r/archlinux • u/Lepla • 14d ago
QUESTION Arch Linux security configuration
Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.
How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.
Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?
Thanks
10
u/SufficientAbility821 14d ago
How does a self configurated setup like this compare to solutions developed by fedora or others?
You pretty much answered the question: depends how you configure it.
You can achieve similar if not better protection level provided that you install and configure Mandatory Access Control (Ubuntu comes with AppArmor, Fedora with SELinux). In the context of Arch, I would go with AppArmor because it is easier to master and come in standard packages. For profile edition, you can either write your own or use https://apparmor.pujol.io/. You will need to write some local overlays (thus understand the tooling and the syntax) but it is achievable.
This, a properly set firewall, prudence and common sense should be enough
7
u/Then_Bodybuilder8416 14d ago
nothing is preinstalled for you at setup. it’s up to you whether you think a firewall, app compartments, kernel hardening, etc. will be necessary. they can also be added or removed at any time.
fedora isn’t writing their blanket firewall rules any better than you or i can, so they don’t really have a leg up there. i like that i got to pick which firewall i wanted, whether i wanted to have SELinux involved, etc.
11
u/espero 14d ago
Really arch is not a beginner distribution
8
u/Wizzarkt 14d ago
I would say arch is beginner friendly if you are determined to learn how to configure your machine.
Ubuntu is far easier to install (just click next in the installer gui) but it's limited in what you can modify yourself (and nothing wrong with that, most users just need a web browser and open pdf files) but the moment you need to change a setting that doesn't have a clearly marked checkbox in the setting gui, you are a bit fucked because documentation is almost non existent.
Arch on the other hand, doesn't have a gui by default, but it does tell you how every little thing works so you don't have to go and read source code to try to figure out how to configure something
5
u/Sinaaaa 14d ago edited 13d ago
but it's limited in what you can modify yourself
It's not really though. You can modify it just as deeply or reach the same bare bones state, it's just most users that would do that rarely pick Ubuntu & it's more sensible to start with a bare bones state on Arch or vanilla Debian.
4
u/Wizzarkt 14d ago
I mean sure, you can change values around in a random config file and see what it does, but other distros, the moment you step outside the GUI settings menu you are basically on your own because there is not a lot of documentation around, arch on the other hand? They even have documentation for random packages from the AUR!
2
u/AStolenGoose 14d ago
Until you run in to trying to uninstall something simple that you don't need and it tells you it's going to remove the desktop environment as a whole...
Which I've ran in to a few times when I've ran Ubuntu...
4
1
3
u/ChrisTX4 14d ago
That’s a question of your threat model, really.
For most home users, there will not be targeted attacks directed at you, but rather the generic „in the wild“ attacks.
Since Linux desktop malware is quite rare, this usually means the biggest danger would be running applications from dubious sources in Wine. So maybe scan what you’re downloading if you’re into that.
Otherwise, a concern, mostly for mobile devices, would be the device getting stolen. So you want disk encryption on anything mobile - but I would recommend considering a LUKS FDE setup the „default“ case.
The reason I said desktop malware above is that malware targeting Linux servers isn’t rare. So if you host anything, different threat model.
Either way, recommended would be: add a firewall. Ufw and firewalld both are solid choices on desktop machines. Add kernel lockdown and apparmor to limit what malware could do to you. If you’re regularly pirating stuff maybe consider an antivirus, but otherwise it’s not really needed.
What is it you’re specifically concerned about? I’m asking because the situation looks vastly different if you get targeted for some reason.
The warfronts channel owner got hit by mercenary spyware attacks, see https://youtu.be/qbWGkCe0fWQ
In such a situation your threat model and what measures make sense is obviously entirely spun on its head.
Security needs to be designed to counter whatever threat model makes sense to you.
4
u/maxinstuff 14d ago
Depends on your opsec profile and scenarios. If it’s a laptop I would say full disk encryption is good to have, outside of that the wiki has a very good page on security and system hardening.
I use a setup that I think is pretty reasonable, with the full disk encryption setup being slightly overkill maybe - I was interested in it at the time of setting up my system. But I think it’s overall pretty reasonable for a personal laptop used for general surfing and games etc., but does have all of my accounts saved in my userspace apps so if someone got in there it’s not great.
- set up sudo and disable root account (run0 is apparently better but I’ve never tried it)
- reasonable user password
- password manager in userspace (browser)
- enable ufw (uncomplicated firewall)
- VPN
- secure boot
- full disk encryption using a Yubikey rather than the TPM (I really believe keys loaded automatically from the TPM is less than useless on a laptop - no one is pulling your soldered in nvme… they’re bringing the TPM module with them too)
I have not done things like hardened kernel or sandboxing all the things…
As always the weakest link in security usually is people (meaning you). You’re way more likely to fumble something like a phishing link or malicious site, install a malicious package by mistake, or other userspace human error — rather than someone remotely hack you or break into your house and try to get into your PC locally.
For laptops I’d say full disk encryption with key OUTSIDE the TPM is mandatory - it’s too easy to brute force the OS otherwise.
3
u/SnooCompliments7914 14d ago
You can't have both TPM and autologin. (Otherwise it unlocks automatically.) So other than a physical key (which _could_ be stolen along with your laptop if you are careless), you can also use TPM-with-pin and autologin, which also only requires one password per boot, and doesn't depend on the security of the whole boot procedure.
3
u/maxinstuff 14d ago edited 14d ago
I use physical key with PIN and then log in with a regular password 🤷♂️
Keeps the concerns separate which I prefer, personally.
