I use Linux for quite a while and would like to gather some security advice, well known and lesser known.

Well known

Dont install random apps from the internet

This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.

So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after -i.

distrobox-create NAME -i IMAGE-NAME

This also goes for

  • Ubuntu PPAs
  • Arch AUR
  • Opensuse Build service repos
  • Fedora COPR
  • Random external repos

Some repos are more or less controlled, so be careful!

Some “external ones” are trusted, like:

  • Fedora/Derivates: rpmfusion
  • Flathub
  • Steam Fedora Repo
  • Google Chrome Fedora Repo (dont use Chrome lol)
  • Open-h264 from Cisco

Not all Flathub repos are controlled, but here is a list

Update, update, update

Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.

Wayland

X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like

  • using your Camera
  • using your Microphone
  • viewing your screen or specific app Windows
  • simulating input devices
  • watching for keypresses

Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means

  • XFCE
  • LXQt, LXDE
  • Budgie
  • Mate
  • Cinnamon

Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.

Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).

All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.

Less known

Avoid stable Distributions

Stable Distros dont get regular updates of every package that… gets an update, but they get backported security fixes.

Correct me if I am wrong, but not all security related bugs get a CVE (Common Vulnerabilities and Exposures) and thus dont get backported.

Stable Distributions are used everywhere on the internet though, so this could be debatable.

Use an “immutable” distro

Immutability is implemented in various ways, there is no standard at all

  • Android, Chromeos
  • Fedora Atomic (Silverblue, Kinoite, …)
  • Opensuse microOS (now Kalpa, Aeon)
  • VanillaOS
  • SteamOS

They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.

VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.

Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple rpm-ostree reset will reset your base system. It is the most secure of the customizable ones to my knowledge.

Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.

Also, changes to the core system through malware are not possible, at least not directly.

secure directories and dotfiles

An exception here is, if a malware would simply create a bash alias to anything. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.

https://madaidans-insecurities.github.io/linux.html#examples

So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.

sudo chmod 755 ~/.bashrc && sudo chown root ~/.bashrc
sudo chmod -R 700 ~/.ssh && sudo chown -R root ~/.ssh
sudo chmod -R 700 ~/.gnupg && sudo chown -R root ~/.gnupg
sudo chmod 755 ~/.zshrc && sudo chown root ~/.zshrc
sudo chmod -R 755 ~/.config/fish/ && sudo chown -R root ~/.config/fish/
sudo chmod -R 755 ~/.config/autostart && sudo chown root -R ~/.config/autostart
#sudo chmod -R 755 ~/.local/share/applications && sudo chown -R root ~/.local/share/applications

(7: read write exexecute, 5: read execute, “-R”, recursively)

This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.

Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in ~/.local/share/applications/ons anyways for some reason.

SELinux or Apparmor

I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.

Sandboxing

I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.

It is in early stages though.

Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.

For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.

Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.

Firmware updates & Coreboot

While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?

In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!

My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.

And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!

  • Novacustom for EU people, they partner with 3mdeb to support and ship Dasharo, a secure Coreboot Distro similar to Heads
  • System76 for US People
  • Starlabs also ships coreboot
  • 3mdeb sells PCs with Coreboot

Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.

Secureboot

Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.

Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.


What other tips do you know?

  • duncesplayed@lemmy.one
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.

    Also, the commands you gave in “secure directories and dotfiles” are not doing anything. sudo chmod 755 ~/.bashrc doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.

    If you want to make your dotfile require root access to change, you would need to augment the chmod with a sudo chown root ~/.bashrc

  • BCsven@lemmy.ca
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    1 year ago

    Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers.

  • chameleon@kbin.social
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Don’t bother “securing” directories like that. The meaningful permission bit is the write permission on the directory holding the file. cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc or the like will still work if you have write permissions to /home/username at all. Marking the file immutable with chattr +i as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you’ve only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn’t stop there.

    Don’t bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that’s good, though.

  • hottari@lemmy.ml
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Not a single mention of secure boot? Weird.

    I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.

    That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.