo (dont use Chrome lol)
Open-h264 from Cisco
...

Not all Flathub repos are controlled, but here is a list

Update, update, update

Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.

Wayland

X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like

using your Camera
using your Microphone
viewing your screen or specific app Windows
simulating input devices
watching for keypresses

Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means

XFCE
LXQt, LXDE
Budgie
Mate
Cinnamon
...

Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.

Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).

All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.

Less known

Avoid stable Distributions

Stable Distros dont get regular updates of every package that... gets an update, but they get backported security fixes.

Correct me if I am wrong, but not all security related bugs get a CVE (Common Vulnerabilities and Exposures) and thus dont get backported.

Stable Distributions are used everywhere on the internet though, so this could be debatable.

Use an "immutable" distro

Immutability is implemented in various ways, there is no standard at all

Android, Chromeos
Fedora Atomic (Silverblue, Kinoite, ...)
Opensuse microOS (now Kalpa, Aeon)
VanillaOS
SteamOS

They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.

VanillaOS and Opensuse microOS use a different form of "regular package management but atomic", so the change does not apply to the running system but to a clone of it, being applied on reboot.

Fedora Atomic goes the "Cloud way" with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple rpm-ostree reset will reset your base system. It is the most secure of the customizable ones to my knowledge.

Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.

Also, changes to the core system through malware are not possible, at least not directly.

secure directories and dotfiles

An exception here is, if a malware would simply create a bash alias to anything. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.

https://madaidans-insecurities.github.io/linux.html#examples

So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.

sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc
sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh
sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg
sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc
sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/
sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart
#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications

(7: read write exexecute, 5: read execute, "-R", recursively)

This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.

Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in ~/.local/share/applications/ons anyways for some reason.

SELinux or Apparmor

I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.

Sandboxing

I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.

It is in early stages though.

Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.

For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.

Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.

Firmware updates & Coreboot

While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?

In most cases, especially for "Laptops with good Linux compatibility" that may be older Laptops, decommissioned Company devices, older Thinkpads... and they all probably dont get Firmware updates anymore!

My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.

And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!

Novacustom for EU people, they partner with 3mdeb to support and ship Dasharo, a secure Coreboot Distro similar to Heads
System76 for US People
Starlabs also ships coreboot
3mdeb sells PCs with Coreboot

Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.

Secureboot

Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.

Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.

What other tips do you know?

16 comments

Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc or the like will still work if you have write permissions to /home/username at all. Marking the file immutable with chattr +i as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.

Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
- Thats important... are you sure you can delete files without write permission? Couldnt this be avoided? Because if you cant delete or write to a file, it is basically immutable right?
  
  Chown sudo is still missing so currently its useless. But how do you do that without a root account?
  
  Yeah, spectre is really bad...
I don't agree with avoiding stable distros. In the case of Debian for example stable gets priority on security patches. Just subscribe to the security mailing list and have auto updates on.

Also download any disto or bleeding edge container and scan it and you'll have vulnerabilities in some library. The ecosystem is always moving. The question is how exposed are you.

Use a firewall, secure your browser and whitelist sites you trust to run JS. Stick to repos. Scan downloaded files via virus total or open In a vm. Dont install what you dont need.

You are far more likely to get compromised in a site breach than to get hacked. The browser is the main attack vector that you need to secure.

Also dont run servers if you dont know what you are doing. Use a non networked VM to practice.

Dont blindly paste commands and be sure to read the source before you compile and run some random program.

Watch out for rogue containers and libraries .
Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE's zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers.
- Good point about "no new security issues". But new issues mostly also mean zero days so this is very less likely that old bugs that didnt get a CVE. But I dont know the details, what bugs Debian backports always, I just assume its not all.
As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.

Also, the commands you gave in "secure directories and dotfiles" are not doing anything. sudo chmod 755 ~/.bashrc doesn't change the ownership of the file: it's still owned by you. So setting the permissions 755 just makes it writeable by...you. You will still be able to modify it without sudo.

If you want to make your dotfile require root access to change, you would need to augment the chmod with a sudo chown root ~/.bashrc
- Thanks yes I forgot to mention that.
Not a single mention of secure boot? Weird.

I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.

That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.
In general, the articles found on privsec.dev are excellent reads and provide both guidance and motivation. With their article on Desktop Linux Hardening being my personal favorite.
- Careful with MAC randomization in your local Wifi. DHCP goes brrrr
Great List. I’m not to much into security so I can’t add anything
The desktop security model is insecure in general. Phone OSes are much more secure.

Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)

Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.

Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)

Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.

This all doesn't matter if you're running an EoL device. Make sure your receiving official security and firmware updates.

that's about it
- The thing is I use Noscript so I guess having random malicious Javascript executed is pretty rare. And Firefox + Arkenfox is so much more private than damn Chromium, even though I keep a Flatpak of Chromium around.
  
  I understand that the hardened Fedora Ublue version from qoijjj isn't that far off, maybe removing flatpaks is a bit weird and makes little sense.
  
  I am pretty sure I wont use Chromium, as Firefox is just working better for me? Everything makes sense, and for sure I wont give Google any Data.
- The base assumption here is you trust corporations such as IBM, Google, MS, and only consider security threats from minor individual actors.
  
  There is no secure way to run any gecko/chrome based app if you don't trust google.
  
  @Genghis @Pantherina
  
  A lot of the security work on Linux is being done by Google. It's highly unlikely they are putting backdoors in their products.
Eh, I don't have anything "complex" to add, other than buying a raspberry pi and using it as a DNS sinkhole/recursive dns under docker/ipvlan network, and then "hiding" it behind a macvlan connection + ufw. Been doing this over several years and never had any problems with it. You can even use it as a music player of sorts by configuring a hotkey to bring up mpv with a playlist, and another one to close it. Oh, and even as a "live stream player 24/7" if you are into it.

You've viewed 16 comments.