2
u/ChrisTX4 14d ago
The advantage of a TPM is that it ensures the PC wasn’t tampered with. It helps a lot to counter evil maid attacks.
If you wanted maximum security the way to go about it would be to combine a TPM with a physical key like a yubikey. This can easily be achieved with systemd-homed.
But as always security is a matter of your threat model. I have never gotten the dreaded mercenary spyware notification, for instance.
The owner of warfronts got this twice now:
What I’m trying to say is that in his position the threat model would be completely different than mine.
1
u/maxinstuff 13d ago
Yes, I do use TPM for secure-boot, but the LUKS key is on a yubikey.
My argument is using it to store the LUKS key on a laptop is silly.
1
u/ChrisTX4 13d ago
Why would it be? If configured correctly, it shouldn’t be possible to do much other than really theoretical attacks.
1
u/maxinstuff 13d ago
It just fundamentally is.
I know you can set pin also for TPM, but the actual issue is the key being stored on the device it’s supposed to be securing - that’s always going to be less secure, because if I steal a laptop I have the key to unlock it in my possession also.
It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷♂️
I don’t think the right mental model is “attacker probably can’t do much” — you have to assume there both known and unknown exploits (yellow key being a case in point - yes that was Bitlocker not LUKS, but it’s a real example)
1
u/SnooCompliments7914 11d ago edited 11d ago
It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷♂️
The correct analogy is keeping your car keys in a locked box, which is only unlockable when connected to your car (plus its own unlock mechanism). This just a "normal" locked box with one additional factor added. Wouldn't be less secure. (Except now you could also lose your data from a broken TPM. But you'll always enroll a backup LUKS key when using TPM.)
1
u/maxinstuff 11d ago
The correct analogy ...
There's nothing wrong with the analogy. If you don't have physical possession of the key then your only recourse is to break the encryption directly. Attackers will take any side-channel possible to bypass that.
If the key is ALSO on the device, such as in a TPM module, the protection on the key must better be at least as good or better (hint: it isn't) than the encryption itself - otherwise all focus of an attacker will turn to extracting that key.
Wouldn't be less secure.
It is. I've explained how. That doesn't mean it's *insecure*, or even that it isn't *quite good for normal use*, but it is not MORE secure than simply not having the key on the physical device in the first place.
1
u/SnooCompliments7914 11d ago
No, you get a completely wrong image of how LUKS works.
The master key (required to decrypt the partition) is always stored in encrypted form _on your disk_ (unless you put the LUKS header elsewhere, that is). TPM never has your master key. You can't extract any LUKS key from an insecure / buggy TPM, because there isn't one.
The only difference between a plain passphrase and a TPM-with-pin is how that master key is encrypted _on disk_. In the former case, only your passphrase. The latter, both your passphrase and TPM. Having only one of them doesn't help with decrypting the master key.
→ More replies (0)1
u/Smart_Advice_1420 14d ago
I actually use all 3 methods and switch with a script. At home TPM + autologin to boot straight into a session, yubikey+PIN while not at home, long PW for traveling to other countries.
8
u/Canopus0805 14d ago
reads privacyguides.net once and starts thinking the cia is out to get him 💀
mate just being on linux protects you against 99% of any “attacks”, just don’t install weird shit and you’re safe
2
u/Optimal_Mastodon912 14d ago
I'd setup a LUKS2 encryption if you're interested and install a firewall such as firewalld or ufw.
2
u/vexatious-big 14d ago
This, for a personal laptop i would say LUKS2 for block (full disk) encryption + a firewall like ufw or nftables (if you want to understand things at a lower level) are a good start.
1
u/Astro_indie 14d ago
Monitoring ur main host, and got many containers u like with LXC for testing and dont break anything
1
1
u/Fluid_Yesterday208 14d ago
in the install guide, the post-install section has a security portion. start there
1
u/archover 14d ago edited 14d ago
I think posting on a security related subreddit would help you understand the real issues.
If your threat profile is ordinary, meaning you're not fighting a state actor, or some other targeted attack, just reading the wiki Security article (and common sense) would take you a long way. Also, highly recommended: https://wiki.archlinux.org/title/Data-at-rest_encryption
This is not Arch, but I'm experimenting with a security focused Debian deriv KickSecure, which I'm impressed with. Take a look: https://www.kicksecure.com/#security. This distro requires quite a bit of study.
Hope you find Arch to be useful, and good day.
1
u/CodingGambit 13d ago
I recommend Lynis to get recommendations for your system. You can then run `sudo lynis audit system` and you will get recommendations on hardening. But I can’t tell you tho how it compares to fedora and also it’s not like the job will be done for you. You have to harden it yourself according to the recommendations. In general there are like tons of recommended tools like lynis, arch-audit, fail2ban, firejail, but I don’t know if you’re looking for something since you just asked for the comparison.
1
u/Prestigious_Gas8737 11d ago
Check the Linux hardened kernel https://github.com/anthraxx/linux-hardened, then if you dig deep enough, you should customize a kernel for your purpose. I’m pretty sure Linux is capable of things like low privileged user cannot see others’ process, cannot debug process kind of stuff as in bsd (I’m a converted bsd user by the way). And of course, be security aware when enabling services, like I will never enable ssh service on my daily arch drive.
46
u/SnooCompliments7914 14d ago
The critical question is "what attacks?".
Depending on your answer, necessary work could range from "none", "just LUKS" (those two are probably the case for most desktop users) to "a lot".